Re: [graylog2] Journal settings
Thanks I will look into this and update my findings. On Thursday, February 26, 2015 at 12:00:15 AM UTC-7, Bernd Ahlers wrote: > Hey, > > you can tweak the "message_journal_max_age" and > "message_journal_max_size" settings in your graylog.conf. (see > > https://github.com/Graylog2/graylog2-server/blob/master/misc/graylog2.conf#L250-L254) > > > > That said, if you constantly writing more messages into the journal > than you read from it, the journal will always fill up. This indicates > that your Graylog server or Elasticsearch server is not able to keep > up with the incoming message rate. The journal helps with temporary > load spikes or if Elasticsearch is down for a short period. It does > not help if you send more messages than you can process. > > Since your Elasticsearch seems to be bored, you might check the CPU > usage of your Graylog server. Do you have lots of extractors? Reverse > DNS lookups enabled? > > Regards, > Bernd > > On 24 February 2015 at 17:16, > > wrote: > > I have upgraded to 1.0, I am seeing errors regarding Journaling useage > > being too high and deletion of messages due to journaling params being > too > > low. what params can I change? I only see on or off when it comes to > > journaling. I do have a cluster for ES, running two nodes 32gb of ram > each, > > 4 cores. they seem bored looking at the metrics. I have increased the > batch > > size to 1500, but journaling is still running at ~95% and higher. > > > > Thanks in advance for any suggestions. > > > > -- > > You received this message because you are subscribed to the Google > Groups > > "graylog2" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to graylog2+u...@googlegroups.com . > > For more options, visit https://groups.google.com/d/optout. > > > > -- > Developer > > Tel.: +49 (0)40 609 452 077 > Fax.: +49 (0)40 609 452 078 > > TORCH GmbH - A Graylog company > Steckelhörn 11 > 20457 Hamburg > Germany > > Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175 > Geschäftsführer: Lennart Koopmann (CEO) > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
Re: [graylog2] Journal settings
Hey, you can tweak the "message_journal_max_age" and "message_journal_max_size" settings in your graylog.conf. (see https://github.com/Graylog2/graylog2-server/blob/master/misc/graylog2.conf#L250-L254) That said, if you constantly writing more messages into the journal than you read from it, the journal will always fill up. This indicates that your Graylog server or Elasticsearch server is not able to keep up with the incoming message rate. The journal helps with temporary load spikes or if Elasticsearch is down for a short period. It does not help if you send more messages than you can process. Since your Elasticsearch seems to be bored, you might check the CPU usage of your Graylog server. Do you have lots of extractors? Reverse DNS lookups enabled? Regards, Bernd On 24 February 2015 at 17:16, wrote: > I have upgraded to 1.0, I am seeing errors regarding Journaling useage > being too high and deletion of messages due to journaling params being too > low. what params can I change? I only see on or off when it comes to > journaling. I do have a cluster for ES, running two nodes 32gb of ram each, > 4 cores. they seem bored looking at the metrics. I have increased the batch > size to 1500, but journaling is still running at ~95% and higher. > > Thanks in advance for any suggestions. > > -- > You received this message because you are subscribed to the Google Groups > "graylog2" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to graylog2+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- Developer Tel.: +49 (0)40 609 452 077 Fax.: +49 (0)40 609 452 078 TORCH GmbH - A Graylog company Steckelhörn 11 20457 Hamburg Germany Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175 Geschäftsführer: Lennart Koopmann (CEO) -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
[graylog2] Journal settings
I have upgraded to 1.0, I am seeing errors regarding Journaling useage being too high and deletion of messages due to journaling params being too low. what params can I change? I only see on or off when it comes to journaling. I do have a cluster for ES, running two nodes 32gb of ram each, 4 cores. they seem bored looking at the metrics. I have increased the batch size to 1500, but journaling is still running at ~95% and higher. Thanks in advance for any suggestions. -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
