Linux transparent hugetables support, enabled="always" defrag="always"

Linux transparent hugetables support,

 enabled=”always” defrag=”always”

1. Go to your Search Head OR Indexer and open a GUI :
     https://:8000
2.  Go to “Searching and Reporting” Application from the “Apps” Menu on the top left
3. Give the following Splunk Query on the Search Box :
 
index=_internal (transparent always)
OR recommended sourcetype=splunkd
| stats count by message,
 
 
 
If the output comes as :
Linux transparent hugetables support, enabled=”always” defrag=”always”
 
Remedy :
 
 
1.  Go to box ( Search Head ) OR ( Indexer ) as 
 
    ssh OR  
2.  Check if your OS is affected:
 
    cat /sys/kernel/mm/transparent_hugepage/enabled
 
    O/P : [always] madvise never
    cat /sys/kernel/mm/transparent_hugepage/defrag 
 
    O/P : [always] madvise never
  
3.  Fix on OS level:
 
    echo never > /sys/kernel/mm/transparent_hugepage/enabled
 
    echo never > /sys/kernel/mm/transparent_hugepage/defrag 
 
 4.  Validate on OS level:
 
    cat /sys/kernel/mm/transparent_hugepage/enabled 
 
    O/P : always madvise [never]
 
    cat /sys/kernel/mm/transparent_hugepage/defrag 
 
    O/P : always madvise [never]
Note : Hope whenever you encounter :
 
 
Linux transparent hugetables support, enabled=”always” defrag=”always”
 
 
the above error, you will be able to solve it immediately!!
Happy Splunking !
 
 
Advertisements

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.