Splunk Enterprise Security

Not to use RAID5 on SSD when using SmartStore.

rbal_splunk
Splunk Employee
Splunk Employee

Why avoid RAID5 on SSD when using SmartStore?

Labels (1)
0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

The problem about RAID5/6 even with SSDs, and especially with SmartStore, is that you add at least two dimensions of access patterns and obviously a lot more linear write (download from SmartStore to the local cache) to the game.


A normal IDX does random read/write for ingesting and a lot more read while searching.


The upload of a rolled bucket will need another linear read of the bucket and a linear write if you download the bucket again.
So even more IO and remember that write IO will stress the RAID because you have to calc the checksums…
I think this was learning from our own tests with RAID in AWS.

Also, why waste space/iops on your cache, if you already have a copy in S3 (smart store for stable bucket) or on other hosts (RF for buckets that haven’t been uploaded)
 

 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!