-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Jan 13, 2011, at 2:09 PM, dan (ddp) wrote: > I'm not disagreeing with you because I haven't done any testing, but > according to splunk the light forwarder shouldn't use more than about > 25MB of ram and 256kb of network. > The trainer also mentioned he had helped with an installation where a > splunk LF was installed on every desktop/laptop in the organization. > Seemed like a neat idea, but knowing the machine I use at work even > with the resource limits it could be a bit much.
You don't necessarily need to use the light forwarder, though. You can always use push the data to splunk using something like rsyslog or syslog-ng. The biggest difference here is that the spiunk will give you the ability to do SSL. There was also mention of a new light forwarder coming "soon" that will really be a light installation. Right now the light forwarder is a full splunk install with just a few items turned on. This new forwarder, I believe they're calliing it the ultra light forwarder, will be stripped down to the bare minimum. - --------------------------- Jason 'XenoPhage' Frisvold xenoph...@godshell.com - --------------------------- "Any sufficiently advanced magic is indistinguishable from technology." - - Niven's Inverse of Clarke's Third Law -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) iEYEARECAAYFAk06T0cACgkQ8CjzPZyTUTQm1QCfdJ6nYjf/cvpugTb6q9pyp3Rp srQAn1nzJNSJV7X74ACSYpsGCC8MrGq1 =SOOT -----END PGP SIGNATURE-----
