Splunk Search

Changing the Linux Scheduler for indexer filesystems

mikelanghorst
Motivator

I've been thinking alot lately about the possibility of changing the Linux scheduler for the filesystems on my hot & cold indexes. My storage is all on EMC VMAX arrays, so I'm thinking that setting those devices to noop might result in better performance. But I haven't had the opportunity to test this tuning, and only have a production environment.

Has anyone already done this, and found the "best" scheduler for indexers?

Tags (1)

araitz
Splunk Employee
Splunk Employee

A few years ago I spent about a week with a customer trying different schedulers on a Debian machine. It turned out that there was no clear advantage to any of them from a search or indexing performance perspective.

From a tuning perspective, I haven't seen too many optimizations that make a big difference with search or indexing. On certain platforms such as Solaris, specifying certain mallocs other than the system default can yield better performance in some cases.

When testing indexing or search performance, the same customer mentioned above did show me a useful one-liner for making sure that the OS caches don't muddy your results. Use caution and only run as root:

 echo 3 > /proc/sys/vm/drop_caches
0 Karma

lmyrefelt
Builder

Have you been able to test ? 🙂

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...