for Splunk forwarder, indexer, search head

For CentOS 6:

ulimit -n

vi /etc/security/limits.conf

*         soft    nofile       65535
*         hard    nofile       65535


ulimit -u

vi /etc/security/limits.d/90-nproc.conf

*          soft    nproc     65535
*          hard    nproc     65535
root       soft    nproc     65535
root       hard    nproc     65535


For CentOS 7:

ulimit -n

vi /etc/systemd/system.conf

DefaultLimitNOFILE=65535


ulimits -u

for system side, vi /etc/systemd/system.conf

DefaultLimitNPROC=65535


for user side,  vi /etc/security/limits.d/20-nproc.conf

*          soft    nproc     65535


for CentOS 6:

disable Transparent Huge Page

echo "echo never > /sys/kernel/mm/transparent_hugepage/enabled" >> /etc/rc.local
echo "echo never > /sys/kernel/mm/transparent_hugepage/defrag" >> /etc/rc.local

echo "echo no > /sys/kernel/mm/transparent_hugepage/khugepaged/defrag" >> /etc/rc.local


for CentOS 7:
vi /etc/systemd/system/disable-thp.service


[Unit]

Description=Disable Transparent Huge Pages (THP)


[Service]

Type=simple

ExecStart=/bin/sh -c "echo 'never' > /sys/kernel/mm/transparent_hugepage/enabled && echo 'never' > /sys/kernel/mm/transparent_hugepage/defrag && echo '0' > /sys/kernel/mm/transparent_hugepage/khugepaged/defrag"


[Install]

WantedBy=multi-user.target


systemctl daemon-reload

systemctl start disable-thp

systemctl enable disable-thp


Set Timezone to UTC:

timedatectl set-timezone UTC