Based on the recommended hardware sizes, you might need to change the configurations of various product components to make optimum use of available resources.
The following table provides a list of the configuration properties, their locations, and the recommended values for the properties for each setup.
Use the following table in conjunction with the recommendations provided in the horizontal sizing recommendations.
In the table, the configuration location paths must be preceded by one of the following environment variables:
Note
When you change any of the following properties, ensure that you re-start the corresponding service for the particular component and any dependent services. For example, the wrapper.java.initmemory
property defines the initial memory required for the Indexer, so when you change this property value, ensure that you re-start the Indexer.
For more information about starting or stopping services and service dependencies, see Starting or stopping product services.
Ensure that you make the same configuration changes for components of the same type. For example, if you change certain configurations for the Indexer, and you have multiple instances of Indexers deployed, ensure that you make the change for all Indexers in your environment.
Product Component | Configuration property and location | Medium setup | Large setup |
---|---|---|---|
Indexer | Initial memory required for the Indexer | ||
Indexer |
| 5,000 MB | 5,000 MB |
Indexer | custom\conf\services\indexer.conf | ||
Indexer | Maximum memory required for the Indexer | ||
Indexer |
| 5,000 MB | 5,000 MB |
Indexer | custom\conf\services\indexer.conf | ||
Configuration Database | Initial memory required for the Configuration Database | ||
Configuration Database |
| 1,000 MB | 1,000 MB |
Configuration Database | custom\conf\services\configdb.conf | ||
Configuration Database | Maximum memory required for the Configuration Database | ||
Configuration Database | wrapper.java.maxmemory | 1,000 MB | 1,000 MB |
Configuration Database | custom\conf\services\configdb.conf | ||
Console Server + Search | Initial memory required for the Console Server + Search | ||
Console Server + Search | wrapper.java.initmemory | 3,000 MB | 3,000 MB |
Console Server + Search | custom\conf\services\server.conf | ||
Console Server + Search | Maximum memory required for the Console Server + Search | ||
Console Server + Search | wrapper.java.maxmemory | 3,000 MB | 3,000 MB |
Console Server + Search | custom\conf\services\server.conf | ||
Collection Station | Initial memory required for the Collection Station | ||
Collection Station | wrapper.java.initmemory | 4,000 MB | 4,000 MB |
Collection Station | custom\conf\services\collectionstation.conf | ||
Collection Station | Maximum memory required for the Collection Station | ||
Collection Station | wrapper.java.maxmemory | 4,000 MB | 4,000 MB |
Collection Station | custom\conf\services\collectionstation.conf | ||
Collection Station | Maximum number of concurrent collector threads | ||
Collection Station | collection.thread.pool.size | 160 | 160 |
Collection Station | \station\collection\custom\conf\agent.properties | ||
Collection Station | Number of hours of data per index for the Collection Station | ||
Collection Station |
| 1 | 1 |
Collection Station | \station\collection\custom\conf\indexstrategies.yml | ||
Console Server + Search | Number of hours of data per index for the Console Server + Search | ||
Console Server + Search |
| 1 | 1 |
Console Server + Search | \custom\conf\server\customIndexstrategies.yml | ||
Console Server + Search | Maximum number of events to fetch in a single search query | ||
Console Server + Search | search.events.fetch.query.limit | 4,000 | 2,000 |
Console Server + Search | \custom\conf\server\searchserviceCustomConfig.properties | ||
Console Server + Search | Upper cap on the number of search buckets that can be created when events are greater than the search.events.fetch.query.limit value | ||
Console Server + Search | search.events.bucket.max.limit | 150 | 100 |
Console Server + Search | \custom\conf\server\searchserviceCustomConfig.properties | ||
Indexer | Number of shards per index | ||
Indexer | index.number_of_shards
|
|
|
Indexer | \conf\indexer\dynamic_template_1.json | ||
Indexer | Indexing request timeout (in milliseconds) | ||
Indexer | indexing.request.timeoutmillis | 30,000 | 5,000 |
Indexer | \station\collection\custom\conf\agent.properties |
1 Comment
Scott Bleasdell
The entry on this page referring to the indexing.request.timeoutmillis setting is ambiguous. That file (\station\collection\custom\conf\agent.properties) does not exist on the Indexer server (which the configuration recommendation is associated with). That file/setting lives on the Collection Station servers, which are connecting to the Indexer.