Monitoring Splunk

How is the Distributed Management Console Physical Memory Usage(%) value calculated?

adamblock2
Path Finder

We are currently running a distributed Splunk 6.2.3 infrastructure with multiple indexers.

According to the Distributed Management Console Resource Usage, each indexer shows "Physical Memory Usage(%)" as being > 96.5%.

I ran the command free -htlw on one of the indexers, and received the following results:

         total    used     free    shared    buffers    cache    available
Mem:     188G     2.1G     5.6G    24M       215M       180G     186G
Low:     188G     183G     5.6G
High:    0B       0B       0B
Swap:    4.0G     3.6M     4.0G
Total:   192G     2.1G     9.6G

Based on this information, I question the authenticity of that which is being reported by the Distributed Management Console. If someone could clarify exactly how these values differ, it would be greatly appreciated.

Thank you.

0 Karma
1 Solution

hexx
Splunk Employee
Splunk Employee

Up until Splunk Enterprise 6.2.5 included, the platform instrumentation records that the DMC leverages for its views have reported system-wide physical memory usage by including OS buffers & cache.

This did not yield a value that was representative of the physical memory actually available on the system, which is why starting with Splunk Enterprise 6.2.6, platform instrumentation reports system-wide physical memory usage without including OS buffers & cache.

Therefore, our recommendation is to upgrade all instances monitored by the DMC to 6.2.6 or later.

Please see this Splunk Answer for full details.

View solution in original post

hexx
Splunk Employee
Splunk Employee

Up until Splunk Enterprise 6.2.5 included, the platform instrumentation records that the DMC leverages for its views have reported system-wide physical memory usage by including OS buffers & cache.

This did not yield a value that was representative of the physical memory actually available on the system, which is why starting with Splunk Enterprise 6.2.6, platform instrumentation reports system-wide physical memory usage without including OS buffers & cache.

Therefore, our recommendation is to upgrade all instances monitored by the DMC to 6.2.6 or later.

Please see this Splunk Answer for full details.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...