今天发现splunk server 有很多crash 的log,再看一下:
On Splunk crashing every 18 minutes
发现server 需要调整如下splunk 参数:(就是这/etc/security/limits.d 下面增加如下文件)
[root@xxx limits.d]# cat 90-splunk.conf
#Found this in the 90-nproc.conf file in limits.d on the new RHEL6 build
#unsure how it got there but adding for consistency
splunk soft nproc 515605
# Max openfiles for splunk 04/07/2015
splunk soft nofile 1048576
splunk hard nofile 1048576
# Max openfiles for splunk 09/29/2020
root soft nofile 1048576
root hard nofile 1048576
[root@xxx limits.d]# cat 90-nproc.conf
# Default limit for n