red herring IOWait alerts
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 32/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- docker, python
- Domain
- infrastructure, observability-sre
Research direction
Start by tracing the alert definitions for single_cpu__max_perc_last_3m and sum_top3_cpu_percs__max_last_3m in the Docker Splunk deployment. Verify whether their IOWait readings cover the host or only container-allocated CPUs, then determine the appropriate behavior for idle containerized deployments and confirm the health status reflects it.
Written by the indexing model from the issue text.
Description
The deployment health for my Splunk containers constantly appears yellow because of triggered IO wait alerts single_cpu__max_perc_last_3m and sum_top3_cpu_percs__max_last_3m. This occurs even when the containers are idle, not processing data or serving searches. I suspect that this alert is reading the iowait % for all cores on the host, instead of only those allocated to the container. If that's the case, this might not be the most useful signal for containerized deployments. Is it appropriate to entirely disable the IOWait health alerts for docker-splunk instances?
- Dominant language
- Python
- Stars
- 549
- Forks
- 277
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from splunk/docker-splunk
-
Difficulty 2/5 Half a day Newbie friendliness 78/100
splunk/docker-splunk#730 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 58/100
splunk/docker-splunk#737 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
splunk/docker-splunk#732 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
splunk/docker-splunk#731 · 1 reaction ·
-
Difficulty 3/5 1-2 days Newbie friendliness 38/100
splunk/docker-splunk#724 ·
All issues in splunk/docker-splunk
Similar issues
-
documentation help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
simonw/sqlite-utils#872 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100