Lokasi file : cat /etc/wazuh-indexer/jvm.options (wazuh 4.14.2)

Heap = jatah RAM khusus untuk aplikasi Java

Di Wazuh:

• wazuh-indexer (OpenSearch) → Java
• Java tidak boleh sembarang pakai RAM
• Dia cuma boleh pakai RAM sebanyak heap yang ditentukan

Analogi :

Rumah = Virtual Mesin

• Total RAM VM = luas rumah
• Heap = kamar khusus OpenSearch
• OS, Wazuh Manager, Dashboard = penghuni lain

Heap terlalu besar → kamar kebesaran → penghuni lain sesak

Heap terlalu kecil → OpenSearch susah bergerak

Konfigurasi terlihat :

• Xms1024m
• Xmx1024m

Artinya :

• Xms → heap awal
• Xmx → heap maksimal
• Disamakan = stabil (best practice)

Kenapa heap itu PENTING di Wazuh?

Karena :

OpenSearch rakus RAM

Kalau dibiarkan auto:

• Bisa makan 50–70% RAM VM
• VM 4 GB → bisa habis

Impact nya:

• Dashboard lambat
• Service restart
• Bisa kena OOM Kill tiba-tiba (Out-Of-Memory)

Rumusan penggunaan HEAP :

Heap ≈ 25% – 40% dari total RAM VM

RAM 4 GB → heap 1 GB ✅

RAM 6 GB → heap 2 GB ✅

RAM 8 GB → heap 2–3 GB

Bagaimana cara mengetahui heap kepakai berapa ?

curl -k -u admin:<password> <https://localhost:9200/_nodes/stats/jvm?prettys/jvm?pretty>

Result : 
{
  "_nodes": {
    "total": 1,
    "successful": 1,
    "failed": 0
  },
  "cluster_name": "wazuh-cluster",
  "nodes": {
    "Vqj4Hj52RhedMn48ORco0w": {
      "timestamp": 1769318181222,
      "name": "node-1",
      "transport_address": "100.107.46.26:9300",
      "host": "100.107.46.26",
      "ip": "100.107.46.26:9300",
      "roles": [
        "cluster_manager",
        "data",
        "ingest",
        "remote_cluster_client"
      ],
      "attributes": {
        "shard_indexing_pressure_enabled": "true"
      },
      "jvm": {
        "timestamp": 1769318181222,
        "uptime_in_millis": 1127291,
        "mem": {
          "heap_used_in_bytes": 547356672,
          "heap_used_percent": 50,
          "heap_committed_in_bytes": 1073741824,
          "heap_max_in_bytes": 1073741824,
          "non_heap_used_in_bytes": 225442656,
          "non_heap_committed_in_bytes": 230424576,
          "pools": {
            "young": {
              "used_in_bytes": 304087040,
              "max_in_bytes": 0,
              "peak_used_in_bytes": 620756992,
              "peak_max_in_bytes": 0,
              "last_gc_stats": {
                "used_in_bytes": 0,
                "max_in_bytes": 0,
                "usage_percent": -1
              }
            },
            "old": {
              "used_in_bytes": 193986560,
              "max_in_bytes": 1073741824,
              "peak_used_in_bytes": 193986560,
              "peak_max_in_bytes": 1073741824,
              "last_gc_stats": {
                "used_in_bytes": 193986560,
                "max_in_bytes": 1073741824,
                "usage_percent": 18
              }
            },
            "survivor": {
              "used_in_bytes": 49283072,
              "max_in_bytes": 0,
              "peak_used_in_bytes": 80740352,
              "peak_max_in_bytes": 0,
              "last_gc_stats": {
                "used_in_bytes": 49283072,
                "max_in_bytes": 0,
                "usage_percent": -1
              }
            }
          }
        },
        "threads": {
          "count": 82,
          "peak_count": 96
        },
        "gc": {
          "collectors": {
            "young": {
              "collection_count": 16,
              "collection_time_in_millis": 422
            },
            "G1 Concurrent GC": {
              "collection_count": 10,
              "collection_time_in_millis": 53
            },
            "old": {
              "collection_count": 0,
              "collection_time_in_millis": 0
            }
          }
        },
        "buffer_pools": {
          "mapped": {
            "count": 1640,
            "used_in_bytes": 74695250,
            "total_capacity_in_bytes": 74695250
          },
          "direct": {
            "count": 42,
            "used_in_bytes": 6677013,
            "total_capacity_in_bytes": 6677012
          },
          "mapped - 'non-volatile memory'": {
            "count": 0,
            "used_in_bytes": 0,
            "total_capacity_in_bytes": 0
          }
        },
        "classes": {
          "current_loaded_count": 30683,
          "total_loaded_count": 30731,
          "total_unloaded_count": 48
        }
      }
    }
  }
}
root@svr-wazuh:/etc#

Bagian : "heap_used_percent”

• <60% → aman
• 60–75% → mulai padat
• 85% → perlu tuning