Skip to main content
Splunk Lantern

*Nix memory utilization nearing capacity

You might want to detect when memory utilization is nearing capacity when doing the following:

Prerequisites 

In order to execute this procedure in your environment, the following data, services, or apps are required:

Example

Excessive memory utilization on a host, particularly abnormal or prolonged, is a sign of potential issues with the critical applications running on the host. You want to detect when an application is starved for memory resources, so you can prevent performance degradations or application instability.

Option 1

To optimize the search shown below, you should specify an index and a time range.

  1. Run the following search:
| mstats avg(vmstat_metric.memUsedPct) AS vmstat_metric.memUsedPct WHERE index="<name of *nix metrics index>" AND host="<name of host to check>" span=1m  BY host 
| timechart avg(vmstat_metric.memUsedPct) AS memUsedPct BY host

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation
| mstats avg(vmstat_metric.memUsedPct) AS vmstat_metric.memUsedPct WHERE index="< name of *nix metrics index >" AND host="<name of host to check>" span=1m  BY host  Search metrics index(es) where memory utilization data is being collected and filter down to the desired host(s) to check.
| timechart avg(vmstat_metric.memUsedPct) AS memUsedPct BY host Plot the percent of memory used for each host over time.

Result

Create an alert based on this search so you can proactively manage potential stability issues.

Option 2

  1. Ensure that you have the Splunk OTEL Collector installed on the host you want to monitor.
  2. In Splunk Infrastructure Monitoring, use the following SignalFlow to search the memory.utilization streaming metric and filter down to the desired host(s).
    A = data('memory.utilization', filter=filter('host.name', '<name of host to check>'), rollup='latest').publish(label='A')

Result

To alert when memory utilization is nearing max capacity for the selected host(s), use the SignalFlow from this procedure to configure a detector with an alert condition of "Static Threshold" and alert settings of:

  • Alert when: Above
  • Threshold: 95
  • Trigger sensitivity: Duration
  • Duration: 5m
  • Was this article helpful?