Security

small resident memory size limit

dmlee
Communicator

Hi,

I found two error message from splunkd.log when I start splunk forwarder (splunk 3.4.12 , installed on AIX)

first is : ERROR ulimit - Splunk may not work due to small resident memory size limit!

second is : ERROR ulimit - Splunk may not work due to low file size limit

anyone know what it means ? thanks !

08-11-2010 11:05:17.461 INFO  ulimit - Limit: virtual address space size: unlimited
08-11-2010 11:05:17.461 INFO  ulimit - Limit: data segment size: 1879048192 bytes [hard maximum: unlimited]
08-11-2010 11:05:17.461 INFO  ulimit - Limit: resident memory size: 33554432 bytes [hard maximum: unlimited]
08-11-2010 11:05:17.461 ERROR ulimit - Splunk may not work due to small resident memory size limit!
08-11-2010 11:05:17.461 INFO  ulimit - Limit: stack size: 33554432 bytes [hard maximum: 2147483646 bytes]
08-11-2010 11:05:17.461 INFO  ulimit - Limit: core file size: 1073741312 bytes [hard maximum: unlimited]
08-11-2010 11:05:17.461 INFO  ulimit - Limit: data file size: 1073741312 bytes
08-11-2010 11:05:17.461 ERROR ulimit - Splunk may not work due to low file size limit
08-11-2010 11:05:17.461 INFO  ulimit - Limit: open files: unlimited
08-11-2010 11:05:17.461 INFO  ulimit - Limit: cpu time: unlimited
08-11-2010 11:05:17.462 INFO  loader - Splunkd starting (build 47883).
08-11-2010 11:05:17.463 INFO  loader - System info: AIX, sloanap1, 2, 5, 00C3468F4C00.
08-11-2010 11:05:17.463 INFO  loader - Getting configuration data from: /opt/splunk/splunk/etc/myinstall/splunkd.xml
08-11-2010 11:05:17.465 INFO  loader - SPLUNK_MODULE_PATH environment variable not found - defaulting to /opt/splunk/splunk/etc/modules
08-11-2010 11:05:17.465 INFO  loader - loading modules from /opt/splunk/splunk/etc/modules
Tags (1)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

This has to do with your user ulimits -- which is a feature of all Unix operating systems. The operating system will restrict a process' use of resources to be in line with the ulimit settings put together by the system admin.

The AIX defaults are typically a little stingy on max file size (fsize) and resident memory size (rss). You will want to review with your system admin to see if he/she is willing to raise these limits for the user running splunk. These are set on AIX in /etc/security/limits.

Run "man ulimit" on your AIX box for additional info.

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

in version 6.1.2
the minimum resident memory size : 512MB for UF.
1GB for non-UF

yannK
Splunk Employee
Splunk Employee

I confirm, in 4.2 the minimum value is 1GB = 1073741824 kb

dwaddle
SplunkTrust
SplunkTrust

This has to do with your user ulimits -- which is a feature of all Unix operating systems. The operating system will restrict a process' use of resources to be in line with the ulimit settings put together by the system admin.

The AIX defaults are typically a little stingy on max file size (fsize) and resident memory size (rss). You will want to review with your system admin to see if he/she is willing to raise these limits for the user running splunk. These are set on AIX in /etc/security/limits.

Run "man ulimit" on your AIX box for additional info.

jrodman
Splunk Employee
Splunk Employee

To add specifics: resident memory size is the maximum amount of ram the operating system will allow each program to use, 33MB is too low for splunk. File Size is the maximum size file the system will allow a program to create. 1GB is quite low for a modern system, but it's possible a forwarder won't need to make a file larger than this.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

With ulimit values as displayed above, at least for the resident memory size, you can raise the limit (using the ulimit command in your shell) up to the hard limit. Since the hard limit is unlimited, you can raise the soft limit up to that. Similarly, you can increase the core file size. You will have a problem with the data file size limit only being 1 GB though.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...