Dear, from few days our Graylog Appliance (in the morning) runs with 100% CPU (4vCPU) for some hours then returns in normal state. There aren’t log rotation operations (this happend every 7d, in the weekend) and there aren’t a lot of INCOMING logs (no more then 200 msg/s). Currently there are 7 ind…

[image] marcob: Buffer is full (100%, 65536 msg) Which buffer? Graylog has 3 buffers, and it can tell, what part has a problem.

Process buffer is 100%, Utilization Journal is growing (slowly)

[image] I don’t have the entry for Get Process-buffer Dump.

I have resolved stopping few minutes the UDP 514 INPUT, then after the restart all seem to be processed well… question: How I can find which message bloccked the processing?

with the given version no way - that is the reason later versions have the ability to make a processing buffer dump where you see the worker threads and messages they are working on.

Graylog 3.1 Appliance, High CPU 100%

Graylog Central (peer support)

ihe June 4, 2020, 9:31am 4

Do you use Grok Patterns? Maybe it is a runaway grok pattern. In Graylog nodes stop outputting/fill up buffers you might find a solution.

Topic		Replies	Views
Problems in graylog about Disk Journal and Process buffer Graylog Central (peer support)	9	3577	February 17, 2021
Status Green, all systems go. How to optimize? Graylog Central (peer support)	15	5048	August 25, 2017
Input Buffer: 100%, Process Buffer 100%, Output Buffer: 0% Graylog Central (peer support)	2	2218	July 17, 2020
Process buffer 100% and nothing helps until restart Graylog Central (peer support)	1	1847	January 16, 2019
Disk Journal is full and Process buffer is full Graylog Central (peer support)	1	412	March 17, 2023

Graylog 3.1 Appliance, High CPU 100%

Related topics