# Graylog OVA Appliance Process Buffer and Journal High Utilization

**URL:** <https://community.graylog.org/t/graylog-ova-appliance-process-buffer-and-journal-high-utilization/6758>\
**Category:** Graylog Central (peer support)\
**Created:** [September 9, 2018, 11:05am UTC](https://community.graylog.org/t/graylog-ova-appliance-process-buffer-and-journal-high-utilization/6758 "2018-09-09T11:05:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ashfaq](https://avatars.discourse-cdn.com/v4/letter/a/858c86/32.png) [@ashfaq](https://community.graylog.org/u/ashfaq)\
**Post date:** [September 9, 2018, 11:05am UTC](https://community.graylog.org/t/graylog-ova-appliance-process-buffer-and-journal-high-utilization/6758/1 "2018-09-09T11:05:10Z")

</div>

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/0/026ccd2a57281da812473ec99c64bdc8da9b59b8.png)

I need help on Graylog OVA Appliance for fine tuning as I am getting very high utilization of Process Buffer and Journal.

Processing **2,784** incoming and **0** outgoing msg/s.

My VM has 24 GB Memory, 8vCPU and 2.72 TB disk space for graylog.

ubuntu@graylog:~ df -h Filesystem Size Used Avail Use% Mounted on udev 12G 4.0K 12G 1% /dev tmpfs 2.4G 444K 2.4G 1% /run /dev/dm-0 15G 3.2G 11G 23% / none 4.0K 0 4.0K 0% /sys/fs/cgroup none 5.0M 0 5.0M 0% /run/lock none 12G 0 12G 0% /run/shm none 100M 0 100M 0% /run/user /dev/sda1 236M 75M 149M 34% /boot /dev/sdb1 2.7T 196G 2.4T 8% /var/opt/graylog/data ubuntu@graylog:~

---

<div class="post-metadata">

**Author:** ![ashfaq](https://avatars.discourse-cdn.com/v4/letter/a/858c86/32.png) [@ashfaq](https://community.graylog.org/u/ashfaq)\
**Post date:** [September 9, 2018, 11:57am UTC](https://community.graylog.org/t/graylog-ova-appliance-process-buffer-and-journal-high-utilization/6758/2 "2018-09-09T11:57:19Z")

</div>

I am receiving two notifications as below.

## There are 2 notifications

Notifications are triggered by Graylog and indicate a situation you should act upon. Many notification types will also provide a link to the Graylog documentation if you need more information or assistance.

×

### Journal utilization is too high (triggered 2 hours ago)

Journal utilization is too high and may go over the limit soon. Please verify that your Elasticsearch cluster is healthy and fast enough. You may also want to review your Graylog journal settings and set a higher limit. (Node: _742950e5-9e80-44cb-a860-77b014c24493_ )

×

### Uncommited messages deleted from journal (triggered 2 hours ago)

Some messages were deleted from the Graylog journal before they could be written to Elasticsearch. Please verify that your Elasticsearch cluster is healthy and fast enough. You may also want to review your Graylog journal settings and set a higher limit. (Node: _742950e5-9e80-44cb-a860-77b014c24493_ )

---

<div class="post-metadata">

**Author:** ![derPhlipsi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/derphlipsi/32/38_2.png) [@derPhlipsi](https://community.graylog.org/u/derPhlipsi)\
**Post date:** [September 10, 2018, 5:00am UTC](https://community.graylog.org/t/graylog-ova-appliance-process-buffer-and-journal-high-utilization/6758/3 "2018-09-10T05:00:38Z")

</div>

Heyo @ashfaq,

what is the state of the Elasticsearch instance behind Graylog?

If Graylog is not able to output any logs, it’s most likely related with a non working Elasticsearch or a broken connection to it.

Have a look at the [Graylog default file locations](http://docs.graylog.org/en/2.4/pages/configuration/file_location.html) and post the content of the Elasticsearch logs and config.  
Additionally, the log from Graylog could be helpful. If your able to, clear the log file, restart Graylog and wait a few minutes. Then copy the log and paste it here.

Greetings,  
Philipp

PS: Remember to use tripple backticks or using a gist/etc. when posting logs. 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 24, 2018, 5:09am UTC](https://community.graylog.org/t/graylog-ova-appliance-process-buffer-and-journal-high-utilization/6758/4 "2018-09-24T05:09:57Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.