Splunk 7.x Quick Start Guide
上QQ阅读APP看书,第一时间看更新

Transparent huge pages

Some Linux distributions typically have a transparent huge pages feature that is enabled by default; this causes some fairly significant performance losses with Splunk Enterprise (reportedly 30% or more), so Splunk suggests this feature be disabled. The process for doing this varies between distributions and versions, so you may need to search the web for instructions for your particular distribution. The following link has instructions for Red Hat Enterprise Linux versions 6 and 7: https://access.redhat.com/solutions/46111.

The following process works for RHEL 7.5:

Check to see if THP is enabled by using (root) cat /proc/cmdline. Look for transparent_hugepage=never
 in the results.

If this is missing, edit the /etc/sysconfig/grub file and add thetransparent_hugepage=never to the GRUB_CMDLINE_LINUX entry, as follows:

GRUB_CMDLINE_LINUX="console=ttyS0,115200n8 console=tty0 net.ifnames=0 crashkernel=auto transparent_hugepage=never"

Then, run the: grub2-mkconfig -o/boot/grub2/grub.cfg command and restart the server. When it comes up, run the cat /proc/cmdline command again and verify the entry.