Splunk Enterprise

Too many open files issue on indexer, will increasing Ulimit resolve issue?

thahir
Path Finder

Hi Team,

Indexer is going down very frequently due to too many open files 

currently ulimit value for open files on the server is 128000

are we good to increase the Ulimit value more than 200000, if we increase the ulimit value the open file issue will resolve?

if we increase any other impact is there on the indexer.

Kindly assist me on this issue.

Thanks

Labels (3)
Tags (1)
0 Karma

thahir
Path Finder

@aasabatini  Thank you for you response.

we have set the Ulimit as same already like you suggested and thp also disabled. but still we are facing the too many open files issue.

0 Karma

aasabatini
Motivator

Hi @thahir 

 

how many buckets have your indexes?

can you check on the path where are stored?

Regards

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

aasabatini
Motivator

Hi @thahir 

 

the best pratices suggest to set the ulimit like this:

 modify /etc/security/limits.conf

ulimit -n 65535
ulimit -u 20480
ulimit -f unlimited
ulimit -d  unlimited

 

use ulimit -a to check the configuration

Also don't forget to disable the THP

Regards

Alessandro

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...