Hi, We are trying to limit the maxKBps of a couple forwarders to 30 KBps. We are doing this because the app on those servers keeps messing up and logging gigabytes upon gigabytes per hour, which violates our license usage.
In limits.conf in the system local directory I have specified the following stanza:
[thruput]
maxKBps = 30
(30 kbps is more than enough to let this server index their logs at a good pace while not breaking our bank when their app screws up)
Now, when I parse through our log files, I keep getting KBps thruput higher than this.
grep tcpout_connections /lcl/logs/splunk/metrics.log | awk '{print $12}' | tail -17
_tcp_KBps=0.01,
_tcp_KBps=0.01,
_tcp_KBps=0.01,
_tcp_KBps=0.01,
_tcp_KBps=0.07,
_tcp_KBps=0.01,
_tcp_KBps=0.01,
_tcp_KBps=0.01,
_tcp_KBps=0.71,
_tcp_KBps=162.86,
_tcp_KBps=289.25,
_tcp_KBps=284.02,
_tcp_KBps=303.00,
_tcp_KBps=307.52,
_tcp_KBps=307.61,
_tcp_KBps=303.70,
_tcp_KBps=303.26,
This is not an isolated incident, I have seen it shoot up to 912, or 168, etc. It shouldn't go higher than 30 KBps. Any assistance or input in this matter would be appreciated (And no, we dont want to go to a lightweight forwarder, we just want the throughput limited)
... View more