# Journal issues / sizing

**URL:** <https://community.graylog.org/t/journal-issues-sizing/14253>\
**Category:** Graylog Central (peer support)\
**Created:** [February 28, 2020, 4:07pm UTC](https://community.graylog.org/t/journal-issues-sizing/14253 "2020-02-28T16:07:59Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![vladx](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/vladx/32/4656_2.png) [@vladx](https://community.graylog.org/u/vladx)\
**Post date:** [February 28, 2020, 4:07pm UTC](https://community.graylog.org/t/journal-issues-sizing/14253/1 "2020-02-28T16:07:59Z")

</div>

hi,

Yesterday I had some minor issues in my Graylog cluster when users started to report there are no logs since 3pm. I started to investigate, but I couldn’t find anything interesting in the logs, so I’ve restarted both Graylog and ES and I found there are 7m+ unprocessed messages. This morning, processing is finished and everything looks fine, but when I check node stats I can see this message “Couldn’t get journal information”, but other than this, everything looks fin, ES GREEN, logs are coming at 2K rate

My version is  
graylog-server-3.2.2-1.noarch

This cluster has two nodes (Graylog+ES and ES) each with 8GB RAM and 1 TB not-too-fast-storag plus 4 cores each.

As I wrote earlier, I have a sustained ingress rate at 2K to 4K and the total size of indexes are half terabytes.

So, my question are two-fold

- how can I fix this journal metrics issue (I already increased the size a bit)
- is my cluster has enough resources to serve this traffic? is there any sizing guide?

Thank you  
Laszlo

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [February 29, 2020, 1:12pm UTC](https://community.graylog.org/t/journal-issues-sizing/14253/2 "2020-02-29T13:12:43Z")

</div>

he @vladx

this is a known issue. It will be fixed in 3.2.3

> <https://github.com/Graylog2/graylog2-server/issues/7521>
>
> Expected Behavior
> 
> There should not be an error when viewing the page for a node.
> Current Behavior
> On two systems using Nginx as a...

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [March 1, 2020, 8:10pm UTC](https://community.graylog.org/t/journal-issues-sizing/14253/3 "2020-03-01T20:10:37Z")

</div>

> [@vladx](#):
>
> but when I check node stats

Your monitoring system should check it, not you. Monitor your envirolment.

---

<div class="post-metadata">

**Author:** ![vladx](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/vladx/32/4656_2.png) [@vladx](https://community.graylog.org/u/vladx)\
**Post date:** [March 2, 2020, 8:39am UTC](https://community.graylog.org/t/journal-issues-sizing/14253/4 "2020-03-02T08:39:13Z")

</div>

I think this is something else.  
#there is no reverse proxy, accessing Graylog on port 9000 using non-localhost address  
#earlier -before the upgrade and/or issue- it was ok, so I was able to check journal utilisation from the Web UI

Any other idea?

Thanks  
Laszlo

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [March 2, 2020, 9:20am UTC](https://community.graylog.org/t/journal-issues-sizing/14253/5 "2020-03-02T09:20:59Z")

</div>

he @vladx

sorry that I did not point directly to the PR that fixes the issue. This above linked issue was the “starter” to identify the problem:

> <https://github.com/Graylog2/graylog2-server/pull/7526>

the above is the fix.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 16, 2020, 9:21am UTC](https://community.graylog.org/t/journal-issues-sizing/14253/6 "2020-03-16T09:21:07Z")

</div>

Closed on March 16, 2020, 9:21am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
