Splunk Search

Any plans for splunk to run on FreeBSD without relying on the compat6x package?

spoon
Engager

This is a follow up to a previous question I had regarding FreeBSD and zfs. I understand that currently splunk does not support zfs on FreeBSD. Could it be that splunk won't run from within a zfs pool on FBSD because zfs was not introduced into FBSD until FBSD 7x? My thought was that if splunk could run on FBSD without needing compat6x, then it probably wouldn't complain about zfs. For what it's worth, I get the following error when trying to run from within zfs on FBSD 8.1 and compat6x installed...

Could not create a lock in the SPLUNK_DB directory. Filesystem type is not supported: buf.f_fstypename = zfs If supporting this filesystem type is important to you, please file an Enhancement Request with Splunk Support with the fs info number listed.

An error occurred: Locking test failed on filesystem in path '/zfsdisk0/opt/splunk/var/lib/splunk' with code '9'.

I should point out that splunk will run on this same machine from within a ufs partition. I will file an Enhancement Request and I would be willing to help out with any testing needed to get splunk to run on FBSD without relying on the compat6x package.

Tags (1)

mahlerrd
Explorer

Splunk supports ZFS under Solaris. As the actual filesystem is the same between the the two systems, it is not simply a performance issue or anything else. At this time the hacks required by a user are completely non-trivial, yet the hacks used imply that support for this only needs to be 'turned on' inside a couple of Splunk binaries which would be trivial for Splunk to do in the next version.

And, here's why all the BSD boxes I run use FreeBSD. If I decided checksumming is too heavy of an operation, you can simply turn it off on individual filesystems or system wide.
zfs set checksum=off

Why not support it and, if you feel it necessary, mention that users may want to disable checksumming?

jrodman
Splunk Employee
Splunk Employee

Given our current strategy of minimal binaries per platforms, running on FreeBSD 7+ without compat6x means abandoning FreeBSD 6, which some of our customers still use, so this isn't an attractive option at the moment.

As for ZFS, I, and we, appreciate the ER. It will help product management the most if you can convey why running on ZFS is important to you -- what are the business issues etc. Realistically you can already defeat the check with some minor hacking, but it means you are in a configuration which is not currently undergoing any testing.

ZFS specifically, as opposed to other filesystems, does have some issues with high-io applications, especially high I/O and high computation tasks such as Splunk. Since ZFS performs checksum verification for all reads and writes, this means high I/O can reduce CPU avaialbility, for many Splunk loads causing a significant reduction in overall performance. This reduces, to some extent, the attraction of spending a good deal of effort in verifying and qualifying that platform.

That said, please do tell us why it is important to do that work, via the ER channel.

Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...