# Has a question about nofication delay, what should i do

**URL:** <https://community.graylog.org/t/has-a-question-about-nofication-delay-what-should-i-do/36800>\
**Category:** Graylog Central (peer support)\
**Tags:** alert\
**Created:** [December 29, 2025, 9:16am UTC](https://community.graylog.org/t/has-a-question-about-nofication-delay-what-should-i-do/36800 "2025-12-29T09:16:43Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![gnarly9203](https://avatars.discourse-cdn.com/v4/letter/g/54ee81/32.png) [@gnarly9203](https://community.graylog.org/u/gnarly9203)\
**Post date:** [December 29, 2025, 9:16am UTC](https://community.graylog.org/t/has-a-question-about-nofication-delay-what-should-i-do/36800/1 "2025-12-29T09:16:43Z")

</div>

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.  
**Don’t forget to select tags to help index your topic!**

**1. Describe your incident:**

**Summary:** Critical alert notification delay of 40–90 minutes.

**Details:** I am running a Graylog cluster with 6,000 alert definitions.My Graylog input throughput is 40k per minute. Each alert is configured to “Search within the last 1 minute” and “Execute search every 1 minute.”

**Symptoms:** \* Notifications are delayed significantly (up to 90 minutes behind real-time).

**2. Describe your environment:**

- OS Information: CentOS 7.9

- Package Version: graylog-7.0.0-10, graylog-datanode-7.0.0-10, mongodb-7.0.25-1

- Service logs, configurations, and environment variables:

- **Hardware:**

**3. What steps have you already taken to try and solve the problem?**

I tried to add “async\_eventbus\_processors = 16  
outputbuffer\_processors = 16  
processbuffer\_processors = 16” in server.config

**4. How can the community help?**

**Helpful Posting Tips:** [Tips for Posting Questions that Get Answers](https://community.graylog.org/t/tips-for-posting-questions-that-get-answers/21828) [Hold down CTRL and link on link to open tips documents in a separate tab]

---

<div class="post-metadata">

**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\
**Post date:** [December 29, 2025, 9:59am UTC](https://community.graylog.org/t/has-a-question-about-nofication-delay-what-should-i-do/36800/2 "2025-12-29T09:59:28Z")

</div>

Hey @gnarly9203,

When looking under system/Node configuration, are the process/output buffers operating at close to 100%?

If your hosts have 16 cores available, then the processbuffer\_processors and outputbuffer\_processors settings should probably be better balanced to that number. For example:

outputbuffer\_processors = 9  
processbuffer\_processors = 7

---

<div class="post-metadata">

**Author:** ![gnarly9203](https://avatars.discourse-cdn.com/v4/letter/g/54ee81/32.png) [@gnarly9203](https://community.graylog.org/u/gnarly9203)\
**Post date:** [December 29, 2025, 11:42am UTC](https://community.graylog.org/t/has-a-question-about-nofication-delay-what-should-i-do/36800/4 "2025-12-29T11:42:29Z")

</div>

Thank you! The datanode I/O utilization is very low, with both graylog-server’s process and output buffers remaining normal and well below 10%. At First, i tried

outputbuffer\_processors = 8  
processbuffer\_processors = 8， but the nofication still delay. So, i changed to 16.

By the way, I’m confident the system time is correct. Although I came across articles blaming time sync for similar problems, I’ve verified that our clocks are synchronized.

---

<div class="post-metadata">

**Author:** ![Wine\_Merchant](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/wine_merchant/32/14596_2.png) [@Wine\_Merchant](https://community.graylog.org/u/Wine_Merchant)\
**Post date:** [December 29, 2025, 12:16pm UTC](https://community.graylog.org/t/has-a-question-about-nofication-delay-what-should-i-do/36800/5 "2025-12-29T12:16:42Z")

</div>

System clock differences across Graylog nodes could certainly cause this issue and it would be the most likely causation.

Are there any indicators with the Graylog logs, perhaps something losing the Graylog leader node or communication timeouts to Mongo?

Within the mongosh context on your mongo primary, then when viewing the graylog DB, if you run the below what do the post\_processing times for each node say?

db.processing\_status.find().toArray()

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [January 12, 2026, 12:16pm UTC](https://community.graylog.org/t/has-a-question-about-nofication-delay-what-should-i-do/36800/6 "2026-01-12T12:16:42Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.