Archive

Can we monitor the swap space usage on the forwarder?

ddrillic
Ultra Champion

We had a couple of cases recently, in which the swap space usage was very high on several Linux servers. Is it possible to monitor the swap space usage? btw, we do have the Splunk_TA_nix installed on these forwarders.

Tags (2)
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@ddrillic,

vmstat from Splunk_TA_nix should return swap usage of your host if its enabled or at least that's what the headers say.

PRINTF='END {printf "%10d  %10d  %10d  %10.1f  %10.1f  %10s   %10.1f  %10s  %10s  %10s  %10s  %10s  %10s  %10.2f  %10.2f    %10.2f    %10.2f    %10.2f\n", memTotalMB, memFreeMB, memUsedMB, memFreePct, memUsedPct, pgPageOut, swapUsedPct, pgSwapOut, cSwitches, interrupts, forks, processes, threads, loadAvg1mi, waitThreads, interrupts_PS, pgPageIn_PS, pgPageOut_PS}'

DERIVE='END {memUsedMB=memTotalMB-memFreeMB; memUsedPct=(100.0*memUsedMB)/memTotalMB; memFreePct=100.0-memUsedPct; swapUsedPct=swapUsed ? (100.0*swapUsed)/(swapUsed+swapFree) : 0;  waitThreads=loadAvg1mi > cpuCount ? loadAvg1mi-cpuCount : 0}'

If that doesn't help you , there are few other commands from which you could use to extract the swap information. top/atop/htop/free are few of them.

View solution in original post

0 Karma

PowerPacked
Builder

Hi @ddrillic

You can also forward the Introspection logs of forwarders forwarded to indexers.

You will find info related to swap space usage in

index=_introspection sourcetype=splunk_resource_usage component="hostwide" | rename data.* as * | fields swap swap_used

Thanks

0 Karma

ddrillic
Ultra Champion

I see the swap information alt text

But it's for the Splunk servers, not the forwarders, right?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@ddrillic,

vmstat from Splunk_TA_nix should return swap usage of your host if its enabled or at least that's what the headers say.

PRINTF='END {printf "%10d  %10d  %10d  %10.1f  %10.1f  %10s   %10.1f  %10s  %10s  %10s  %10s  %10s  %10s  %10.2f  %10.2f    %10.2f    %10.2f    %10.2f\n", memTotalMB, memFreeMB, memUsedMB, memFreePct, memUsedPct, pgPageOut, swapUsedPct, pgSwapOut, cSwitches, interrupts, forks, processes, threads, loadAvg1mi, waitThreads, interrupts_PS, pgPageIn_PS, pgPageOut_PS}'

DERIVE='END {memUsedMB=memTotalMB-memFreeMB; memUsedPct=(100.0*memUsedMB)/memTotalMB; memFreePct=100.0-memUsedPct; swapUsedPct=swapUsed ? (100.0*swapUsed)/(swapUsed+swapFree) : 0;  waitThreads=loadAvg1mi > cpuCount ? loadAvg1mi-cpuCount : 0}'

If that doesn't help you , there are few other commands from which you could use to extract the swap information. top/atop/htop/free are few of them.

View solution in original post

0 Karma

ddrillic
Ultra Champion

Thank you @renjith.nair.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!