Hi guys, We have a cluster of graylog2 servers (3 instances on aws) configured and I see the message_cache_spool_dir is getting filled up. Not sure what to change. I see this on graylog2 master host as well. Here is the snippet of diskusage:
[root@2-graylog2 ~]# df -h Filesystem Size Used Avail Use% Mounted on /dev/xvde 99G 94G 26M 100% / tmpfs 1.8G 0 1.8G 0% /dev/shm /dev/xvdj 99G 16G 78G 17% /graylog2 [root@2-graylog2 ~]# cd / [root@2-graylog2 /]# du -ks *|sort -n|tail -2 16013564 graylog2 96146920 var [root@2-graylog2 /]# cd /var [root@2-graylog2 var]# du -ks *|sort -n|tail -2 156436 log 95902964 lib [root@2-graylog2 var]# cd lib [root@2-graylog2 lib]# du -ks *|sort -n|tail -2 9810992 mongo 86059256 graylog2-server [root@2-graylog2 lib]# cd graylog2-server [root@2-graylog2 graylog2-server]# du -hs message-cache-spool/ 83G message-cache-spool/ [root@2-graylog2 graylog2-server]# cd message-cache-spool/ [root@2-graylog2 message-cache-spool]# ls -lrt -rw-r--r-- 1 graylog2 graylog2 1048576 Oct 30 12:02 input-cache.t -rw-r--r-- 1 graylog2 graylog2 1048576 Oct 30 12:02 input-cache.p -rw-r--r-- 1 graylog2 graylog2 1048576 Oct 30 12:02 input-cache -rw-r--r-- 1 graylog2 graylog2 2097152 Nov 1 22:50 output-cache.t -rw-r--r-- 1 graylog2 graylog2 86901784576 Nov 1 22:50 output-cache.p -rw-r--r-- 1 graylog2 graylog2 1237319680 Nov 1 22:50 output-cache [root@2-graylog2 message-cache-spool]# Here is my current config file looks like: -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ is_master = false node_id_file = /etc/graylog2/server/node-id password_secret = aeRgD1vHCOJObPYwnlt0UsfxQnd2DAYyuvMS8WdQ4GldPyMw929huH7jtvII3Lf7bY6jvOdYemLvfEEwpdb6w7h7xYk7eIG8 root_password_sha2 = ece1515a0a2a0e504bcc8a619aea25dde30f2d8d9c87372a1a720b71064361e4 plugin_dir = /usr/share/graylog2-server/plugin rest_listen_uri = http://2-graylog2.sfk.com:12900/ elasticsearch_max_docs_per_index = 2000000 elasticsearch_max_number_of_indices = 50 retention_strategy = delete elasticsearch_shards = 2 elasticsearch_replicas = 1 elasticsearch_index_prefix = graylog2 allow_leading_wildcard_searches = false allow_highlighting = false elasticsearch_cluster_name = aws-graylog2 elasticsearch_node_name = "2 Graylog2" elasticsearch_node_master = false elasticsearch_node_data = false elasticsearch_http_enabled = false elasticsearch_discovery_zen_ping_multicast_enabled = false elasticsearch_discovery_zen_ping_unicast_hosts = 1-graylog2.sfk.com:9300,2-graylog2.sfk.com:9300,3-graylog2.sfk.com:9300 elasticsearch_analyzer = standard output_batch_size = 25 output_flush_interval = 1 processbuffer_processors = 15 outputbuffer_processors = 15 processor_wait_strategy = blocking ring_size = 1024 dead_letters_enabled = false lb_recognition_period_seconds = 3 mongodb_useauth = true mongodb_user = graylog2 mongodb_password = graylog2 mongodb_replica_set = 1-graylog2.sfk.com:27017,2-graylog2.sfk.com:27017,3-graylog2.sfk.com:27017 mongodb_database = graylog2 mongodb_port = 27017 mongodb_max_connections = 100 mongodb_threads_allowed_to_block_multiplier = 5 transport_email_enabled = false message_cache_spool_dir = /var/lib/graylog2-server/message-cache-spool versionchecks = false -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Let me know if you need further details on this. Regards, Seby. -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
