https://community.splunk.com/t5/Monitoring-Splunk/Why-does-SPLUNK-recommend-setting-the-ulimit-settings-for-core/m-p/210061#M7948 <P>A lovely explanation especially for the indexers at <A href="http://blogs.splunk.com/2011/11/21/whats-your-ulimit/">What's Your ulimit</A></P> <P>It says -</P> <P>-- Therefore, a super safe ulimit will be 8 x # forwarders to account for the additional file descriptors Splunk will need for reading/writing during indexing/searching. This setting is very important for indexers as we are expecting constant concurrent connections from forwarders.</P> <P>Now if you have a 1000 forwarders, like us, we can see why the ulimit should be high...</P> <P>It also says -<BR /> -- It doesn’t hurt to remove the hard limit and set ulimit to unlimited… unless there is some kind of file descriptor leak in Splunk. Such a leak can go undetected for a long time and consume more and more resources. We don’t expect this to happen since we do monitor specifically for these types of problems in our longevity tests conducted with 1000 forwarders across 10 indexers over many days with ulimit set at 2048.</P> Tue, 14 Jun 2016 16:09:37 GMT ddrillic 2016-06-14T16:09:37Z https://community.splunk.com/t5/Monitoring-Splunk/Why-does-SPLUNK-recommend-setting-the-ulimit-settings-for-core/m-p/210060#M7947 <P>The ulimit -c (for core file size) currently reads:</P> <P>core file size (blocks, -c) 0</P> Tue, 14 Jun 2016 15:00:11 GMT https://community.splunk.com/t5/Monitoring-Splunk/Why-does-SPLUNK-recommend-setting-the-ulimit-settings-for-core/m-p/210060#M7947 M2016G0216 2016-06-14T15:00:11Z https://community.splunk.com/t5/Monitoring-Splunk/Why-does-SPLUNK-recommend-setting-the-ulimit-settings-for-core/m-p/210061#M7948 <P>A lovely explanation especially for the indexers at <A href="http://blogs.splunk.com/2011/11/21/whats-your-ulimit/">What's Your ulimit</A></P> <P>It says -</P> <P>-- Therefore, a super safe ulimit will be 8 x # forwarders to account for the additional file descriptors Splunk will need for reading/writing during indexing/searching. This setting is very important for indexers as we are expecting constant concurrent connections from forwarders.</P> <P>Now if you have a 1000 forwarders, like us, we can see why the ulimit should be high...</P> <P>It also says -<BR /> -- It doesn’t hurt to remove the hard limit and set ulimit to unlimited… unless there is some kind of file descriptor leak in Splunk. Such a leak can go undetected for a long time and consume more and more resources. We don’t expect this to happen since we do monitor specifically for these types of problems in our longevity tests conducted with 1000 forwarders across 10 indexers over many days with ulimit set at 2048.</P> Tue, 14 Jun 2016 16:09:37 GMT https://community.splunk.com/t5/Monitoring-Splunk/Why-does-SPLUNK-recommend-setting-the-ulimit-settings-for-core/m-p/210061#M7948 ddrillic 2016-06-14T16:09:37Z https://community.splunk.com/t5/Monitoring-Splunk/Why-does-SPLUNK-recommend-setting-the-ulimit-settings-for-core/m-p/210062#M7949 <P>splunk recommended ulimit is 64000 but what is maximum ulimit ? </P> Tue, 02 Jul 2019 11:24:42 GMT https://community.splunk.com/t5/Monitoring-Splunk/Why-does-SPLUNK-recommend-setting-the-ulimit-settings-for-core/m-p/210062#M7949 harish_l 2019-07-02T11:24:42Z