Greylog message error

Graylog Central (peer support)
, ,
1
  1. Describe your incident:

I have a random UI message in Graylog:

“Node cannot be found among active nodes”

The node is real and active:

  • Single-node installation

  • The node ID exists in:

    • /etc/graylog/server/node-id

    • MongoDB (db.nodes.find())

  • The node appears as RUNNING in Graylog

  • Searches and dashboards continue working, but the message appears intermittently and affects the dashboard experience.

Additional observations:

  • Initially OpenSearch/DataNode was configured with only 1 GB heap (-Xms1g -Xmx1g) on a VM with 32 GB RAM.

  • I increased heap to 8 GB and performance improved dramatically.

  • Before increasing heap, jcmd sometimes failed with:
    AttachNotSupportedException: target process doesn't respond within 10500ms

  • After increasing heap:

    • OpenSearch cluster health is GREEN

    • No pending tasks

    • No rejected search/write queues

    • Heap usage around 60%

  • Despite this, the UI message still appears randomly.

  1. Describe your environment:

  • Graylog 7.1.2

  • Single-node deployment

  • CentOS Stream 9

  • Graylog Data Node (embedded OpenSearch)

  • MongoDB local

  • 32 GB RAM VM

  • OpenSearch heap currently:

    • -Xms8g

    • -Xmx8g

  1. What steps have you already taken to try and solve the problem?

  • Verified node ID exists and matches:

    • Graylog configuration

    • MongoDB database

  • Verified cluster health:

    • GREEN

    • No pending tasks

    • No rejected thread pool queues

  • Restarted:

    • graylog-server

    • graylog-datanode

  • Increased OpenSearch heap from 1 GB to 8 GB

  • Verified:

    • Node status RUNNING

    • Searches work

    • Dashboards load correctly

  • Cleared browser cache and tested with direct IP access

  1. How can the community help?

I would like help understanding:

  • Why Graylog UI still randomly reports the node as inactive/not found

  • Whether this is a known Graylog 7.1.x UI/polling issue

  • If there are additional logs, APIs, or configuration checks recommended for troubleshooting this intermittent node detection behavior