Increasing JVM Heap Size works but

Graylog Central (peer support)
1

Hi guys!
I set up a Graylog instance and everythings it’s working smoothly.
After start receiveign a couple of logs I notice that the default JVM Heap size it’s a bit short (1 GB) and I read a little in google to increase it. The prefered way to do it it’s seems to be adding the tag “ES_HEAP_SIZE=xxg” in /etc/default/elasticsearch, but after doing this and reboot elasticsearch I noticed that in Graylog web platform the node it’s still showing a max size of 972.8MB.
Now, if I modified the settings in /etc/default/graylog-server it works and I can see it in the Node section in the web platform.
So far so good, but I noticed that if I run the command “curl -sS -XGET “localhost:9200/_cat/nodes?h=heap*&v””, the result shows me two results like this:
heap.current heap.percent heap.max
429.7mb 44 972.8mb
353.5mb 2 11.9gb

The thing is I only have one node, I don’t know why it shows me two results and if this is a normal behavior.
So now I’m unsure if I have to change the settings in the elasticsearch file and increasing the heap size theree (even if it doesn’t show up in the Graylog Node) or change it in graylog-server.

My system:
Ubuntu 16.04
Graylog 2.2.2
Elasticsearch 2.4.4

Thanks!

2

As you have Graylog and Elasticsearch you are able to modify the HEAP for both.

It looks like you mixed in your mind both up. What did you like todo? Raise the HEAP for which one? Why did you want to raise the heap?

3

Thanks for the replay and the clarification Jan!
I wanted to raise the HEAP for Elastix because I read that it needs the 50% of the RAM in order to have a good performance and avoid bottlenecks as I’m going to start feeding it with a lot of logs.
So, the HEAP size in Graylog is it good if I leaved it as is or is better to increase it a little to have a better performance?
Currently my server have 30 GB of ram memory.
Cheers!

4

Hej @Nicodd17

the default file location can be found in out documentation. Just to have it said.

If you run a server with 30GB RAM and everything on one box, give Elasticsearch ~12GB Heap and Graylog ~2GB - said that you will have some Memory left for the OS and everything else.

1 Like
5

Thanks for the help Jan, everything set up correctly now.
Cheers!

6

@Nicodd17 So just to be sure did you ever get a clear answer; what is the meaning of A and B when you do the curl call?

Thanks
~B

7

These are simply the Java heap memory stats of the Elasticsearch nodes in that particular cluster.

If you add name and id to the h parameter of the cat nodes API request, you will also see which nodes these are specifically.

1 Like
8

bingo! thank you

heap.current heap.percent heap.max id name
759mb 46 1.5gb 6GiP graylog-c14015b6-b090-4e4c-a37a-2b5f3b241cc9
1.7gb 22 7.9gb 50_0 Pulse

9

So the web interface GUI shows us the “Pulse” node graphically but not the elasticsearch? What is “Pulse” and what is “graylog-c14015b6-b090-4e4c-a37a-2b5f3b241cc9”?

The math matches up if I assume that’s what the GUI shows me. What about that area which is NOT used up (circled in blue):

heap.png1686×315 28 KB

10

You’re mixing things up.

“Pulse” is the name of your Elasticsearch node, “graylog-c14015b6-b090-4e4c-a37a-2b5f3b241cc9” is the name of the embedded Elasticsearch node inside your Graylog process (the name is simply a concatenation of “graylog-” and the node ID).

The chart on the web interface shows the heap memory of the Graylog node (i. e. the same numbers shown for the “graylog-c14015b6-b090-4e4c-a37a-2b5f3b241cc9” Elasticsearch node).

1 Like
11

Hello,

I got the same situation as bubba198 does and then the same question
> What about that area which is NOT used up (circled in blue)

Thanks!

1 Like
12

That’s the maximum amount of heap memory the JVM will allocate if required.

Check the -Xms and -Xmx parameters in the JVM.

13

Thanks for the quick answer,

ok got it, the orange part show the -Xms and only the -Xmx was increased. Thanks

14

sorry for this newbie question but i want to allocate 4g to elasticsearch container but should the ulimit option match it ? Any correlation between the two? Can i keep it to 1g ?
ulimit it’s for the vm running the container and ES_JAVA_OPTS it’s for the elastic app right ? :blush:

15

A post was merged into an existing topic: Buffer Full and journal disk