# Graylog stops processing messages seemingly at random times

**URL:** <https://community.graylog.org/t/graylog-stops-processing-messages-seemingly-at-random-times/15739>\
**Category:** Graylog Central (peer support)\
**Created:** [June 2, 2020, 3:12pm UTC](https://community.graylog.org/t/graylog-stops-processing-messages-seemingly-at-random-times/15739 "2020-06-02T15:12:12Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![oidz1234](https://avatars.discourse-cdn.com/v4/letter/o/c57346/32.png) [@oidz1234](https://community.graylog.org/u/oidz1234)\
**Post date:** [June 2, 2020, 3:12pm UTC](https://community.graylog.org/t/graylog-stops-processing-messages-seemingly-at-random-times/15739/1 "2020-06-02T15:12:12Z")

</div>

Hello,

My instance of Graylog sometimes (about twice a day) stops processing messages. The messages are getting written to the message journal and a restart of Graylog (using systemctl restart graylog-server) fixes the issue temporarily. The logs in the journal get processed and then written to Elasticsearch.

I can see no errors at all in either the Graylog or Elasticsearch log files.

I am a bit stuck on what to do here. Any pointers would be appreciated

I am running Graylog 3.1.4 on 1 server

then on another server I am running elasticsearch 6.8.9

I have some thread dumps from the time that the issue happens. If they would be useful let me know and I shall post them.

Thanks!

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 3, 2020, 7:54am UTC](https://community.graylog.org/t/graylog-stops-processing-messages-seemingly-at-random-times/15739/2 "2020-06-03T07:54:37Z")

</div>

he @oidz1234

you should investigate what is happening during this time? Does your Elasticsearch is having problem? Check what does happen in the system and you will get a trace.

---

<div class="post-metadata">

**Author:** ![oidz1234](https://avatars.discourse-cdn.com/v4/letter/o/c57346/32.png) [@oidz1234](https://community.graylog.org/u/oidz1234)\
**Post date:** [June 3, 2020, 8:50am UTC](https://community.graylog.org/t/graylog-stops-processing-messages-seemingly-at-random-times/15739/3 "2020-06-03T08:50:37Z")

</div>

Hello,

My elasticsearch seems to be perfectly fine.

I have gotten a trace from graylog, I am not sure how to read it or what to look for as it’s very long. Would you like me to post this trace?

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 3, 2020, 9:04am UTC](https://community.graylog.org/t/graylog-stops-processing-messages-seemingly-at-random-times/15739/4 "2020-06-03T09:04:47Z")

</div>

from such a time you want to create a processor buffer dump on the `System > Nodes` page. This allows you to see what the processing processors do.

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/6/6090b2bb97fbadedba06eecfd763c3ca485b6416.png)

---

<div class="post-metadata">

**Author:** ![oidz1234](https://avatars.discourse-cdn.com/v4/letter/o/c57346/32.png) [@oidz1234](https://community.graylog.org/u/oidz1234)\
**Post date:** [June 3, 2020, 9:08am UTC](https://community.graylog.org/t/graylog-stops-processing-messages-seemingly-at-random-times/15739/5 "2020-06-03T09:08:16Z")

</div>

I do not seem to have that option? I am on graylog 3.1.4  
 ![2020-06-03-100728_524x339_scrot](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/39af5aa5f7d85e93b54640666b3088e4e47063dc.png)

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 3, 2020, 9:30am UTC](https://community.graylog.org/t/graylog-stops-processing-messages-seemingly-at-random-times/15739/6 "2020-06-03T09:30:54Z")

</div>

ok - that is added in 3.2 AFAIK … sorry. Without that it is nearly impossible to find what the reason for this is.

---

<div class="post-metadata">

**Author:** ![oidz1234](https://avatars.discourse-cdn.com/v4/letter/o/c57346/32.png) [@oidz1234](https://community.graylog.org/u/oidz1234)\
**Post date:** [June 5, 2020, 9:20am UTC](https://community.graylog.org/t/graylog-stops-processing-messages-seemingly-at-random-times/15739/7 "2020-06-05T09:20:17Z")

</div>

Ok, I will try and get Graylog upgraded to 3.2 next week.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 19, 2020, 9:20am UTC](https://community.graylog.org/t/graylog-stops-processing-messages-seemingly-at-random-times/15739/8 "2020-06-19T09:20:19Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
