title: How does Splunk monitor Files/Directories and what is the performance impact?
body: <p>I'm wondering what is the implementation of Splunk Files/Directory Monitor feature that ensures the small footprint on the performance of the system running the Data Collector (in terms of CPU, memory and disk I/O)?</p>
  <p>I'm asking since we are considering running an Universal Forwarder on a production machine to forward and monitor its log, but we would like to best analyze the performance hit to make sure it doesn't affect the availability of the service in production.</p>