Input Buffer: 100%, Process Buffer 100%, Output Buffer: 0%

[batinthesun (Robin)]

Input Buffer: 100% utilized
Process Buffer 100% utilized
Output Buffer: 0% utilized

Should this be a cause of concern?
It seems I am getting delayed logs but unable to pinpoint the root issue.

Elasticsearch is green and running fine, No indexing errors on Graylog nodes, however, it seems Input Buffer and Process Buffer for all nodes are stuck at 100% while Output Buffer is 0%.

Any suggestions?

Thanks in advance

[tmacgbay]

Here is a similar thread that I was involved in before. Hopefully there are some answers in it or at least some suggestions of things to look at.

Graylog nodes stop outputting/fill up buffers

Hi, we have a curios little problem in which one graylog node out of a 3 + 2 Cluster stops outputting messages. filling up the buffers and subsequently the journal. This happens about every other day and can be resolved by a “graceful shutdown” and restart of the node in question. Unfortunately there is nothing in the logs from graylog or elasticsearch that would indicate a problem. Is there additional logging we could enable to get behind this issue or look at other places besides the standa…

Regardless of if you solve it or not, post up what you find for more detailed help and/or future readers fo the thread.

[jan (Jan Doberstein)]

he @batinthesun

depending on your Graylog version you would be able to see that the processing buffer is doing. This way you get a sense what is the problem most of the time - it is very likely that a regex is running wild.