Stream not showing incoming messages

Graylog Central (peer support)
1

Hey everyone!

i installed graylog using docker and i have a couple of issues,

when i open a new input indice and stream, i can see there are new message incoming and outcoming, i can see them in the stream’s “messages/seconds” but it does not display them for me to view!

unfortunately I cant attach screenshots because this is on a closed system but i checked and the clock is synchronized with the browser, user and server, i see the messages in the journal log with no errors and i will start printing out messages to the stream after ~ 30 minutes of runtime.

I have also changes the time to all time with no avail.
this is the only streamactive

thank you!

2

If you choose “all messages “ from the time range selector, do your messages show up?

If not, try going to the settings for the default index and choose “recalculate index ranges” from the Maintenance button.

Try those and report back here please.

3

Hey,
the messages do not show up when i select “all messages” but i have noticed that most of the messages will appear after 2-3 hours. all of the clocks are in sync except for root use clock.

recaculate index ranges also didnt help :frowning:

4

Sounds like they may be getting caught in the journal or one of the buffers. Take a look at the System\nodes> node details page. Does it show any of your buffers or your journal as full?

5

it says “The VJm is using 663MiB of 869 MiB heap space and will not attempt to use more that 904Mib”
but i am seeing it clear itself constantly, the worst ive seen it use is 800\869, can i change these values?

also, the input Process and output buffer never change from 0.000 precent even when there are messages in and out

6

Don’t worry about heap space. GL manages that automatically.

If your buffers and your journal are empty, then this is not the source of your delayed messages.

What is your in/out rate? Average and highest load.

7

I am not sure if this is a statistic, i couldnt find it anywhere but i would say pretty minimal, i only have two input streams from different gelf ports each one of them is transmitting on different time of day and when they do transmit its about 10 lines per second

8

It’s the little in/out counter in the top right of the screen. For you, it’s probably almost always 0/0.

What do you mean that they transmit at different times? Are they sending batch events? If so, at what intervals?

9

i have two apps transmitting messages, usually one is sending throughout the day and the other throughout the night, when they do work, its usually about 16/16 in/out messages or something around that.

how ever i am only able to see those message aound 2-3 hours after i see the come in in the input/output

10

I have noticed some strange behavior,

i am sending my own logs using grypy and i see that even thoug i am getting input/output live, the messages are only really being shown when i kill the python instance and start a new one. once i do that the old logs will start showing up

11

That is quite strange. Do you have any other options on how to collect the messages?

12

thank you for the help and guidance, I solved it 20 minutes ago, apperantly graypy uses time.time() to set the time to send to graylog which sometime causes trouble when it is not in sync with daylight savings.

this is why sometimes logs were late or early by an hour or two and it varied between all of my reporting devices

13

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.