All Apps and Add-ons

nmon - Solaris memory used shows as negative number

johnansett
Communicator

Hey there nmon users,

I am working on a splunk using nmon and when viewing the Solaris UI MEM, Solaris Memory and Swap Usage page the results are provided in a negative number.

alt text

This means that the percentage can't work either.

It looks like the calculated field is askew also.
alt text

Before I bust open the app and fix this, wondered if they was any fix for this?

0 Karma

guilmxm
SplunkTrust
SplunkTrust

Hi @johnansett

Interesting, and wrong obviously 😉

So in props.conf, the mem_used relies on the following calculation:

EVAL-mem_used = case(type=="MEM", (case(isnotnull(Real_total_MB), (Real_total_MB-Real_free_MB), isnotnull(memtotal), (memtotal-memfree))), type="TOP", case(OStype="AIX", ((ResData+ResText)), OStype="Linux", (ResSet), OStype="Solaris", ResSize))

So in case of Solaris and the MEM type, this shall rely on memtotal less memfree raw fields values, would you mind checking what are the values you can see ?

Guilhem

0 Karma

johnansett
Communicator

Hi Guilhem,

Thanks for the quick response! I'm sorry I was meant to get back to you straight away but got buried.

Looks like the issue is in the raw data. Running this:

index=nmon memtotal=* | eval memused_test = memtotal-memfree | search memused_test<0

Returns results for 2 out of the 7 servers and they show:

timestamp="1553819244" type="MEM" serialnum="host2" hostname="host2" OStype="Solaris" logical_cpus="24" virtual_cpus="24" ZZZZ="2019-03-28 17:27:24" interval="60" snapshots="120" memtotal="57344.0" NA1="0.0" NA2="0.0" swaptotal="205493.7" memfree="186235.9" NA3="0.0" NA4="0.0" swapfree="146579.6" swapused="58914.1" 

timestamp="1553819215" type="MEM" serialnum="host1" hostname="host1" OStype="Solaris" logical_cpus="24" virtual_cpus="24" ZZZZ="2019-03-28 17:26:55" interval="60" snapshots="120" memtotal="57344.0" NA1="0.0" NA2="0.0" swaptotal="290659.2" memfree="286294.3" NA3="0.0" NA4="0.0" swapfree="236111.2" swapused="54548.0" 

All 7/7 servers to have memtotal="57344.0" in their data and 5/7 don't have memfree above 20000 but those two offending hosts have an average memfree of 70000.
It looks like it's a result of the data/collection of data.

0 Karma

guilmxm
SplunkTrust
SplunkTrust

Hi @johnansett

Did you have the chance to get more insights on the issue ?

Solaris is not exactly an operating system in active "development", so if the issue is happening at the collection time, this might be very easy to fix indeed.

I forgot to ask, but these are all Solaris 11 ?

Ideally, you would run the collection on a local file and verify the value you get for the memfree / memtotal

To start a process locally, which will write to an nmon file:

Notes: if running on sparc, change to "sarmon_bin_sparc"

/opt/splunkforwarder/var/log/nmon/bin/sarmon_bin_i386/sadc 60 120 >/dev/null &

Then check the stats:

root@solaris-113:~# grep '^MEM,' solaris-113_190417_2255.nmon 
MEM,Memory MB solaris-113,memtotal,NA1,NA2,swaptotal,memfree,NA3,NA4,swapfree,swapused
MEM,T0001,511.6,0.0,0.0,1079.1,19.5,0.0,0.0,699.4,379.7
MEM,T0002,511.6,0.0,0.0,1094.9,16.9,0.0,0.0,708.6,386.3

And as said previously, at search time the calculation made is a simple "memtotal-memfree"

Guilhem

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!