Splunk Search

How can I verify basic OS tweaking is applied in the container version of Splunk?

daniel333
Builder

All,

So currently when I start an instance of Splunk I use an init.d script which disable THP and sets ulimits. How do I verify this is happening in the Docker container version of Splunk Enterprise?

0 Karma

outcoldman
Communicator

@daniel333 you can aways attach to the running container with

docker exec -it [container_name] bash

and after that check this configurations as you always do by

ps aux

Find splunkd process and do

cd /proc/[splunkd]/
cat limits

cat /sys/kernel/mm/transparent_hugepage/enabled

mattymo
Splunk Employee
Splunk Employee

exec to container is what I would do, too.

We'll have to incorporate these best practices into the dockerfiles soon as well.

Other handy verification items are this searchindex=_internal source=*splunkd.log ulimit which runs at any startup and checks these items, or grep $SPLUNK_HOME/var/log/splunk/splunkd.log for ulimit. Also monitoring console health check has checks for this too.

Once you have set the configs the way you want, you'll want to verify these after restart.

- MattyMo
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...