Implementing Splunk 7, Third Edition - Third Edition

Monitoring logs on servers

In this scenario, servers write their logs to a local drive, and a forwarder process monitors these logs. This is the typical Splunk installation.

The advantages of this approach include the following:

• This process is highly optimized. If the indexers are not overworked, events are usually searchable within a few seconds.
• Slowdowns caused by network problems or indexer overload are handled gracefully. The forwarder process will pick up where it left off when the slowdown is resolved.
• The agent is light, typically using less than 100 megabytes of RAM and a few percent of one CPU. These values go up with the amount of new data written and the number of files being tracked. See inputs.conf in Chapter 11, Configuring ...