Recommended free disk space requirement to be allocated for the Collector to operate

Question:

How much free disk space is recommended to be allocated to the filesystem for the Collector to operate, and what is the reason behind this recommendation?

Answer:

Sumo Logic recommends initially allocating 8GB of disk space for the operation of the Sumo Logic Collector, though over time you may see your specific use of the Collector may require less space than this.

This recommendation is based on the following:

1.) During normal operation, the Collector will store information about the files it has previously collected. This information is stored as JSON files on disk and these tell the Collector what is has read from a specific file matched by your Sources. The number and size of these files will vary depending on the number of Sources configured and the number of files you are collecting via your Source path expressions.

2.) In cases where a Script Action has been configured for a Collector, and a Scheduled Search has been configured to trigger that action, the results of a scheduled search will be received by the Collector host. This output is stored as a JSON file within the /alerts directory of the Collector and may be used by your provided script to perform further processing on those search results. The size of these files may vary depending on the output of your Scheduled Searches and the number of Scheduled Searches you have configured to trigger an action.

3.) In the case of a temporary network connection issue or period of time where your overall ingest may be higher than your contracted terms allow (see throttling) the Collector will compress and cache to disk any data it is unable to send to the service. By default Sumo Logic will cache up to 3GB of compressed data to disk. Once connectivity is restored, or ingest levels have reduced, the Collector will send any data stored in this cache ensuring that all your log data has all been delivered.