Is there any way to Increase the Journal Size? its 1G at the moment. I loaded some hosts onto the system (16 via a script) they all started sending their messages to graylog and the Journal filled. I then had a message saying that messages had been discarded and not logged due to over utilization.
I managed to change the journal size, but found that after I run a graylog-ctl reconfigure, the changes are wiped out so in this case, restart keeps the settings :
ubuntu@graylog:/ sudo vi /opt/graylog/conf/graylog.conf
ubuntu@graylog:/ sudo graylog-ctl restart
ok: run: elasticsearch: (pid 31331) 0s
ok: run: etcd: (pid 31358) 1s
ok: run: graylog-server: (pid 31408) 0s
ok: run: mongodb: (pid 31431) 1s
ok: run: nginx: (pid 31449) 0s
ubuntu@graylog:/$ sudo cat /opt/graylog/conf/graylog.conf | grep "message_journal_max_size"
message_journal_max_size = 4gb
The same seems to be true for “indices.store.throttle.max_bytes_per_sec” that you can put into /opt/graylog/elasticsearch/config/elasticsearch.yml. After a reconfigure, it wipes the changes.
The heapsize, I have set … but still only using 1.4G even though I have set it to 4.
Reconfigure and restart don’t seem to wake it up … Also tried sticking it into /etc/environment but that didn’t do it either.
ubuntu@graylog:/$ sudo cat /etc/default/elasticsearch | grep “ES_HEAP_SIZE”
.# Set ES_HEAP_SIZE to 50% of available RAM, but no more than 31g
.# in elasticsearch.yml (ES_HEAP_SIZE must also be set).
ubuntu@graylog:/$ sudo cat /etc/elasticsearch/elasticsearch.yml | grep “ES_HEAP_SIZE”
.# Make sure that the ES_HEAP_SIZE environment variable is set to about half the memory