Hi Jochen,
We ended up deleting everything in /var/lib/graylog-server/journal/, but we lost all the messages. We saw some weird error messages about the memory usage in Elasticsearch. We had set it to use 50% of the available memory on the server, but it did not seem to be working. We also did the following configuration file changes: /usr/lib/systemd/system/elasticsearch.service LimitNOFILE=65536 LimitMEMLOCK=infinity /etc/security/defaults.conf elasticsearch - nofile 65535 elasticsearch - memlock unlimited root - memlock unlimited /etc/default/elasticsearch MAX_LOCKED_MEMORY=unlimited ES_HEAP_SIZE=6g (This is half of our memory) I am not sure if all this is right, but my Linux top command shows “Virtual memory” for elasticsearch at 13G and “Resident memory” as 6.5G. Thank you for your reply. Beth On Tuesday, December 13, 2016 at 12:15:10 AM UTC-8, Jochen Schalanda wrote: > > Hi, > > On Monday, 12 December 2016 23:14:22 UTC+1, OlyLady wrote: >> >> Hi, I am having the same issue. The journal is getting big and nothing is >> going to Elasticsearch. How do you actually "flush" the disk journal? I am >> using Debian Jessie and Graylog 2.1. My graylog journal is in >> /var/lib/graylog-server/journal. >> > > You don't have to flush the disk journal manually. If messages won't get > indexed and removed from the disk journal, something is wrong. Check the > logs of your Graylog and Elasticsearch nodes and make sure that the ES > cluster is healthy. > > If everything else fails, you can delete the files under > /var/lib/graylog-server/journal/ (while Graylog *is not* running) to > "reset" the disk journal. > > Cheers, > Jochen > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/a242e7e8-273a-4438-9c32-f3cd390d8b96%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
