Is there any built-in mechanism (e.g. settings in limits.conf or server.conf) that would throttle the execution of the Splunk Universal Forwarder in such a way that it stops collecting perfmon data (via the Splunk Add-on for Microsoft Windows) if the host was under distress with high CPU or high memory utilization?
I am not talking about throttling data output or throughput. This is not a matter of limiting outgoing data.
Instead, I am talking about the collection scripts not running when the system is heavily loaded. I cannot reproduce it on my Windows 7 system, but I seem to recall seeing it a long time ago and someone else is reporting that they have observed this behavior.
The perfmon collections resumes once the system is no longer under distress, so that is why I suspected that there might be some configuration option that tells the forwarder to stop collecting if a certain CPU threshold is reached.
↧