Stream processing disabled / not using all ressources

Graylog Central (peer support)
1

I have a Graylog2 Docker installation running on a 16 core, 16 GB memory machine.

GRAYLOG_SERVER_JAVA_OPTS is set to:

“-Xms8g -Xmx8g -XX:NewRatio=1 -XX:MaxMetaspaceSize=256m -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow”

I quite often have the problem that Graylog disables streams, showing lines like this in the logs:

ERROR: org.graylog2.streams.StreamFaultManager - Processing of stream <5b716629a7b11b0001c68728> failed to return within 2000ms for more than 3 times. Disabling stream.

From what I understood this could come from too little resources. But my CPU load is only ~4.5 (with 16 cores → which means that only 1/4 of my cores are utilized).

Is there a way that I can make Graylog use all the available resources?

2

you should reduce the RAM that is dedicated to Graylog - and check the stream with the ID 5b716629a7b11b0001c68728 to remove/easy up the processing.

is Graylog the only user of the ressources or did you have additional consumers?

3

Graylog is the only application running on this host (Mongo and an Elasticsearch cluster run on dedicated nodes).

Why should I reduce the RAM dedicated to Graylog? I have 16 GB on that machine and only use 8 für Graylog/Java VM ("-Xms8g -Xmx8g").

4

you wrote that you have two Graylog instances on this 16GB host - if you apply each 8GB you have nothing left of your 16GB that are available for the OS.

In addition the garbage collection for this 8GB will take longer than for 2GB. A typical setup should not need more than 2GB of RAM for Graylog. Not speaking having big lookup tables or similar that will boost the need of your RAM.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.