Graylog Retention Strategy Not Being Followed

Graylog Central (peer support)
1

Hi All,

I have set a Graylog instance to only hold 60 indices and delete all others. I had previously closed some older indices and then noticed that Graylog was not following the retention strategy and now has 69 indices, I then opened the old indices thinking that closing them may have caused this, but Graylog still hasn’t deleted them.
I have also tried cyling the active write index and recalculating index ranges, but this helped.
I encountered this issue once before, however I found Elasticsearch to be Red in status and resolving that issue resolved the retention strategy problem. In this case Elasticsearch is healthy.

System Specs

OS: Ubuntu 16.04 LTS
Graylog: 2.4.4
Elasticsearch: 5.6.9
MongoDB: 2.6.10

Here you can see my config and also the amount of incides in the system.

image
image.png1913×278 19.9 KB

Regards,

G

2

did you see any entries in the logfiles about the retention check?

Graylog should give you some ideas why it can’t run the retention checks.

3

Hi Jan,

I looked in the logs and can’t find anything regarding retention strategies.
I have looked into another working system and found logs such as these:

2018-08-21T01:03:58.379+01:00 INFO  [AbstractIndexCountBasedRetentionStrategy] Number of indices (4) higher than limit (3). Running retention for 1 indices.
2018-08-21T01:03:59.296+01:00 INFO  [AbstractIndexCountBasedRetentionStrategy] Running retention strategy [org.graylog2.indexer.retention.strategies.DeletionRetentionStrategy] for index <graylog_381>

Both systems are configured the same, however the one that is not working is set to 60 indices instead of 4.

Cheers,

G

4

you need to find the difference to solve the issue.

5

The one that works is on 2.4.5 and the one that isn’t working is on 2.4.4, is this a known issue of 2.4.4?

We will aim to update as soon as we can but due to being in production it will have to be scheduled in.

6

not that I know - so it should be something else.

7

I did close and reopen about ten of the indices on the system that is not working properly. That’s all I can think of, it shouldn’t have caused this.

8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.