Ubuntu 20.04.3 LTS
1 NODE - 24Core, 48GB ram, 7 Drives Hardware Raid 5
Average ingestion rate: 2,500 in,
High ingestion rate 5,000 in
Graylog -4.2.4+b643d2b, codename Noir
JVM - PID 1616, Private Build 1.8.0_312 on Linux 5.4.0-91-generic
db version v4.0.27
Graylog is saying that journal utilization is too high. I had an issue similar to this that I believe was resolved by changing the mount of ram in my heap file from 20 to 16gb. I checked my heap file, and it appears to be still set to 16gb.
I did do an upgrade on my OS yesterday. That brought up the version from 5.4.0-89-generic to 5.4.0-91-generic. This was done along side of a Graylog upgrade to patch the log4j vulnerability.
Everything appeared to be working for more than 24 hours, then got the journaling error. When I checked elasticsearches CPU it was close to 90-100% usage. I have turned off all inputs and CPU is still extremely high.
Best I can tell elasticsearch didn’t have an updated, but honestly not sure where to go from here.