I have a Graylog2 installation with:
- 2 nodes with Graylog2 (16CPU, 14GB memory)
- 3 nodes with Elastic Search (4 CPU, 26 GB memory)
At the moment the system is under high load (messages in: 12.000 msg/sec) and can not manage to process them fast enough.
The journals are filling up, “Process buffer” and “Output buffer” are both at 100%.
But when I look at the CPU on the 2 Graylog2 hosts (with top") it’s only at 400%. Does that mean that only 4 cores (out of 16) are utilized?
Can I increase the CPUs that Graylog2 utilizes?
Please post the complete configuration of the Graylog nodes and their respective JVM settings.
The full process and output buffer usually means it can’t write out the message to Elasticsearch.
So maybe your graylog servers “need” only 400% CPU and your elastic have a bottleneck.
So I suggest to check the elasticsearch cluster first. CPU, and disk IO.
But a wrong config can also cause simmilar error, please upload your config as @jochen asked.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.