# Elasticsearch data nodes - pagefile/hard faults vs. heap usage

**URL:** https://discuss.elastic.co/t/elasticsearch-data-nodes-pagefile-hard-faults-vs-heap-usage/317570
**Category:** Elasticsearch
**Tags:** elastic-stack-monitoring
**Created:** [October 27, 2022, 1:46am UTC](https://discuss.elastic.co/t/elasticsearch-data-nodes-pagefile-hard-faults-vs-heap-usage/317570 "2022-10-27T01:46:00Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![BradVido](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bradvido/32/741_2.png) [@BradVido](https://discuss.elastic.co/u/BradVido)
#### Post date: [October 27, 2022, 1:46am UTC](https://discuss.elastic.co/t/elasticsearch-data-nodes-pagefile-hard-faults-vs-heap-usage/317570/1 "2022-10-27T01:46:00Z")

</div>

I have an Elasticsearch cluster version 7.8.1running on Windows server 2019. There are 3 3 data nodes, 3 master nodes, and 1 coordinating node, in the cluster. That data nodes each have 48gb ram, and 24gb is dedicated to the jvm.

I've noticed with large queries in Kibana, that the hard faults (read from virtual memory, aka disk), spike massively on my data nodes, but the used heap size in the JVM doesn't get much past 60%.  
Here's a snip of one of my nodes hard faults vs. heap usage:

hard faults:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/1/c1fb9ab9edb66b826ef1256fe42b74e75135cf77.png)

Heap Usage:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/6/160933307459a8b876193b82824749233732cb18.png)

Thoughts on why elasticsearch isn't using more of the JVM heap? The typical proposed solution is "throw more ram at it", but since it's not using what it has, I'm hesitant

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 31, 2022, 2:19am UTC](https://discuss.elastic.co/t/elasticsearch-data-nodes-pagefile-hard-faults-vs-heap-usage/317570/2 "2022-10-31T02:19:58Z")

</div>

> [@BradVido](#):
>
> Elasticsearch cluster version 7.8.1

This is no longer supported and has reached [EOL](https://www.elastic.co/support/eol), please upgrade.

> [@BradVido](#):
>
> Thoughts on why elasticsearch isn't using more of the JVM heap?

if Elasticsearch is constantly accessing files from disk, the OS will transparently cache this for you which will also reduce these "hard faults". So the question would be, how often are you querying the data?

---

<div class="post-metadata">

### Author: ![BradVido](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bradvido/32/741_2.png) [@BradVido](https://discuss.elastic.co/u/BradVido)
#### Post date: [November 1, 2022, 3:00pm UTC](https://discuss.elastic.co/t/elasticsearch-data-nodes-pagefile-hard-faults-vs-heap-usage/317570/3 "2022-11-01T15:00:29Z")

</div>

Thanks for the info. I'm wondering if the OS transparent disk caching any different on windows/NTFS than \*nix? Is there any more documentation on this?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 2, 2022, 10:03pm UTC](https://discuss.elastic.co/t/elasticsearch-data-nodes-pagefile-hard-faults-vs-heap-usage/317570/4 "2022-11-02T22:03:22Z")

</div>

There probably is, but TBH I don't have any real knowledge of the differences and my focus is primarily linux sorry.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 30, 2022, 10:03pm UTC](https://discuss.elastic.co/t/elasticsearch-data-nodes-pagefile-hard-faults-vs-heap-usage/317570/5 "2022-11-30T22:03:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.