All Apps and Add-ons

What happens when the UF service is stopped?

sjcoluccio67
Explorer

I have UFs deployed to many systems monitoring Windows event logs. I need to stop the SplunkForwarder service on some of these systems for about a day to do some testing. Will the UF pick back up from where it left off in the event logs or will I lose the logs from the day that the service is stopped? Does the UF queue up incoming logs while it is stopped or does it have a place marker that it goes back to in the logs once it is turned back on?

1 Solution

sudosplunk
Motivator

Splunk has something called fishbucket which keeps track of what data is indexed. With help of this, as long as the logs are not rolled over, UF will pick up where it left off.

Persistent queuing lets you store data in an input queue to disk. This can help prevent data loss if the forwarder or indexer gets backed up. You can use this setting to store any data in flight to disk.

By default, forwarders and indexers have an in-memory input queue of 500KB.

Please refer to this link for more information about how monitor processor works.

View solution in original post

ddrillic
Ultra Champion

A place marker describes it well ; - )

0 Karma

sudosplunk
Motivator

Splunk has something called fishbucket which keeps track of what data is indexed. With help of this, as long as the logs are not rolled over, UF will pick up where it left off.

Persistent queuing lets you store data in an input queue to disk. This can help prevent data loss if the forwarder or indexer gets backed up. You can use this setting to store any data in flight to disk.

By default, forwarders and indexers have an in-memory input queue of 500KB.

Please refer to this link for more information about how monitor processor works.

akocak
Contributor

if you stop forwarder from CLI, i believe it should send what it has in its buffer and then stop the service.
When you re-start the service after your maintenance, it will continue by looking fishbucket index which holds file read information ( where to continue reading etc... ) . Therefore, you should NOT be missing any data from outage unless you have some logs disappears due to log rotation etc..

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...