small resident memory size limit

[dmlee]

Hi,

I found two error message from splunkd.log when I start splunk forwarder (splunk 3.4.12 , installed on AIX)

first is : ERROR ulimit - Splunk may not work due to small resident memory size limit!

second is : ERROR ulimit - Splunk may not work due to low file size limit

anyone know what it means ? thanks !

08-11-2010 11:05:17.461 INFO  ulimit - Limit: virtual address space size: unlimited
08-11-2010 11:05:17.461 INFO  ulimit - Limit: data segment size: 1879048192 bytes [hard maximum: unlimited]
08-11-2010 11:05:17.461 INFO  ulimit - Limit: resident memory size: 33554432 bytes [hard maximum: unlimited]
08-11-2010 11:05:17.461 ERROR ulimit - Splunk may not work due to small resident memory size limit!
08-11-2010 11:05:17.461 INFO  ulimit - Limit: stack size: 33554432 bytes [hard maximum: 2147483646 bytes]
08-11-2010 11:05:17.461 INFO  ulimit - Limit: core file size: 1073741312 bytes [hard maximum: unlimited]
08-11-2010 11:05:17.461 INFO  ulimit - Limit: data file size: 1073741312 bytes
08-11-2010 11:05:17.461 ERROR ulimit - Splunk may not work due to low file size limit
08-11-2010 11:05:17.461 INFO  ulimit - Limit: open files: unlimited
08-11-2010 11:05:17.461 INFO  ulimit - Limit: cpu time: unlimited
08-11-2010 11:05:17.462 INFO  loader - Splunkd starting (build 47883).
08-11-2010 11:05:17.463 INFO  loader - System info: AIX, sloanap1, 2, 5, 00C3468F4C00.
08-11-2010 11:05:17.463 INFO  loader - Getting configuration data from: /opt/splunk/splunk/etc/myinstall/splunkd.xml
08-11-2010 11:05:17.465 INFO  loader - SPLUNK_MODULE_PATH environment variable not found - defaulting to /opt/splunk/splunk/etc/modules
08-11-2010 11:05:17.465 INFO  loader - loading modules from /opt/splunk/splunk/etc/modules

[sylim_splunk]

in version 6.1.2
the minimum resident memory size : 512MB for UF.
1GB for non-UF

[yannK]

I confirm, in 4.2 the minimum value is 1GB = 1073741824 kb

[dwaddle · Accepted solution]

This has to do with your user ulimits -- which is a feature of all Unix operating systems. The operating system will restrict a process' use of resources to be in line with the ulimit settings put together by the system admin.

The AIX defaults are typically a little stingy on max file size (fsize) and resident memory size (rss). You will want to review with your system admin to see if he/she is willing to raise these limits for the user running splunk. These are set on AIX in /etc/security/limits.

Run "man ulimit" on your AIX box for additional info.

[jrodman]

To add specifics: resident memory size is the maximum amount of ram the operating system will allow each program to use, 33MB is too low for splunk. File Size is the maximum size file the system will allow a program to create. 1GB is quite low for a modern system, but it's possible a forwarder won't need to make a file larger than this.

[gkanapathy]

With ulimit values as displayed above, at least for the resident memory size, you can raise the limit (using the ulimit command in your shell) up to the hard limit. Since the hard limit is unlimited, you can raise the soft limit up to that. Similarly, you can increase the core file size. You will have a problem with the data file size limit only being 1 GB though.