Splunk Search

Anybody seen search/indexer performance degradation after installing Meltdown patches on Linux

leonrtx
Explorer

Hello

Has anybody seen any indexer/search performance degradation after installing the Meltdown patches on Linux? Anybody willing to share some performance before and after stats?

Tags (1)

ChrisG
Splunk Employee
Splunk Employee

See this blog post for the latest Splunk communication and test results: https://www.splunk.com/blog/2018/02/12/meltdown-patch-and-the-impact-on-infrastructure-supporting-sp...

0 Karma

mendesjo
Path Finder

My Splunk rep told me that Splunk cloud was patched (we are still on prem), and they were testing for performance. Anyone know if WIndows or Linux Splunk agents are compatible with Microsoft or Linux OS patches for Meltdown/Spectre ?

0 Karma

gjanders
SplunkTrust
SplunkTrust

The agents should not notice the difference as this is an OS level (and potentially a patch at the CPU level), as long as the OS functions as normal the agent should continue to function as normal...(with the potential performance decrease of course)

0 Karma

mendesjo
Path Finder

Agreed, however, Anti-Virus software as an example is not all compatible, some work other require upgrades. I grant you that a Splunk agent doesn't behave like an anti-virus/malware software but just want to be sure before we start patching and find an issue with the OS patches and Splunk agents.

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...