JVM Configuration

Data Node

The JVM configuration for the Data Node is stored in:

  • /etc/logserver/jvm.options - main JVM options file (overwritten during upgrades, do not edit)

  • /etc/logserver/jvm.options.d/ - directory for user-defined JVM settings (persistent across upgrades)

By default, Data Node tells the JVM to use a heap with a minimum (Xms) and maximum (Xmx) size of 1 GB. When moving to production, it is important to configure heap size to ensure that Data Node has enough heap available.

Heap Sizing

Heap size settings are stored in /etc/logserver/jvm.options.d/heap-size.options. Edit this file to set the -Xms and -Xmx values:

-Xms16g
-Xmx16g

Warning

Do not place custom JVM settings in /etc/logserver/jvm.options directly. This file is overwritten during upgrades. All user-defined settings must go in /etc/logserver/jvm.options.d/.

Guidelines:

  • Always set -Xms equal to -Xmx to prevent heap resizing at runtime.

  • Do not exceed 31GB to maintain JVM compressed ordinary object pointers (compressed oops), which significantly improve memory efficiency.

  • As a general rule, allocate no more than half of the available system RAM to the JVM heap, leaving the rest for the operating system and file system cache.

After changing the heap size, restart the Data Node service:

systemctl restart logserver

Sizing Guidelines

Right-size the heap to the cluster workload, not just the host RAM:

  • Shards per heap: keep at most ~25 active shards per 1 GB of JVM heap. A node with 16 GB heap can comfortably host ~400 active shards; beyond that, metadata overhead and GC pressure grow quickly.

  • Host RAM vs heap: reserve at least 2× the heap size in system RAM. The OS page cache is what keeps search and aggregation latency low on cold data, so giving the JVM everything is counterproductive.

  • Ballpark tiers:

    Node role

    Typical RAM

    Heap

    Small ingest / single

    16 GB

    8 GB

    Standard data node

    64 GB

    31 GB

    Hot node, heavy queries

    128 GB+

    31 GB

    The 31 GB cap stays in place regardless of host size — the only way to use more memory effectively above that point is more nodes, not bigger heap.

For OpenSearch sizing references see the upstream Sizing Guidance.

Additional JVM Options

You can place additional JVM configuration files in /etc/logserver/jvm.options.d/. Each file should contain one JVM option per line. This is used, for example, for SSO configuration (see Authentication and Directory Integration).

Network Probe

The JVM configuration for the Network Probe is stored in:

  • /etc/logserver-probe/jvm.options

To apply TLS-related Java security properties, make sure the following definition is present in /etc/logserver-probe/jvm.options:

-Djava.security.properties=/etc/logserver-probe/java.properties

After changing JVM options, restart the Network Probe service:

systemctl restart logserver-probe