Why is it a problem to have GrayLog and the Data Node on the same machine?

Graylog Central (peer support)
,
1

Hi, I’m new to GrayLog (not even actually a user, yet) and still considering my options.

1. Describe your incident:

It’s not an incident per-se. Given the modest size of our environment we would like to install all components on a single machine. I have noticed in the documentation that it is strongly discouraged to have the data node on the same machine as GrayLog itself. But the reason isn’t explained (or I haven’t found it). Reading between the lines (which is always a perilous exercise), I have come to the conclusion that it’s mostly because it would complicate scaling up, down the road. Is that so? Any other reason we should take into consideration?

2. Describe your environment:

  • OS Information:
    Debian 12

  • Package Version:
    Would be the latest available.

  • Service logs, configurations, and environment variables:
    So far we’re working on a simple centralized rsyslog sink for servers which mostly run Debian, with a couple of Ubuntu in the mix, and are considering beefing it up with GrayLog.

Thank you for your help. :slight_smile:

2

Scaling is a part of it, also both Graylog and Datanode/Opensearch are running in the JVM and so having those conflict with each other can cause strange issues, performance problems etc.

Will it start and run on the same machine, yes, could really weird things happen, and have we seen them happen, yep…

3

Ok, makes sense.

Thanks!

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.