Splunk Search

Changing the Linux Scheduler for indexer filesystems

mikelanghorst
Motivator

I've been thinking alot lately about the possibility of changing the Linux scheduler for the filesystems on my hot & cold indexes. My storage is all on EMC VMAX arrays, so I'm thinking that setting those devices to noop might result in better performance. But I haven't had the opportunity to test this tuning, and only have a production environment.

Has anyone already done this, and found the "best" scheduler for indexers?

Tags (1)

araitz
Splunk Employee
Splunk Employee

A few years ago I spent about a week with a customer trying different schedulers on a Debian machine. It turned out that there was no clear advantage to any of them from a search or indexing performance perspective.

From a tuning perspective, I haven't seen too many optimizations that make a big difference with search or indexing. On certain platforms such as Solaris, specifying certain mallocs other than the system default can yield better performance in some cases.

When testing indexing or search performance, the same customer mentioned above did show me a useful one-liner for making sure that the OS caches don't muddy your results. Use caution and only run as root:

 echo 3 > /proc/sys/vm/drop_caches
0 Karma

lmyrefelt
Builder

Have you been able to test ? 🙂

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...