Hi Olaf, have you tried upgrading to Graylog2 0.92.4 <https://www.graylog2.org/news/post/0015-graylog2-v0-92-4> and does the problem still occur? In general I'd suggest deactivating the disk based message spool <https://github.com/Graylog2/graylog2-server/blob/0.92.4/misc/graylog2.conf#L310-312> completely or to disable the output cache <https://github.com/Graylog2/graylog2-server/blob/0.92.4/misc/graylog2.conf#L346-350>. It just didn't work as intended in many scenarios.
You can also try the JVM options we've added by default for Graylog 1.0.0 ( https://github.com/Graylog2/graylog2-server/blob/1.0.0-rc.1/bin/graylogctl#L54) which should also take some pressure off your system. Cheers, Jochen On Thursday, 29 January 2015 13:33:26 UTC+1, Olaf Heydorn wrote: > > Hi, > > we are running a graylog2 instance on 92.3 with an elasticsearch cluster > on 1.4.2. Our graylog-server is processing between 1000-2000 messages/sec, > but after some time the master_cache gets a couple of messages 20-100, > which are never removed. Of course when I restart the instance the messages > in the master_cache are gone, but if there are any files in the spool > directory on the graylog2 node, I have to delete them as well, otherwise I > won't get graylog2 up again. instead I receive a lof of null pointer > exceptions. > > Any idea? > > Regards, > > Olaf > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
