Some questions about RAM

[g.tran (GiaHungTran)]

I am having now issue with RAM consumption, but Graylog doesn’t have any problem with performance.

all 3 components: Graylog, Elasticsearch and MongoDB are installed on the same Machine with 4 cores and 16 GB RAM.

Heap Size of Graylog
GRAYLOG_SERVER_JAVA_OPTS=“-Djava.net.preferIPv4Stack=true -Xms4000m -Xmx4000m -XX:NewRatio=1 -server -XX:+ResizeTLAB -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:-OmitStackTraceInFastThrow”

Heap Size of Elasticsearch is default 4GB

Xms represents the initial size of total heap space

Xmx represents the maximum size of total heap space

-Xms4g
-Xmx4g

I have some questions:

1. Graylog and Elastichsearch Heap size is set for 4GB, but in reality Graylog is taking 4720M and Elasticsearch is taking 4993M Ram. Is it normal like this?

2. Why MongoDB is taking too much RAM. Can I limit the RAM for MongoDB?

3. Even RAM is showing high, but there is no issue until now. It’s ok like this or is there any potential issue for the future?

Thank you for your help.

[ihe]

The Ram-Usage of Mongo is sometimes a bit strange. In older versions the Garbage collector needed to collect stuff, and the trigger for that was (default) 50% of total RAM or so. I think this might be the case in your instance as well. After a restart of Mongo this gets better, as long as there is not so much activity around mongo.

[g.tran (GiaHungTran)]

Thank you for your reply. Is it safe to restart MongoDB, will I lose any logs? if MongoDB after restart will raise the RAM again and doesn’t crash the machine, then I don’t have any problem to keep it like this.

[ihe]

In the time there is no mongo available the Graylog will be unhappy. I assume a Mongo-Restart should not take longer than 30 seconds. Depending on your log-sources you will miss some logs (UDP), or the application might be so smart and buffer them.