Installation

Does Splunk support cgroups v2 for Workload Management?

AlexHaydock
Engager

I'm looking to enable Workload Management for Splunk and I'm just trying to understand whether this is fully supported on a deployment which is using cgroups v2.

Based on the documentation, the wording on the Configure Linux systemd for workload management page suggests that Splunk understands cgroups v1:

CPU: /sys/fs/cgroup/cpu/system.slice/<SPLUNK_SERVER_NAME>.service
Memory: /sys/fs/cgroup/memory/system.slice/<SPLUNK_SERVER_NAME>.service

But there is nothing (except the diagram) that suggests it can operate under cgroups v2 as well.

Does anyone know whether Splunk fully supports cgroups v2, or will our deployment need to be cgroups v1?

Edit: Some investigation suggests that Splunk fails to start with Workload Management enabled on a cgroups v2 host:

Jul 15 10:30:50 hostnamehere splunk[16311]: Couldn't open dir /sys/fs/cgroup/cpu/: No such file or directory
Jul 15 10:30:50 hostnamehere splunk[16311]: Error perform systemd preparation: No such file or directory
Labels (1)

nortonjco
Explorer

This is the same thing I needed to do for RHEL 9.

0 Karma

cameronjust
Path Finder

I just encountered this issue with Fedora 33

My fix was to edit /etc/systemd/system/Splunkd.service then change the ExecStartPost commands to 

 

 

# old cgroups v1 method installed by Splunk. Comment these out
# ExecStartPost=/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/cpu/system.slice/%n"
# ExecStartPost=/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/memory/system.slice/%n"

# new cgroups v2 method
ExecStartPost=/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/system.slice/%n"

 


Don't forget to run "systemctl daemon-reload" after changing the file.

Edit: Not sure if there are other implications with cgroups v2 as I haven't tested workload management but at least Splunk starts with that fix.

 

 

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...