Splunk Enterprise

Too many open files issue on indexer, will increasing Ulimit resolve issue?

thahir
Path Finder

Hi Team,

Indexer is going down very frequently due to too many open files 

currently ulimit value for open files on the server is 128000

are we good to increase the Ulimit value more than 200000, if we increase the ulimit value the open file issue will resolve?

if we increase any other impact is there on the indexer.

Kindly assist me on this issue.

Thanks

Labels (3)
Tags (1)
0 Karma

thahir
Path Finder

@aasabatini  Thank you for you response.

we have set the Ulimit as same already like you suggested and thp also disabled. but still we are facing the too many open files issue.

0 Karma

aasabatini
Motivator

Hi @thahir 

 

how many buckets have your indexes?

can you check on the path where are stored?

Regards

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

aasabatini
Motivator

Hi @thahir 

 

the best pratices suggest to set the ulimit like this:

 modify /etc/security/limits.conf

ulimit -n 65535
ulimit -u 20480
ulimit -f unlimited
ulimit -d  unlimited

 

use ulimit -a to check the configuration

Also don't forget to disable the THP

Regards

Alessandro

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...