Hi everyone,
Thank you for your time. My question is sample:
is it possible to cap this three parameters:
- CPU
- RAM
- DISK
On a Universal Forwarder, installed like a agent for monitoring file and fschange. I think that UF don't write on Disk, just on RAM. is it true ?
I know that is possible to cap bitrate in output.conf and EventQueue, but for CPU and RAM footprinting of process itself, not Queue ?
Thank you and have a nice day.
Nicolas.
This must be accomplished outside the Splunk application(s). Use OS level controls, so as ulimit settings on *Nix systems, or things like Cgroups in RHEL based systems.
OK.
Thank you for your answer.
But, I regret not having the opportunity to cap CPU and RAM footprint.
Customers are worried.
Is it possible to gives some ideas for roadmap ?
Nicolas.
I second this. Worries are abound. We just had a DNS server crash and splunk-regmon was using almost 4GB of virtual memory.....