red herring IOWait alerts
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 549
- Forks
- 277
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 2
Description
The deployment health for my Splunk containers constantly appears yellow because of triggered IO wait alerts single_cpu__max_perc_last_3m and sum_top3_cpu_percs__max_last_3m. This occurs even when the containers are idle, not processing data or serving searches. I suspect that this alert is reading the iowait % for all cores on the host, instead of only those allocated to the container. If that's the case, this might not be the most useful signal for containerized deployments. Is it appropriate to entirely disable the IOWait health alerts for docker-splunk instances?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the alert definitions for single_cpu__max_perc_last_3m and sum_top3_cpu_percs__max_last_3m in the Docker Splunk deployment. Verify whether their IOWait readings cover the host or only container-allocated CPUs, then determine the appropriate behavior for idle containerized deployments and confirm the health status reflects it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, python
- Domain
- infrastructure, observability-sre
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100