|
I am in the process of testing the integration of Splunk into our enterprise system and have been asked by our architect to determine the performance impact of the universal forwarder. I have read extensively through the documentation and all I can find is the ‘marketing terms’ “extremely lightweight “, “low impact” etc. This unfortunately does not satisfy my superiors!
I have tested the universal forwarder in situ and have sufficient figures on all areas but memory usage, in particular hard disk space. I have two questions
1. The metrics logs seem to roll, it looks like they keep approx 14days of information, is 14 days the cycle? Or are they based on something else? Assuming our production quantities remain stable is this a consistent quantity of data? Or to ask the same question in a different manner, the metrics logs are currently 150mb will they remain so? Thanks |
|
Have a look at this link regarding configuring logging settings. Futhermore, Universal Forwarders monitor their own $SPLUNK_HOME/var/log/splunk directory into the _internal index and then your outputs.conf can forward these events onto their configured indexer(s).So the log files will roll, but the data will be searchable in the _internal index for as long as you keep it. Regarding core dumps , have a look at this previously answered post . |
thanks for that Just in case anyone follows this trail the answer to question 1: Default is 25mb files 5 archived and 1 current.
To alter these details go to $SPLUNK_HOME/etc/log.cfg