<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Smartstore:SmartStore cache is not respecting cache limits in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/Smartstore-SmartStore-cache-is-not-respecting-cache-limits/m-p/480820#M4281</link>
    <description>&lt;P&gt;Smartstore doesn't appear to be respecting our disk usage limits via the DiskUsage &amp;amp; CacheMan stanzas (minFreeSpace &amp;amp; max_cache_size respectively). Is there way to purge smartstore data that is using this excessive space? i've attached a diag from one of our peers &amp;amp; our cluster master.&lt;/P&gt;</description>
    <pubDate>Wed, 30 Sep 2020 04:22:54 GMT</pubDate>
    <dc:creator>rbal_splunk</dc:creator>
    <dc:date>2020-09-30T04:22:54Z</dc:date>
    <item>
      <title>Smartstore:SmartStore cache is not respecting cache limits</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Smartstore-SmartStore-cache-is-not-respecting-cache-limits/m-p/480820#M4281</link>
      <description>&lt;P&gt;Smartstore doesn't appear to be respecting our disk usage limits via the DiskUsage &amp;amp; CacheMan stanzas (minFreeSpace &amp;amp; max_cache_size respectively). Is there way to purge smartstore data that is using this excessive space? i've attached a diag from one of our peers &amp;amp; our cluster master.&lt;/P&gt;</description>
      <pubDate>Wed, 30 Sep 2020 04:22:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Smartstore-SmartStore-cache-is-not-respecting-cache-limits/m-p/480820#M4281</guid>
      <dc:creator>rbal_splunk</dc:creator>
      <dc:date>2020-09-30T04:22:54Z</dc:date>
    </item>
    <item>
      <title>Re: Smartstore:SmartStore cache is not respecting cache limits</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Smartstore-SmartStore-cache-is-not-respecting-cache-limits/m-p/480821#M4282</link>
      <description>&lt;P&gt;Splunk has attribute  max_cache_size that set the limit for cacahemanager &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;server.conf 
[cachemanager]
eviction_padding = 10% of disk Space on Partition (in bytes)
Refer: https://docs.splunk.com/Documentation/Splunk/7.1.4/Admin/Serverconf
max_cache_size=0
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Given that max_cache_size is not accounting for hot data, it is likely that space usage is going to be above max_cache_size.o limit the disk usage for both hot data + cached data, you can use minFreeSpace to restrict total disk usage. However, you need to have reasonable total space so hot buckets are not overcrowding the cache.&lt;BR /&gt;
Splunk component &lt;STRONG&gt;CacheManager&lt;/STRONG&gt; when put in debug mode provides the stats for key attribute that contribute to the size of Cacahemanager.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;02-05-2020 21:09:41.898 +0000 DEBUG CacheManager - The system has freebytes=75354976256 with minfreebytes=5242880000 cachereserve=5368709120 totalpadding=10611589120 buckets_size=313491456 maxSize=314572800
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;"The system has freebytes=" &amp;gt; freeBytes&lt;BR /&gt;
" with minfreebytes=" &amp;gt; minFreeBytes&lt;BR /&gt;
" cachereserve=" &amp;gt; evictionReservedBytes&lt;BR /&gt;
" totalpadding=" &amp;gt; minFreeBytes + evictionReservedBytes&lt;BR /&gt;
" buckets_size=" &amp;gt; buckets_size&lt;BR /&gt;
" maxSize=" &amp;gt; maxSize&lt;/P&gt;

&lt;P&gt;Now here is some information on each of this attribute.&lt;/P&gt;

&lt;P&gt;1) " maxSize=" &amp;lt;&amp;lt; _maxSize;&lt;BR /&gt;&lt;BR /&gt;
Now this comes from &lt;/P&gt;

&lt;P&gt;*&lt;EM&gt;max_cache_size = *&lt;/EM&gt;&lt;BR /&gt;
* Specifies the maximum space, in megabytes, per partition, that the cache can&lt;BR /&gt;
  occupy on disk. If this value is exceeded, the cache manager starts&lt;BR /&gt;
  evicting buckets.&lt;BR /&gt;
* A value of 0 means this feature is not used, and has no maximum size.&lt;BR /&gt;
* Default: 0&lt;/P&gt;

&lt;P&gt;2) " buckets_size=" &amp;lt;&amp;lt; buckets_size&lt;BR /&gt;
Now this is the total size of the buckets calculated.&lt;/P&gt;

&lt;P&gt;3) " totalpadding=" &amp;lt;&amp;lt; minFreeBytes + evictionReservedBytes&lt;/P&gt;

&lt;P&gt;we can see here that totalpadding=10611589120 = (minfreebytes+cachereserve) = (5242880000+5368709120) &lt;/P&gt;

&lt;P&gt;From the below, we can see that buckets_size can get bigger than maxSize for a temporary period but eventually we will slash it down to maxSize(max_cache_size) OR lesser.&lt;/P&gt;

&lt;P&gt;Here in this example, we have&lt;/P&gt;

&lt;P&gt;As you can see how buckets_size is varying with maxSize wrt time. Once we have buckets_size growing above maxSize, the CacheManager will ensure that we evict something and get back within maxSize.&lt;BR /&gt;
server.conf&lt;/P&gt;

&lt;P&gt;[cachemanager]&lt;BR /&gt;
max_cache_size = 300&lt;/P&gt;

&lt;P&gt;&lt;IMG src="https://community.splunk.com/storage/temp/285611-cachesize.png" alt="alt text" /&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 30 Sep 2020 04:22:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Smartstore-SmartStore-cache-is-not-respecting-cache-limits/m-p/480821#M4282</guid>
      <dc:creator>rbal_splunk</dc:creator>
      <dc:date>2020-09-30T04:22:56Z</dc:date>
    </item>
  </channel>
</rss>

