https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-swapping-why/m-p/90331#M22629 <P>Last days I increased thruput parameter on 2 splunkforwarders:</P> <PRE><CODE>[thruput] maxKBps = 4096 </CODE></PRE> <P>From 256kbps to 4096kbps. Do You think that could be a reason of swapping ?</P> Thu, 11 Apr 2013 11:20:58 GMT konradwawryn 2013-04-11T11:20:58Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-swapping-why/m-p/90329#M22627 <P>Hi, </P> <P>I have a problem with my server. Since few weeks we have high load on the server. Today I saw for the first time SWAP on the server. The funny thing is that I still have free RAM memory on the server. </P> <P><IMG src="http://i.cubeupload.com/ASTQ4H.png" alt="alt text" /></P> <P>Do You know why Splunk swapping ? Would be great if somebody could support me and tell me how to reduce swap.</P> Thu, 11 Apr 2013 08:51:25 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-swapping-why/m-p/90329#M22627 konradwawryn 2013-04-11T08:51:25Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-swapping-why/m-p/90330#M22628 <P>Hi konradwawryn</P> <P>since swapping is controlled by the OS, you should troubleshot/check your OS settings like <A href="http://en.wikipedia.org/wiki/Swappiness">swapiness</A> for example. You also have the possibility to set some memory related limits in splunks <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Limitsconf">limits.conf</A> - but be warned, that you also can break stuff very easily there.</P> <P>I can recall that in some older 4.2.x version there was a bug, causing the OS to use huge amount of swap (like 20 or 30Gb) but this was fixed later.</P> <P>cheers, MuS</P> Thu, 11 Apr 2013 10:52:21 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-swapping-why/m-p/90330#M22628 MuS 2013-04-11T10:52:21Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-swapping-why/m-p/90331#M22629 <P>Last days I increased thruput parameter on 2 splunkforwarders:</P> <PRE><CODE>[thruput] maxKBps = 4096 </CODE></PRE> <P>From 256kbps to 4096kbps. Do You think that could be a reason of swapping ?</P> Thu, 11 Apr 2013 11:20:58 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-swapping-why/m-p/90331#M22629 konradwawryn 2013-04-11T11:20:58Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-swapping-why/m-p/90332#M22630 <P>This setting has an impact to the forwarder only, since it tells the forwarder how much data it can send a once. Does the forwarder really send so much data? You can check that in metrics.log or in the deployment App or the S.o.S. App. </P> <P>Other thing you can do if possible, revert back the change on the forwarder and see what happens.</P> Thu, 11 Apr 2013 11:37:14 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-swapping-why/m-p/90332#M22630 MuS 2013-04-11T11:37:14Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-swapping-why/m-p/90333#M22631 <P>I have connected 30 machines with application servers to Forwarder. We had a delay in Splunk indexers. Thats why I extended that parameter. </P> <P>This swap is strange. </P> <P>Could it be that Splunk storing data to index in swap memory ?</P> Thu, 11 Apr 2013 12:08:14 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-swapping-why/m-p/90333#M22631 konradwawryn 2013-04-11T12:08:14Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-swapping-why/m-p/90334#M22632 <P>have a look at this answer <A href="http://splunk-base.splunk.com/answers/78921/splunkd-using-too-much-ram">http://splunk-base.splunk.com/answers/78921/splunkd-using-too-much-ram</A> and keep analyzing what splunkd is using swap</P> Thu, 11 Apr 2013 12:52:44 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-server-swapping-why/m-p/90334#M22632 MuS 2013-04-11T12:52:44Z