Update maxmind geoip database for iplocation splunk command

If you are using outdated maxmind db in your splunk version, you will see some of the location is not right for a few IPs. Follow these steps to update the maxmind GeoLite2-City db file:

  1. You can go to this site, http://dev.maxmind.com/geoip/geoip2/geolite2/
  2. Download GeoLite2-City.mmdb
  3. Replace it with $SPLUNK_HOME/share/GeoLite2-City.mmdb, usually at /opt/splunk/share in any Linux host
  4. Don’t need to restart splunk, run new query in splunk and the db will be refreshed itself.
Update maxmind geoip database for iplocation splunk command

Best size for swap partition in Linux

The old rule: Swap size should be twice of the RAM is only applicable in the old system when RAM is small (<1GB)

The new rule:
Swap = Equal RAM size (if RAM < 2GB)
Swap = 2GB size (if 2GB < RAM < 8GB)
Swap = 0.5 RAM size (if RAM > 8GB)

There is no benefit to put the swap size twice as RAM > 2GB since a system using up to mutiple GBs in swap memory should not be a good design for performance.

Best size for swap partition in Linux

MongoDB MMS Point In Time restores are only available for the last 24 hours.

Error: When restoring DB for replica set using MMS point in time, we have this error:

“You are attempting to restore to a version no longer accessible for restore. Point In Time restores are only available for the last 24 hours.”

Causes: Allow point-in-time restores going back (or oplog stored time) is set to more than 1 day but the snapshots interval is more than 12 hours (min 12 hours for Point in Time to work)

Solutions: Allow point-in-time restores going back should be set to more than 1 days but the snapshot should be also captured at least every 12 hours

Notes: Point in time only works for replica set. If you are using shard cluster, you should use checkpoint restore which allows to restore to any 15 mins point in time.

MongoDB MMS Point In Time restores are only available for the last 24 hours.