- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
私はいまAWSのサーバでSplunkを利用しています。
先日サーバのインスタンスタイプを「C4.2xlarge」に変更しました。
こちらのインスタンスタイプは、下記のスペックです。
CPU コア数：8
メモリ：15GB
しかし、SplunkのDMCでマシン情報を確認した際に
メモリは15GBと認識されているのですが
CPUのコア数が「4コア」と表示されています。
これはSplunkの設定で、コア数を制限しているのでしょうか。
私はパフォーマンス向上のためにもCPUのコア数をすべて活用できるようにしたいです。
limits.confをいじればよいのでしょうか。
どなたか解決方法をご教示いただけると幸いです。
よろしくお願いします。
ENGLISH TRANSLATION
Title:
Why is the number of server CPU cores different from the number of CPU cores recognized by Splunk
Post:
I am currently using Splunk on the AWS server.
I recently changed the instance type of the server to "C4.2 xlarge".
This instance type is the spec below.
Number of CPU cores: 8
Memory: 15 GB
However, when checking the machine information with Splunk's DMC
The memory is recognized as 15 GB
The number of CPU cores is indicated as "4 cores".
Is this setting of Splunk limiting the number of cores?
I would like to make full use of the number of CPU cores for performance improvement.
Should I fiddle with limits.conf?
It would be greatly appreciated if anyone could tell me how to solve it.
Nice to meet you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk DMS(6.4 and lower) or Monitoring Console(6.5) report the number of physical CPU cores, not virtual CPU cores.
Your AWS "C4.2xlarge" may have 8 virtual CPU cores, not 8 physical CPU cores.
Splunk may recognize your all cores. There is nothing to worry about.
I'd like to share my findings.
AWS "C4.2 xlarge" uses hyper-threading enabled CPU, AWS says in this https://aws.amazon.com/jp/ec2/instance-types/.
Please try to find "ハイパースレッド" word in that URL.
You may find "各 vCPU は、M4、M3、C4、C3、R3、HS1、G2、I2、D2 の Intel Xeon コアのハイパースレッドです。".
It means that your "C4.2xlarge" has 8 virtual Cores, not 8 physical Cores.
And, could you try to search the following on your Splunk.
index=_internal cores
You may find the following Splunk internal events, which explain the number of virtual and physical cores your Splunk recognizes.
12-14-2016 19:54:32.770 + 0900 INFO loader – Detected 4 (virtural) CPUs, 2 CPU cores, and 4022MB RAM
### This event is my Splunk internal log.
My Splunk Monitoring Console says 2 CPU cores, not 4 cores.
I hope this information may help you.
By the way, Splunk Ver 4.2.2 is old and doesn't have DMC. I think you may use later version of Splunk.
Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk DMS(6.4 and lower) or Monitoring Console(6.5) report the number of physical CPU cores, not virtual CPU cores.
Your AWS "C4.2xlarge" may have 8 virtual CPU cores, not 8 physical CPU cores.
Splunk may recognize your all cores. There is nothing to worry about.
I'd like to share my findings.
AWS "C4.2 xlarge" uses hyper-threading enabled CPU, AWS says in this https://aws.amazon.com/jp/ec2/instance-types/.
Please try to find "ハイパースレッド" word in that URL.
You may find "各 vCPU は、M4、M3、C4、C3、R3、HS1、G2、I2、D2 の Intel Xeon コアのハイパースレッドです。".
It means that your "C4.2xlarge" has 8 virtual Cores, not 8 physical Cores.
And, could you try to search the following on your Splunk.
index=_internal cores
You may find the following Splunk internal events, which explain the number of virtual and physical cores your Splunk recognizes.
12-14-2016 19:54:32.770 + 0900 INFO loader – Detected 4 (virtural) CPUs, 2 CPU cores, and 4022MB RAM
### This event is my Splunk internal log.
My Splunk Monitoring Console says 2 CPU cores, not 4 cores.
I hope this information may help you.
By the way, Splunk Ver 4.2.2 is old and doesn't have DMC. I think you may use later version of Splunk.
Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
FYI, this is my instance C4.2xlarge for Splunk 6.5.1
$ ./splunk search 'index=_internal sourcetype=splunkd detected CPU'
12-19-2016 23:58:08.665 -0500 INFO loader - Detected 8 (virtual) CPUs, 4 CPU cores, and 14621MB RAM
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank You!!
And I'm Sorry.
My Splunk Version is 6.4.2.
I mistook the other day's remarks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How many cores do you see on DMS or MC? I believe "4".
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is what I see in DMC in Splunk
Splunk Enterprise Server 6.5.1
Linux, 14.28 GB Physical Memory, 4 CPU Cores
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, melonman!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- データ取り込みのために4つのCPUコア
- サーチ1つのために1つのCPUコア
が原則です。
6.3 からは、並列処理機能を有効にすることができるようになっています。
http://docs.splunk.com/Documentation/Splunk/6.3.0/ReleaseNotes/MeetSplunk
Ver4.2.2は、とても古いですね。Ver5.xはVer7がリリースされる時点でサポート対象外になるので、最近のOSでどんな問題が起きるか全く予想がつきませんので注意されたほうがよいかと思います。
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ありがとうございます。
Ver 4.2.2は間違いでした、すみません。
いまは6.4.2を利用しております。
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What version of Splunk are you using? There was a bug in some releases were DMC/REST endpoints will show wrong CPU count.
https://answers.splunk.com/answers/378630/why-is-my-cpu-core-count-wrong.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am using Splunk Ver 6.4.2
