Monitoring Splunk

How is the Distributed Management Console Physical Memory Usage(%) value calculated?

adamblock2
Path Finder

We are currently running a distributed Splunk 6.2.3 infrastructure with multiple indexers.

According to the Distributed Management Console Resource Usage, each indexer shows "Physical Memory Usage(%)" as being > 96.5%.

I ran the command free -htlw on one of the indexers, and received the following results:

         total    used     free    shared    buffers    cache    available
Mem:     188G     2.1G     5.6G    24M       215M       180G     186G
Low:     188G     183G     5.6G
High:    0B       0B       0B
Swap:    4.0G     3.6M     4.0G
Total:   192G     2.1G     9.6G

Based on this information, I question the authenticity of that which is being reported by the Distributed Management Console. If someone could clarify exactly how these values differ, it would be greatly appreciated.

Thank you.

0 Karma
1 Solution

hexx
Splunk Employee
Splunk Employee

Up until Splunk Enterprise 6.2.5 included, the platform instrumentation records that the DMC leverages for its views have reported system-wide physical memory usage by including OS buffers & cache.

This did not yield a value that was representative of the physical memory actually available on the system, which is why starting with Splunk Enterprise 6.2.6, platform instrumentation reports system-wide physical memory usage without including OS buffers & cache.

Therefore, our recommendation is to upgrade all instances monitored by the DMC to 6.2.6 or later.

Please see this Splunk Answer for full details.

View solution in original post

hexx
Splunk Employee
Splunk Employee

Up until Splunk Enterprise 6.2.5 included, the platform instrumentation records that the DMC leverages for its views have reported system-wide physical memory usage by including OS buffers & cache.

This did not yield a value that was representative of the physical memory actually available on the system, which is why starting with Splunk Enterprise 6.2.6, platform instrumentation reports system-wide physical memory usage without including OS buffers & cache.

Therefore, our recommendation is to upgrade all instances monitored by the DMC to 6.2.6 or later.

Please see this Splunk Answer for full details.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...