What happens when the UF service is stopped?

[sjcoluccio67]

I have UFs deployed to many systems monitoring Windows event logs. I need to stop the SplunkForwarder service on some of these systems for about a day to do some testing. Will the UF pick back up from where it left off in the event logs or will I lose the logs from the day that the service is stopped? Does the UF queue up incoming logs while it is stopped or does it have a place marker that it goes back to in the logs once it is turned back on?

[ddrillic]

A place marker describes it well ; - )

[sudosplunk · Accepted solution]

Splunk has something called fishbucket which keeps track of what data is indexed. With help of this, as long as the logs are not rolled over, UF will pick up where it left off.

Persistent queuing lets you store data in an input queue to disk. This can help prevent data loss if the forwarder or indexer gets backed up. You can use this setting to store any data in flight to disk.

By default, forwarders and indexers have an in-memory input queue of 500KB.

Please refer to this link for more information about how monitor processor works.

[akocak]

if you stop forwarder from CLI, i believe it should send what it has in its buffer and then stop the service.
When you re-start the service after your maintenance, it will continue by looking fishbucket index which holds file read information ( where to continue reading etc... ) . Therefore, you should NOT be missing any data from outage unless you have some logs disappears due to log rotation etc..