# Negative number of Unprocessed Message

**URL:** <https://community.graylog.org/t/negative-number-of-unprocessed-message/16701>\
**Category:** Graylog Central (peer support)\
**Created:** [August 6, 2020, 5:56pm UTC](https://community.graylog.org/t/negative-number-of-unprocessed-message/16701 "2020-08-06T17:56:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tiger](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@Tiger](https://community.graylog.org/u/Tiger)\
**Post date:** [August 6, 2020, 5:56pm UTC](https://community.graylog.org/t/negative-number-of-unprocessed-message/16701/1 "2020-08-06T17:56:28Z")

</div>

Hello,

I have three Graylog (3.1.2) nodes (Kubernetes). With unexpected load, the Disk journals were full (with some message are deleted), and then utilization was lower to ~70% with ~ 5,000,000 messages in each of their journals.

I increased the capacity (replaced) the node, the processing seemed good (speed up) for a short time. However a little bit later, one of the journals contains -454,097,877 unprocessed messages, and the other two have a few hundred messages in their journal.

What does this mean?

I replace the node one by one again, the numbers are still the same.

The negative number is slowly going up.  
It seems the messages in the journals are lost.

Tige

---

<div class="post-metadata">

**Author:** ![makarands](https://avatars.discourse-cdn.com/v4/letter/m/838e76/32.png) [@makarands](https://community.graylog.org/u/makarands)\
**Post date:** [August 7, 2020, 12:58pm UTC](https://community.graylog.org/t/negative-number-of-unprocessed-message/16701/2 "2020-08-07T12:58:41Z")

</div>

@Tiger It looks like your elasticsearch hosts not accepting messages due to some reason which we can get after reviewing ES logs and also check journal directory utilization if that’s full then you should make some space on it. Please check the below FAQ documentation for your reference.  
[https://docs.graylog.org/en/latest/pages/faq.html#what-does-uncommited-messages-deleted-from-journal-mean](https://docs.graylog.org/en/latest/pages/faq.html#what-does-uncommited-messages-deleted-from-journal-mean)

Hope this helps you 🙂

---

<div class="post-metadata">

**Author:** ![Tiger](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@Tiger](https://community.graylog.org/u/Tiger)\
**Post date:** [August 8, 2020, 3:06pm UTC](https://community.graylog.org/t/negative-number-of-unprocessed-message/16701/3 "2020-08-08T15:06:37Z")

</div>

Found a warning in graylog node. It may be related to this issue:  
2020-08-07 20:47:54,158 WARN [AbstractTcpTransport] - receiveBufferSize (SO\_RCVBUF) for input GELFTCPInput{title=Gelf\_TCP\_Graylog, type=org.graylog2.inputs.gelf.tcp.GELFTCPInput, nodeId=null} (channel [id: 0xa27b08c9, L:/0.0.0.0:12201]) should be 1048576 but is 425984. - {}

It seems the bad node only taking in messages without process and I cannot figure out how to fix if in the non-prod environment, turn on graylog.journal.deleteBeforeStart and restart the node to bring it up to normal.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 22, 2020, 3:06pm UTC](https://community.graylog.org/t/negative-number-of-unprocessed-message/16701/4 "2020-08-22T15:06:44Z")

</div>

Closed on August 22, 2020, 3:06pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.