Process buffer, 100.00% utilized

Graylog Central (peer support)
1

Hi Team,
We have been running graylog for sometime but suddenly overnight we are finding the process buffer is 100% utlised. Both the input and output buffer are at 0% and we are finding no messages in the search.
Elastic search seems to be fine and there are no errors in server.log that stands out.
Any ideas where we should be looking.
I’m wondering if it is because of the version of es we are running. We are running 7.16.2 and have been for since December with no issues.
Reading the documentation it mentions graylog supports es 7.x but I have since found we shouldn’t go above 7.10 which isn’t very clear in the documentation. Is this correct?

anyway looking forward to any pointers.
Cheers

2

Hello @lukef

Did you check you Elasticsearch?
ES Health Check
curl -XGET http://127.0.0.1:9200/_cluster/health?pretty=true
Check Shards
curl -XGET http://127.0.0.1:9200/_cat/shards
If you do find something wrong you can execute this to find out why.
ES Shard Info
curl -XGET http://127.0.0.1:9200/_cluster/allocation/explain?pretty

Is you journal full?
How many logs are ingested during this time?
What are you’re buffer settings set as?
Have you tried to increase the Processor Buffer ?

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.