Splunk Enterprise Security

Not to use RAID5 on SSD when using SmartStore.

rbal_splunk
Splunk Employee
Splunk Employee

Why avoid RAID5 on SSD when using SmartStore?

Labels (1)
0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

The problem about RAID5/6 even with SSDs, and especially with SmartStore, is that you add at least two dimensions of access patterns and obviously a lot more linear write (download from SmartStore to the local cache) to the game.


A normal IDX does random read/write for ingesting and a lot more read while searching.


The upload of a rolled bucket will need another linear read of the bucket and a linear write if you download the bucket again.
So even more IO and remember that write IO will stress the RAID because you have to calc the checksums…
I think this was learning from our own tests with RAID in AWS.

Also, why waste space/iops on your cache, if you already have a copy in S3 (smart store for stable bucket) or on other hosts (RF for buckets that haven’t been uploaded)
 

 

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...