Low CPU usage (60-65%) with a high level of uncommited messages

Graylog Central (peer support)
1

Hi everyone,

there is the following problem, a standalone server (mongodb 6.0.14, opensearch 2.13.0, graylog 5.2.6), with 60-65% processor load, there is a huge number of uncommited messages - about 7-8 million. The average download is 15,000-20,000 messages per second. The server has 32 threads, 64GB of RAM. The threads are distributed as follows: 20 threads per processor buffer, 10 threads per output buffer. At the same time, the queue of the processor buffer grows before it can be processed. Is it possible to optimize the services somehow?

2

15-20k logs / sec is serious data. Is the output buffer full before the processing buffer is full? If that is the case the OpenSearch is the bottleneck - you need to increase the performance here. If the output buffer is empty and processing fills up only your bottleneck is here. Then you should check your parsing for regexploits.