I ran into a similar problem with the latest version of the Universal Forwarder (5.0.4) eating up pretty much all my 3 hosts' 8 GB of RAM, then eating all the swap, and ultimately causing it to fall over.
What fixed it for me was disabling a rogue input in the Unix app that I'd installed, which was generating large numbers of errors in the splunkd.log along the following lines...
08-02-2013 11:12:17.610 +0100 WARN FilesystemChangeWatcher - error reading directory "/home/[blahblah]": Permission denied
08-02-2013 11:12:17.699 +0100 ERROR TailingProcessor - Unable to resolve path for symlink: /home/[blahblah].
Basically, it looks as though the Splunk agent wasn't able to successfully read the contents of users' home directories which seemed to be causing it to leak memory.
The input I ended up disabling was:
[monitor:///home/.../.bash_history]
Since then, no more memory leakage... so far!
... View more