- Describe your incident:
I have a random UI message in Graylog:
“Node cannot be found among active nodes”
The node is real and active:
-
Single-node installation
-
The node ID exists in:
-
/etc/graylog/server/node-id -
MongoDB (
db.nodes.find())
-
-
The node appears as RUNNING in Graylog
-
Searches and dashboards continue working, but the message appears intermittently and affects the dashboard experience.
Additional observations:
-
Initially OpenSearch/DataNode was configured with only 1 GB heap (
-Xms1g -Xmx1g) on a VM with 32 GB RAM. -
I increased heap to 8 GB and performance improved dramatically.
-
Before increasing heap,
jcmdsometimes failed with:
AttachNotSupportedException: target process doesn't respond within 10500ms -
After increasing heap:
-
OpenSearch cluster health is GREEN
-
No pending tasks
-
No rejected search/write queues
-
Heap usage around 60%
-
-
Despite this, the UI message still appears randomly.
- Describe your environment:
-
Graylog 7.1.2
-
Single-node deployment
-
CentOS Stream 9
-
Graylog Data Node (embedded OpenSearch)
-
MongoDB local
-
32 GB RAM VM
-
OpenSearch heap currently:
-
-Xms8g -
-Xmx8g
-
- What steps have you already taken to try and solve the problem?
-
Verified node ID exists and matches:
-
Graylog configuration
-
MongoDB database
-
-
Verified cluster health:
-
GREEN
-
No pending tasks
-
No rejected thread pool queues
-
-
Restarted:
-
graylog-server
-
graylog-datanode
-
-
Increased OpenSearch heap from 1 GB to 8 GB
-
Verified:
-
Node status RUNNING
-
Searches work
-
Dashboards load correctly
-
-
Cleared browser cache and tested with direct IP access
- How can the community help?
I would like help understanding:
-
Why Graylog UI still randomly reports the node as inactive/not found
-
Whether this is a known Graylog 7.1.x UI/polling issue
-
If there are additional logs, APIs, or configuration checks recommended for troubleshooting this intermittent node detection behavior