Splunk Search

Changing the Linux Scheduler for indexer filesystems

mikelanghorst
Motivator

I've been thinking alot lately about the possibility of changing the Linux scheduler for the filesystems on my hot & cold indexes. My storage is all on EMC VMAX arrays, so I'm thinking that setting those devices to noop might result in better performance. But I haven't had the opportunity to test this tuning, and only have a production environment.

Has anyone already done this, and found the "best" scheduler for indexers?

Tags (1)

araitz
Splunk Employee
Splunk Employee

A few years ago I spent about a week with a customer trying different schedulers on a Debian machine. It turned out that there was no clear advantage to any of them from a search or indexing performance perspective.

From a tuning perspective, I haven't seen too many optimizations that make a big difference with search or indexing. On certain platforms such as Solaris, specifying certain mallocs other than the system default can yield better performance in some cases.

When testing indexing or search performance, the same customer mentioned above did show me a useful one-liner for making sure that the OS caches don't muddy your results. Use caution and only run as root:

 echo 3 > /proc/sys/vm/drop_caches
0 Karma

lmyrefelt
Builder

Have you been able to test ? 🙂

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...