All Apps and Add-ons

nmon - Solaris memory used shows as negative number

johnansett
Communicator

Hey there nmon users,

I am working on a splunk using nmon and when viewing the Solaris UI MEM, Solaris Memory and Swap Usage page the results are provided in a negative number.

alt text

This means that the percentage can't work either.

It looks like the calculated field is askew also.
alt text

Before I bust open the app and fix this, wondered if they was any fix for this?

0 Karma

guilmxm
SplunkTrust
SplunkTrust

Hi @johnansett

Interesting, and wrong obviously 😉

So in props.conf, the mem_used relies on the following calculation:

EVAL-mem_used = case(type=="MEM", (case(isnotnull(Real_total_MB), (Real_total_MB-Real_free_MB), isnotnull(memtotal), (memtotal-memfree))), type="TOP", case(OStype="AIX", ((ResData+ResText)), OStype="Linux", (ResSet), OStype="Solaris", ResSize))

So in case of Solaris and the MEM type, this shall rely on memtotal less memfree raw fields values, would you mind checking what are the values you can see ?

Guilhem

0 Karma

johnansett
Communicator

Hi Guilhem,

Thanks for the quick response! I'm sorry I was meant to get back to you straight away but got buried.

Looks like the issue is in the raw data. Running this:

index=nmon memtotal=* | eval memused_test = memtotal-memfree | search memused_test<0

Returns results for 2 out of the 7 servers and they show:

timestamp="1553819244" type="MEM" serialnum="host2" hostname="host2" OStype="Solaris" logical_cpus="24" virtual_cpus="24" ZZZZ="2019-03-28 17:27:24" interval="60" snapshots="120" memtotal="57344.0" NA1="0.0" NA2="0.0" swaptotal="205493.7" memfree="186235.9" NA3="0.0" NA4="0.0" swapfree="146579.6" swapused="58914.1" 

timestamp="1553819215" type="MEM" serialnum="host1" hostname="host1" OStype="Solaris" logical_cpus="24" virtual_cpus="24" ZZZZ="2019-03-28 17:26:55" interval="60" snapshots="120" memtotal="57344.0" NA1="0.0" NA2="0.0" swaptotal="290659.2" memfree="286294.3" NA3="0.0" NA4="0.0" swapfree="236111.2" swapused="54548.0" 

All 7/7 servers to have memtotal="57344.0" in their data and 5/7 don't have memfree above 20000 but those two offending hosts have an average memfree of 70000.
It looks like it's a result of the data/collection of data.

0 Karma

guilmxm
SplunkTrust
SplunkTrust

Hi @johnansett

Did you have the chance to get more insights on the issue ?

Solaris is not exactly an operating system in active "development", so if the issue is happening at the collection time, this might be very easy to fix indeed.

I forgot to ask, but these are all Solaris 11 ?

Ideally, you would run the collection on a local file and verify the value you get for the memfree / memtotal

To start a process locally, which will write to an nmon file:

Notes: if running on sparc, change to "sarmon_bin_sparc"

/opt/splunkforwarder/var/log/nmon/bin/sarmon_bin_i386/sadc 60 120 >/dev/null &

Then check the stats:

root@solaris-113:~# grep '^MEM,' solaris-113_190417_2255.nmon 
MEM,Memory MB solaris-113,memtotal,NA1,NA2,swaptotal,memfree,NA3,NA4,swapfree,swapused
MEM,T0001,511.6,0.0,0.0,1079.1,19.5,0.0,0.0,699.4,379.7
MEM,T0002,511.6,0.0,0.0,1094.9,16.9,0.0,0.0,708.6,386.3

And as said previously, at search time the calculation made is a simple "memtotal-memfree"

Guilhem

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...