Hey there nmon users,
I am working on a splunk using nmon and when viewing the Solaris UI MEM, Solaris Memory and Swap Usage page the results are provided in a negative number.
This means that the percentage can't work either.
It looks like the calculated field is askew also.
Before I bust open the app and fix this, wondered if they was any fix for this?
Hi @johnansett
Interesting, and wrong obviously 😉
So in props.conf, the mem_used relies on the following calculation:
EVAL-mem_used = case(type=="MEM", (case(isnotnull(Real_total_MB), (Real_total_MB-Real_free_MB), isnotnull(memtotal), (memtotal-memfree))), type="TOP", case(OStype="AIX", ((ResData+ResText)), OStype="Linux", (ResSet), OStype="Solaris", ResSize))
So in case of Solaris and the MEM type, this shall rely on memtotal less memfree raw fields values, would you mind checking what are the values you can see ?
Guilhem
Hi Guilhem,
Thanks for the quick response! I'm sorry I was meant to get back to you straight away but got buried.
Looks like the issue is in the raw data. Running this:
index=nmon memtotal=* | eval memused_test = memtotal-memfree | search memused_test<0
Returns results for 2 out of the 7 servers and they show:
timestamp="1553819244" type="MEM" serialnum="host2" hostname="host2" OStype="Solaris" logical_cpus="24" virtual_cpus="24" ZZZZ="2019-03-28 17:27:24" interval="60" snapshots="120" memtotal="57344.0" NA1="0.0" NA2="0.0" swaptotal="205493.7" memfree="186235.9" NA3="0.0" NA4="0.0" swapfree="146579.6" swapused="58914.1"
timestamp="1553819215" type="MEM" serialnum="host1" hostname="host1" OStype="Solaris" logical_cpus="24" virtual_cpus="24" ZZZZ="2019-03-28 17:26:55" interval="60" snapshots="120" memtotal="57344.0" NA1="0.0" NA2="0.0" swaptotal="290659.2" memfree="286294.3" NA3="0.0" NA4="0.0" swapfree="236111.2" swapused="54548.0"
All 7/7 servers to have memtotal="57344.0" in their data and 5/7 don't have memfree above 20000 but those two offending hosts have an average memfree of 70000.
It looks like it's a result of the data/collection of data.
Hi @johnansett
Did you have the chance to get more insights on the issue ?
Solaris is not exactly an operating system in active "development", so if the issue is happening at the collection time, this might be very easy to fix indeed.
I forgot to ask, but these are all Solaris 11 ?
Ideally, you would run the collection on a local file and verify the value you get for the memfree / memtotal
To start a process locally, which will write to an nmon file:
Notes: if running on sparc, change to "sarmon_bin_sparc"
/opt/splunkforwarder/var/log/nmon/bin/sarmon_bin_i386/sadc 60 120 >/dev/null &
Then check the stats:
root@solaris-113:~# grep '^MEM,' solaris-113_190417_2255.nmon
MEM,Memory MB solaris-113,memtotal,NA1,NA2,swaptotal,memfree,NA3,NA4,swapfree,swapused
MEM,T0001,511.6,0.0,0.0,1079.1,19.5,0.0,0.0,699.4,379.7
MEM,T0002,511.6,0.0,0.0,1094.9,16.9,0.0,0.0,708.6,386.3
And as said previously, at search time the calculation made is a simple "memtotal-memfree"
Guilhem