![]() ![]() Step 4: Reboot the OS, and confirm within splunkd.log that your Splunk process is under the correct settings.ĭon’t just restart Splunk. Step 3: Make /etc/rc.d/rc.local executable THP=`find /sys/kernel/mm/ -name transparent_hugepage -type d | tail -n 1` Add the following to the bottom of your /etc/rc.d/rc.local file: There are two sets of configurations for THP, depending on if you are using RedHat Enterprise Linux or some other variant distribution. Ls: cannot access /sys/kernel/mm/redhat_transparent_hugepage/: No such file or ~]# ls /sys/kernel/mm/transparent_hugepage/ You can use the ls command to confirm which one works for your ~]# ls /sys/kernel/mm/redhat_transparent_hugepage/ The actual RHEL distribution uses a slightly different path: /sys/kernel/mm/redhat_transparent_hugepage/ – you may need to modify the code in this step to reflect the correct version of this for your system. Note the information in this step pertains to derivatives of Red Hat Enterprise Linux (RHEL) that use the THP settings in /sys/kernel/mm/transparent_hugepage. Step 2: Add a script to /etc/rc.d/rc.local ![]() Note that it is unsafe to apply the settings to all users unless the machine is ONLY in use for Splunk (this should be the case, however). If you are running as root or some other user, it is appropriate to replace “Splunk” with the name of that user or an asterisk * to apply the settings to all users. If this system is running Splunk as a user called “splunk,” add the following to the bottom of the /etc/security/nf file: Step 1: Set ulimit settings in /etc/security/nf as root These steps should be followed on all parts of your Splunk Server Infrastructure (All Search Heads, Indexers, Heavy Forwarders, Syslog Forwarders). ![]() We have found it necessary to do ALL of these steps in order to deal with all of the different complexities of getting this right, especially in cases to ensure these settings survive a restart AND are actually applied to the Splunk processes. By following this procedure, you will eliminate the risk of meeting OS imposed limits that impede high-performance Splunk operation, regardless of how the Splunk process is started or if any boot-time race conditions exist.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |