Best practice tuning "buffer"


i’m trying to tune my graylog configuration and i’m playing with processbuffer_processors / outputbuffer_processors / inputbuffer_processors.
But there is some rules regarding the number of vCPU ram etc…?

My setup is composed of one graylog (~1500msg/sec) and one cluster of 3 elsatic search .
ES vm is 4vCPU (not really loaded) 16GB with HEAP at 12GB
Graylog is 2vCPU (30/40% loaded) 8GB with HEAP at 4GB.

Thank for help.

1 Like

The rule of thumb would be that those three settings processbuffer_processors / outputbuffer_processors / inputbuffer_processors should be equal to the number of CPUs you have.

If you are unsure about, leave the defaults.

Ok thank you for help, is it the sum of the three settings which should be equal to the number of CPU?

yes - the sum of all.

I have a VM running Elastic and GL with 2 CPU’s and 2 cores each. From what I can tell the “default” totals 12 processors. What is your recommendation? We only collect from about a dozen syslog senders.

leave the defaults - until you have real issues or the need of changing.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.