Multiple Datacenter Setup

#1

Hi, on this FAQ page for multi-datacenter setup: http://docs.graylog.org/en/2.2/pages/faq.html.

"I have datacenters across the world and do not want logs forwarding from everywhere to a central location due to bandwidth, etc. How do I handle this?"
Answer: “You can have multiple graylog-server instances in a federated structure, and forward select messages to a centralized GL server.”

Can someone provide the documentation for a federated structure setup?

For smaller datacenters, will you still recommend a full production architecture, or will a minimum setup be sufficient?
(http://docs.graylog.org/en/2.2/pages/architecture.html)

(Jochen) #2

This refers to the possibility to create a GELF output in Graylog and send the messages of all streams (or of the “All messages” stream) to another Graylog node, see System / Outputs in the Graylog web interface.

What is a “small” datacenter? How many clients, how many events per second (on average and in peak), and how big are the messages?

#3

There are about 50 clients. On average there’s 1 event per second per node. So there are 50 events per second on average.

I do not have a good estimation of the peak but assume that’s double the size (100 events per second).

Each message is about 4KB.

#4

Average: 10,000KB/s
Peak: 20,000KB/s

(Jochen) #5

This is a load that a very small single node Graylog installation can handle (if you don’t care for high availability).

You could install the OVA on a machine with a few CPU cores and 4 GB of memory and it could handle the load.

What are these specifications for? That doesn’t match the 50 events per second (50 eps * 4 KB == 200 KB/s).

#6

Thanks. At what number of clients/events per second would you recommend a full production setup (at least 2 graylog nodes with a load balancer, and at least 3 elasticsearch nodes)?

Please ignore the 2 values I provided earlier. Thanks.

(Jochen) #7

That’s hard to say without all details and I’d rather not generalize this.

(system) closed #8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.