Splunk Enterprise

Too many open files issue on indexer, will increasing Ulimit resolve issue?

thahir
Path Finder

Hi Team,

Indexer is going down very frequently due to too many open files 

currently ulimit value for open files on the server is 128000

are we good to increase the Ulimit value more than 200000, if we increase the ulimit value the open file issue will resolve?

if we increase any other impact is there on the indexer.

Kindly assist me on this issue.

Thanks

Labels (3)
Tags (1)
0 Karma

thahir
Path Finder

@aasabatini  Thank you for you response.

we have set the Ulimit as same already like you suggested and thp also disabled. but still we are facing the too many open files issue.

0 Karma

aasabatini
Motivator

Hi @thahir 

 

how many buckets have your indexes?

can you check on the path where are stored?

Regards

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

aasabatini
Motivator

Hi @thahir 

 

the best pratices suggest to set the ulimit like this:

 modify /etc/security/limits.conf

ulimit -n 65535
ulimit -u 20480
ulimit -f unlimited
ulimit -d  unlimited

 

use ulimit -a to check the configuration

Also don't forget to disable the THP

Regards

Alessandro

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!

Celebrate CX Day with Splunk: Take our interactive quiz, join our LinkedIn Live ...

Today and every day, Splunk celebrates the importance of customer experience throughout our product, ...

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...

Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

  Tech Talk Streamlined Observability for Your Cloud Environment Register    Out of the Box to Up And Running ...