Splunk Enterprise

Too many open files issue on indexer, will increasing Ulimit resolve issue?

thahir
Path Finder

Hi Team,

Indexer is going down very frequently due to too many open files 

currently ulimit value for open files on the server is 128000

are we good to increase the Ulimit value more than 200000, if we increase the ulimit value the open file issue will resolve?

if we increase any other impact is there on the indexer.

Kindly assist me on this issue.

Thanks

Labels (3)
Tags (1)
0 Karma

thahir
Path Finder

@aasabatini  Thank you for you response.

we have set the Ulimit as same already like you suggested and thp also disabled. but still we are facing the too many open files issue.

0 Karma

aasabatini
Motivator

Hi @thahir 

 

how many buckets have your indexes?

can you check on the path where are stored?

Regards

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

aasabatini
Motivator

Hi @thahir 

 

the best pratices suggest to set the ulimit like this:

 modify /etc/security/limits.conf

ulimit -n 65535
ulimit -u 20480
ulimit -f unlimited
ulimit -d  unlimited

 

use ulimit -a to check the configuration

Also don't forget to disable the THP

Regards

Alessandro

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...