Anybody seen search/indexer performance degradation after installing Meltdown patches on Linux

[leonrtx]

Hello

Has anybody seen any indexer/search performance degradation after installing the Meltdown patches on Linux? Anybody willing to share some performance before and after stats?

[ChrisG]

See this blog post for the latest Splunk communication and test results: https://www.splunk.com/blog/2018/02/12/meltdown-patch-and-the-impact-on-infrastructure-supporting-sp...

[mendesjo]

My Splunk rep told me that Splunk cloud was patched (we are still on prem), and they were testing for performance. Anyone know if WIndows or Linux Splunk agents are compatible with Microsoft or Linux OS patches for Meltdown/Spectre ?

[gjanders]

The agents should not notice the difference as this is an OS level (and potentially a patch at the CPU level), as long as the OS functions as normal the agent should continue to function as normal...(with the potential performance decrease of course)

[mendesjo]

Agreed, however, Anti-Virus software as an example is not all compatible, some work other require upgrades. I grant you that a Splunk agent doesn't behave like an anti-virus/malware software but just want to be sure before we start patching and find an issue with the OS patches and Splunk agents.