Splunk Search

Changing the Linux Scheduler for indexer filesystems

mikelanghorst
Motivator

I've been thinking alot lately about the possibility of changing the Linux scheduler for the filesystems on my hot & cold indexes. My storage is all on EMC VMAX arrays, so I'm thinking that setting those devices to noop might result in better performance. But I haven't had the opportunity to test this tuning, and only have a production environment.

Has anyone already done this, and found the "best" scheduler for indexers?

Tags (1)

araitz
Splunk Employee
Splunk Employee

A few years ago I spent about a week with a customer trying different schedulers on a Debian machine. It turned out that there was no clear advantage to any of them from a search or indexing performance perspective.

From a tuning perspective, I haven't seen too many optimizations that make a big difference with search or indexing. On certain platforms such as Solaris, specifying certain mallocs other than the system default can yield better performance in some cases.

When testing indexing or search performance, the same customer mentioned above did show me a useful one-liner for making sure that the OS caches don't muddy your results. Use caution and only run as root:

 echo 3 > /proc/sys/vm/drop_caches
0 Karma

lmyrefelt
Builder

Have you been able to test ? 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...