Graylog not using all CPUs

Graylog Central (peer support)
1

I have a Graylog2 installation with:

  • 2 nodes with Graylog2 (16CPU, 14GB memory)
  • 3 nodes with Elastic Search (4 CPU, 26 GB memory)

At the moment the system is under high load (messages in: 12.000 msg/sec) and can not manage to process them fast enough.

The journals are filling up, “Process buffer” and “Output buffer” are both at 100%.

But when I look at the CPU on the 2 Graylog2 hosts (with top") it’s only at 400%. Does that mean that only 4 cores (out of 16) are utilized?

Can I increase the CPUs that Graylog2 utilizes?

2

Please post the complete configuration of the Graylog nodes and their respective JVM settings.
:arrow_right: http://docs.graylog.org/en/2.4/pages/configuration/file_location.html

3

The full process and output buffer usually means it can’t write out the message to Elasticsearch.
So maybe your graylog servers “need” only 400% CPU and your elastic have a bottleneck.
So I suggest to check the elasticsearch cluster first. CPU, and disk IO.
But a wrong config can also cause simmilar error, please upload your config as @jochen asked.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.