Re: Trying to figure out why logstash changed to active (exi
Posted: Fri Dec 13, 2019 3:43 pm
Currently, we have set:
Optimize Indexes older than (0)
Close indexes older than (22)
Delete indexes older than (22)
Here's what the ulimit -a command looks like on all three nodes (+/- a few thousand for max user processes):
Our log repository is stored on a separate storage drive, but that is only used for snapshots and old index data. Everything within the 22 day index limit is stored locally on each node.
Optimize Indexes older than (0)
Close indexes older than (22)
Delete indexes older than (22)
Ok, so upping the core count on each node might help this issue. I'm planning to upgrade from 6 cores to 12 cores for each node next week.Other than that, searching is going to rely on 2 things:
CPU power
and how fast you can get the data to the CPU
Here's what the ulimit -a command looks like on all three nodes (+/- a few thousand for max user processes):
Code: Select all
root@nagioslscc2:/root> ulimit -a
core file size (blocks, -c) 0
data seg size (kbytes, -d) unlimited
scheduling priority (-e) 0
file size (blocks, -f) unlimited
pending signals (-i) 256933
max locked memory (kbytes, -l) 64
max memory size (kbytes, -m) unlimited
open files (-n) 1024
pipe size (512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
real-time priority (-r) 0
stack size (kbytes, -s) 8192
cpu time (seconds, -t) unlimited
max user processes (-u) 256933
virtual memory (kbytes, -v) unlimited
file locks (-x) unlimited