Splunk Enterprise

Too many open files issue on indexer, will increasing Ulimit resolve issue?

thahir
Path Finder

Hi Team,

Indexer is going down very frequently due to too many open files 

currently ulimit value for open files on the server is 128000

are we good to increase the Ulimit value more than 200000, if we increase the ulimit value the open file issue will resolve?

if we increase any other impact is there on the indexer.

Kindly assist me on this issue.

Thanks

Labels (3)
Tags (1)
0 Karma

thahir
Path Finder

@aasabatini  Thank you for you response.

we have set the Ulimit as same already like you suggested and thp also disabled. but still we are facing the too many open files issue.

0 Karma

aasabatini
Motivator

Hi @thahir 

 

how many buckets have your indexes?

can you check on the path where are stored?

Regards

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

aasabatini
Motivator

Hi @thahir 

 

the best pratices suggest to set the ulimit like this:

 modify /etc/security/limits.conf

ulimit -n 65535
ulimit -u 20480
ulimit -f unlimited
ulimit -d  unlimited

 

use ulimit -a to check the configuration

Also don't forget to disable the THP

Regards

Alessandro

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...