Linux transparent hugetables support, enabled="always" defrag="always"

Linux transparent hugetables support,

 enabled="always" defrag="always"

1. Go to your Search Head OR Indexer and open a GUI :

  

     https://<SearchHead_OR_Indexer_URL>:8000  <enter>

    

2.  Go to "Searching and Reporting" Application from the "Apps" Menu on the top left

3. Give the following Splunk Query on the Search Box :

index=_internal (transparent always)

OR recommended sourcetype=splunkd

| stats count by message,

If the output comes as :

Linux transparent hugetables support, enabled="always" defrag="always"

Remedy :

1.  Go to box ( Search Head ) OR ( Indexer ) as 

    ssh <Search_Head_IP> OR <Indexer_IP> <enter>

2.  Check if your OS is affected:

    cat /sys/kernel/mm/transparent_hugepage/enabled <enter>

    O/P : [always] madvise never

    cat /sys/kernel/mm/transparent_hugepage/defrag <enter>

    O/P : [always] madvise never

3.  Fix on OS level:

    echo never > /sys/kernel/mm/transparent_hugepage/enabled <enter>

    echo never > /sys/kernel/mm/transparent_hugepage/defrag <enter>

4.  Validate on OS level:

    cat /sys/kernel/mm/transparent_hugepage/enabled <enter>

    O/P : always madvise [never]

    cat /sys/kernel/mm/transparent_hugepage/defrag <enter>

    O/P : always madvise [never]

Note : Hope whenever you encounter :

Linux transparent hugetables support, enabled="always" defrag="always"

the above error, you will be able to solve it immediately !!

Happy Splunking !