Splunk Enterprise Security

Not to use RAID5 on SSD when using SmartStore.

rbal_splunk
Splunk Employee
Splunk Employee

Why avoid RAID5 on SSD when using SmartStore?

Labels (1)
0 Karma

rbal_splunk
Splunk Employee
Splunk Employee

The problem about RAID5/6 even with SSDs, and especially with SmartStore, is that you add at least two dimensions of access patterns and obviously a lot more linear write (download from SmartStore to the local cache) to the game.


A normal IDX does random read/write for ingesting and a lot more read while searching.


The upload of a rolled bucket will need another linear read of the bucket and a linear write if you download the bucket again.
So even more IO and remember that write IO will stress the RAID because you have to calc the checksums…
I think this was learning from our own tests with RAID in AWS.

Also, why waste space/iops on your cache, if you already have a copy in S3 (smart store for stable bucket) or on other hosts (RF for buckets that haven’t been uploaded)
 

 

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...