I'm assuming you're referring to Graylog Server "clustering" -- and not MongoDB or ElasticSearch.
If "high availability" is important to you, then I'd suggest having at least 2 Graylog Server processes running across as many availability zones as possible (e.g. different racks in a data center, etc.) You'll also want to ensure that whatever is feeding your Graylog Servers can re-establish a "connection" (a term I'll use loosely due to UDP being a possible protocol) in the event of a failure with the Graylog Server it initially connects with. Lastly, you should ensure that you measure the performance (e.g. CPU, disk, memory, throughput, etc.) of each Graylog Server node to ensure you have enough capacity. You could also take a look at https://www.graylog.org/tools/sizing-estimator for some capacity planning help (but this shouldn't replace collecting performance metrics into your monitoring system). In terms of 'hard limits' to the number of devices which can connect to a Graylog server, it depends on which input protocol is used (e.g. TCP or UDP). For TCP-based connections, the number of file descriptors allocated to the Graylog Server process will determine this limit. HTH, Frederic On Tuesday, June 28, 2016 at 10:30:19 AM UTC-7, Jamie P wrote: > > I have looked this group over and did some Google searches to no avail. > My question is, at what point do you consider using a clustered setup vs. > a single server instance? I know it's based off of how many servers and > devices will be reporting to the server but I can't find any info that > suggests "Well if you have this many devices and servers reporting in then > you should consider having this many nodes, and this many graylog > instances, etc., etc." > > I want to make sure that I build out the correct solution. I don't want > to go overkill and over estimate, but I don't want to under estimate as > well. Any documentation or websites discussing this would be most helpful. > Thanks. > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/c69368e3-7f36-42b7-b927-a3a121e4b97b%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
