Hi Jochen, Okay. I've changed the aws instance type to a larger one and increased the heap for elasticsearch, gl2-server & radio.. Looks good so far. I'll monitor the system for a day and will confirm.
Thanks, Seby. On Sun, Nov 2, 2014 at 4:43 PM, Jochen Schalanda <joc...@torch.sh> wrote: > Hi Seby, > > Am Sonntag, 2. November 2014 09:15:33 UTC+1 schrieb Seby Francis: >> >> We have a cluster of graylog2 servers (3 instances on aws) configured and >> I see the message_cache_spool_dir is getting filled up. Not sure what to >> change. >> > > Unfortunately the off-heap message cache is currently unbound which means > that it'll always grow (if there are any messages cached) and only on > restart of Graylog2 it will be compacted (freeing some disk space if > possible). If you're sure that all messages in the cache have been > processed you can simply delete the files in the spool directory of > Graylog2 between restarts. > > > [root@2-graylog2 message-cache-spool]# ls -lrt >> -rw-r--r-- 1 graylog2 graylog2 1048576 Oct 30 12:02 input-cache.t >> -rw-r--r-- 1 graylog2 graylog2 1048576 Oct 30 12:02 input-cache.p >> -rw-r--r-- 1 graylog2 graylog2 1048576 Oct 30 12:02 input-cache >> -rw-r--r-- 1 graylog2 graylog2 2097152 Nov 1 22:50 output-cache.t >> -rw-r--r-- 1 graylog2 graylog2 86901784576 Nov 1 22:50 output-cache.p >> -rw-r--r-- 1 graylog2 graylog2 1237319680 Nov 1 22:50 output-cache >> > > The size of your output message cache looks like your backend (i. e. > Elasticsearch) isn't able to keep up with the amount of messages it should > index. Maybe you should see if you could optimize Elasticsearch a little > bit there. In a "healthy" setup, the input and output caches should not be > in use at all. > > > Cheers, > Jochen > > -- > You received this message because you are subscribed to the Google Groups > "graylog2" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to graylog2+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
