Splunk on CentOS 6/7 相關係統參數調整

for Splunk forwarder, indexer, search head

For CentOS 6:

ulimit -n

vi /etc/security/limits.conf

*         soft    nofile       65535
*         hard    nofile       65535

ulimit -u

vi /etc/security/limits.d/90-nproc.conf

*          soft    nproc     65535
*          hard    nproc     65535
root       soft    nproc     65535
root       hard    nproc     65535

For CentOS 7:

ulimit -n

vi /etc/systemd/system.conf

DefaultLimitNOFILE=65535

ulimits -u

for system side, vi /etc/systemd/system.conf

DefaultLimitNPROC=65535

for user side,  vi /etc/security/limits.d/20-nproc.conf

*          soft    nproc     65535

for CentOS 6:

disable Transparent Huge Page

echo "echo never > /sys/kernel/mm/transparent_hugepage/enabled" >> /etc/rc.local
echo "echo never > /sys/kernel/mm/transparent_hugepage/defrag" >> /etc/rc.local

echo "echo no > /sys/kernel/mm/transparent_hugepage/khugepaged/defrag" >> /etc/rc.local

for CentOS 7:
vi /etc/systemd/system/disable-thp.service

[Unit]

Description=Disable Transparent Huge Pages (THP)

[Service]

Type=simple

ExecStart=/bin/sh -c "echo 'never' > /sys/kernel/mm/transparent_hugepage/enabled && echo 'never' > /sys/kernel/mm/transparent_hugepage/defrag && echo '0' > /sys/kernel/mm/transparent_hugepage/khugepaged/defrag"

[Install]

WantedBy=multi-user.target

systemctl daemon-reload

systemctl start disable-thp

systemctl enable disable-thp

Set Timezone to UTC:

timedatectl set-timezone UTC