Bootstrap.mlock setting

Elastic Stack Elasticsearch
1

Hello,

We are currently running a cluster with 20 nodes 49800 shards and version 2.4.0. Recently I set the bootstrap.mlockall setting to true. Over the span of a month, I've observed the nodes with this setting have slowly increased their swap space usage. One node went to as high as 1GB of swap. I'm wondering if there are additional steps I need to take to ensure this is working properly? Is this setting supposed to ensure no swapping will occur for that node, or is it more like the node won't swap unless it absolutely has to? Any clarification you can provide here would be helpful.

Most likely I won't be able to disable all swapping as these servers are running other processes, which may require swapping. I'll have to investigate that some more to confirm. That said, can you provide some advice for what to do if you can't disable swapping on the server, but would like ensure ElasticSearch is not swapping? Thanks in advance.

2

If you cannot disable swap, then setting bootstrap.mlockall: true is the best way. Elasticsearch should report that it is applied on startup, if you check the log.

That's too many, you need to reduce this as it's likely causing issues.

3

Thanks for the response. So I checked the log and I don't see anything specifically called out to indicate it's set. Is it at the INFO level? I do see a warning which says,

"unable to install sys call filter: seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed.

Through various google searches, I believe I determined that warning can be ignored. Is that not the case? Aside from the log is there another method for determining it was enabled properly?