Splunk Enterprise Security

Not to use RAID5 on SSD when using SmartStore.

rbal_splunk
Splunk Employee
Splunk Employee

Why avoid RAID5 on SSD when using SmartStore?

Labels (1)
0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

The problem about RAID5/6 even with SSDs, and especially with SmartStore, is that you add at least two dimensions of access patterns and obviously a lot more linear write (download from SmartStore to the local cache) to the game.


A normal IDX does random read/write for ingesting and a lot more read while searching.


The upload of a rolled bucket will need another linear read of the bucket and a linear write if you download the bucket again.
So even more IO and remember that write IO will stress the RAID because you have to calc the checksums…
I think this was learning from our own tests with RAID in AWS.

Also, why waste space/iops on your cache, if you already have a copy in S3 (smart store for stable bucket) or on other hosts (RF for buckets that haven’t been uploaded)
 

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...