Knowledge Management

[Smartstore] CacheManager and eviction

rbal_splunk
Splunk Employee
Splunk Employee

Could you please help understand the DEBUG option for CacheManager to instigate eviction?

 

 

Labels (1)
0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

Cache manager evict buckets when

(i) the total disk utilized by WARM and Cold Buckets  exceeds  max_cache_size

or

(ii)The current free space for partition falls below eviction_padding+minFreeSpace

max_cache_size Specifies the maximum space, in megabytes, per partition, that the cache can occupy on disk. If this value is exceeded, the cache manager starts evicting buckets.

If max_cache_size=0  it means this feature is not used, and has no maximum size, in this case, the eviction will happen when the $SPLUNK_DB partition's free space drops below eviction_padding+minFreeSpace.

The total cache usage is calculated by the Cache manager as the sum of all NONE hot buckets size.

When $SPLUNK_HOME and $SPLUNK_DB are on different partitions, assuming all of the caches in $SPLUNK_DB  will account for disk spaces in that partitions only.

DEBUG on CacheManager shows entries stats for cache manager

07-08-2020 19:19:58.806 +0000 DEBUG CacheManager - The system has freebytes=944143511552 with minfreebytes=471859200000 cachereserve=471859208192 totalpadding=943718408192 buckets_size=0 maxSize=0

07-08-2020 19:19:58.887 +0000 DEBUG CacheManager - The system has freebytes=944141152256 with minfreebytes=471859200000 cachereserve=471859208192 totalpadding=943718408192 buckets_size=0 maxSize=0

Where

  •  Freebytes>> freeBytes
  •  Minfreebytes >>minFreeBytes
  •  Cachereserve >> evictionReservedBytes
  •  Totalpadding >> minFreeBytes + evictionReservedBytes
  •   buckets_size >> max_cache_size

  cmsize.png

 

 

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...