High CPU usage after upgrade from Graylog 4.1 + Java 8 to Graylog 4.2 + Java 17

Sorry, i completely missed that question. I am only working on the default index set, and its settings are

  • Index prefix: graylog
  • Shards: 3
  • Replicas: 1
  • Field type refresh interval: 5 seconds
  • Index rotation strategy: Index Time
  • Rotation period: P1D (1 day, a day)
  • Index retention strategy: Delete
  • Max number of indices: 180

Regarding performance, here is the situation today

where the difference between the node running on Java 8 and the other two is clear as day. I will rollback all nodes to Java 8, given these results.

At least from a practical standpoint, then, I can only observe that Graylog 4.2.12 has a much worse performance running on Java 17 than on Java 8, despite both versions seeming able to run without errors.

I feel that this is a very curious situation, and would likely warrant more attention. If any of you can do more that I did to attract the attention of Graylog’s developers, I greatly appreciate it. I am particularly puzzled by the fact that no one reading these forums seems to notice this (is my installation that peculiar?) and there have been few comments on them, and also the fact that the installation guide pushes users to use Java 17. I also would like to understand why, if this is the suggested version, all Docker images are still sticking to Java 8 (though I see there are Java 11 variants), and if maybe this relates to the fact that some of this was already observed by someone.

There is only so much I can do with my setups. An independent review would be really good, though I understand not many people have the time and interest to spend on on it. I do not know if @H2Cyber suggestion still stands, but I opened the following issue on Github

3 Likes