Installation

Does Splunk support cgroups v2 for Workload Management?

AlexHaydock
Engager

I'm looking to enable Workload Management for Splunk and I'm just trying to understand whether this is fully supported on a deployment which is using cgroups v2.

Based on the documentation, the wording on the Configure Linux systemd for workload management page suggests that Splunk understands cgroups v1:

CPU: /sys/fs/cgroup/cpu/system.slice/<SPLUNK_SERVER_NAME>.service
Memory: /sys/fs/cgroup/memory/system.slice/<SPLUNK_SERVER_NAME>.service

But there is nothing (except the diagram) that suggests it can operate under cgroups v2 as well.

Does anyone know whether Splunk fully supports cgroups v2, or will our deployment need to be cgroups v1?

Edit: Some investigation suggests that Splunk fails to start with Workload Management enabled on a cgroups v2 host:

Jul 15 10:30:50 hostnamehere splunk[16311]: Couldn't open dir /sys/fs/cgroup/cpu/: No such file or directory
Jul 15 10:30:50 hostnamehere splunk[16311]: Error perform systemd preparation: No such file or directory
Labels (1)

nortonjco
Explorer

This is the same thing I needed to do for RHEL 9.

0 Karma

cameronjust
Path Finder

I just encountered this issue with Fedora 33

My fix was to edit /etc/systemd/system/Splunkd.service then change the ExecStartPost commands to 

 

 

# old cgroups v1 method installed by Splunk. Comment these out
# ExecStartPost=/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/cpu/system.slice/%n"
# ExecStartPost=/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/memory/system.slice/%n"

# new cgroups v2 method
ExecStartPost=/bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/system.slice/%n"

 


Don't forget to run "systemctl daemon-reload" after changing the file.

Edit: Not sure if there are other implications with cgroups v2 as I haven't tested workload management but at least Splunk starts with that fix.

 

 

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...