Reduce ram usage

Graylog Central (peer support)
1

I use graylog on my home server and it uses 2,8 GiB ram, opensearch is using 2 GiB and mongodb 0,2 GiB ram

combined its 5 GiB of ram

image
image792×503 26.7 KB

My outgoing traffic for the last 30 days is 41.6GiB, its 1,38 GiB daily on average

image
image818×302 9.36 KB

RAM usage seems to be quite high compared to my outbound traffic usage
Can I reduce RAM consumption by tweaking the Java parameters?

My compose file:

version: "3"
services:
  mongodb:
    image: mongo:6
    restart: always
    environment:
      TZ: Europe/Warsaw
    volumes:
        - /home/docker/ct/graylog/mongoda/db:/data/db
        - /home/docker/ct/graylog/mongoda/configdb:/data/configdb
  opensearch:
    image: "opensearchproject/opensearch:2"
    environment:
      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
      - "bootstrap.memory_lock=true"
      - "discovery.type=single-node"
      - "action.auto_create_index=false"
      - "plugins.security.ssl.http.enabled=false"
      - "plugins.security.disabled=true"
      - "TZ=Europe/Warsaw"
    ulimits:
      memlock:
        hard: -1
        soft: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - "/home/docker/ct/graylog/opensearch/data:/usr/share/opensearch/data"
    restart: always
  graylog:
    hostname: "server"
    image: "${GRAYLOG_IMAGE:-graylog/graylog:5.2}"
    depends_on:
      opensearch:
        condition: "service_started"
      mongodb:
        condition: "service_started"
    entrypoint: "/usr/bin/tini -- wait-for-it opensearch:9200 --  /docker-entrypoint.sh"
    environment:
      GRAYLOG_NODE_ID_FILE: "/usr/share/graylog/data/config/node-id"
      GRAYLOG_PASSWORD_SECRET: "${GRAYLOG_PASSWORD_SECRET:?Please configure GRAYLOG_PASSWORD_SECRET in the .env file}"
      GRAYLOG_ROOT_PASSWORD_SHA2: "${GRAYLOG_ROOT_PASSWORD_SHA2:?Please configure GRAYLOG_ROOT_PASSWORD_SHA2 in the .env file}"
      GRAYLOG_HTTP_BIND_ADDRESS: "0.0.0.0:9000"
      GRAYLOG_HTTP_EXTERNAL_URI: "http://localhost:9000/"
      GRAYLOG_ELASTICSEARCH_HOSTS: "http://opensearch:9200"
      GRAYLOG_MONGODB_URI: "mongodb://mongodb:27017/graylog"
      GRAYLOG_TIMEZONE: Europe/Warsaw
      TZ: Europe/Warsaw
    ports:
    - "192.168.0.106:9000:9000/tcp"
    - "192.168.0.106:5140:5140/udp"
    - "192.168.0.106:5140:5140/tcp"
    - "192.168.0.106:12200-12210:12200-12210/udp"
    volumes:
      - "/home/docker/ct/graylog/graylog/data:/usr/share/graylog/data/"
    restart: always
2

Hey @Valdri

Opensearch is a memory hog. Try executing HTOP or top to find out what the memory is being used.

3

How many indices do you have, what is the retention on those indices, and how many shards does each have? Possibly easier to just post a screenshot of the indices page since it’s all shown on that screen. The reason I ask in shard usage is the number one contributor to ram usage in Opensearch.

1 Like
4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.