Deployment Architecture

Test SHC running out of mem every day.

Jarohnimo
Builder

Hello,

I have a test environment and the SHC members aren't allocated the recommended resources (because it's test) however i haven't had any issues with the environment until recent. For whatever reason in my test environment the 3 node SHC members keep getting shut down because of signal 9 (the server itself is killing the splunk process) Signal 9 is a KILL signal from an external process. The server is running out of memory, and thats the cause for the kill

If i restart the SHC members the resources are freed but the spiral starts over once again.

screenshot that shows the decline, something is eating away at it.

 

Jarohnimo_0-1628268065370.png

 

When i run the top command on the searcheads and press e to change the unit i can see it's splunk mongod that's taking up most of the mem so far.

I also will have replication issue every now and again, where i have to resyc.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The solution to the OOM killer is to add more memory.  Just because a system is a test system doesn't mean you can deprive it of the resources it needs.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...