Hi Seby, Am Sonntag, 2. November 2014 09:15:33 UTC+1 schrieb Seby Francis: > > We have a cluster of graylog2 servers (3 instances on aws) configured and > I see the message_cache_spool_dir is getting filled up. Not sure what to > change. >
Unfortunately the off-heap message cache is currently unbound which means that it'll always grow (if there are any messages cached) and only on restart of Graylog2 it will be compacted (freeing some disk space if possible). If you're sure that all messages in the cache have been processed you can simply delete the files in the spool directory of Graylog2 between restarts. [root@2-graylog2 message-cache-spool]# ls -lrt > -rw-r--r-- 1 graylog2 graylog2 1048576 Oct 30 12:02 input-cache.t > -rw-r--r-- 1 graylog2 graylog2 1048576 Oct 30 12:02 input-cache.p > -rw-r--r-- 1 graylog2 graylog2 1048576 Oct 30 12:02 input-cache > -rw-r--r-- 1 graylog2 graylog2 2097152 Nov 1 22:50 output-cache.t > -rw-r--r-- 1 graylog2 graylog2 86901784576 Nov 1 22:50 output-cache.p > -rw-r--r-- 1 graylog2 graylog2 1237319680 Nov 1 22:50 output-cache > The size of your output message cache looks like your backend (i. e. Elasticsearch) isn't able to keep up with the amount of messages it should index. Maybe you should see if you could optimize Elasticsearch a little bit there. In a "healthy" setup, the input and output caches should not be in use at all. Cheers, Jochen -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
