Deployment Architecture

Test SHC running out of mem every day.

Jarohnimo
Builder

Hello,

I have a test environment and the SHC members aren't allocated the recommended resources (because it's test) however i haven't had any issues with the environment until recent. For whatever reason in my test environment the 3 node SHC members keep getting shut down because of signal 9 (the server itself is killing the splunk process) Signal 9 is a KILL signal from an external process. The server is running out of memory, and thats the cause for the kill

If i restart the SHC members the resources are freed but the spiral starts over once again.

screenshot that shows the decline, something is eating away at it.

 

Jarohnimo_0-1628268065370.png

 

When i run the top command on the searcheads and press e to change the unit i can see it's splunk mongod that's taking up most of the mem so far.

I also will have replication issue every now and again, where i have to resyc.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The solution to the OOM killer is to add more memory.  Just because a system is a test system doesn't mean you can deprive it of the resources it needs.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...