I've installed 1.0.1 by deploying latest AWS image from https://github.com/Graylog2/graylog2-images/tree/master/aws on a medium (4GB) instance. Two configured inputs: syslog TCP and UDP on 513.
After running for a few days, Graylog spontaneously restarts, and when the inputs spin up, they find the system resources too consumed by other things to allow them sufficient memory: Input 550ac07ee4b00f1a0c17d878 has failed to start on node 3afac49d-1641-4e00-807c-3922f9ca37a4 for this reason: "Cannot allocate memory." Checking 'top' shows 135MB left out of the 4GB VM, of which 2GB, 0.8GB, and 0.5GB go to three Java processes, 33MB to Mongo :), and the rest various smaller processes. This is not a heavily-loaded instance, but regardless, I am guessing something is off-kilter somewhere in the JVM memory options of the 3 big guys. But I can't find where I should be configuring this. Is this supposed to be user-accessible configuration or is it deliberately buried? Either way something must be off in the default config. Also it is disturbing that graylog spontaneously restarts, and I can't find anything in the logs indicating why. Does anyone know why this might occur? Logs of an example incident below, showing spontaneous restart at 04:46am 2015/04/06. 2015-04-06 04:46:46.626 +03:00 3afac49d-1641-4e00-807c-3922f9ca37a4 Cannot allocate memory. 2015-04-06 04:46:46.621 +03:00 3afac49d-1641-4e00-807c-3922f9ca37a4 Cannot allocate memory. 2015-04-06 04:46:46.602 +03:00 3afac49d-1641-4e00-807c-3922f9ca37a4 Input [Syslog TCP/550ac07ee4b00f1a0c17d878] is now STARTING 2015-04-06 04:46:46.595 +03:00 3afac49d-1641-4e00-807c-3922f9ca37a4 Input [Syslog UDP/550ac062e4b00f1a0c17d857] is now STARTING 2015-04-06 04:46:46.547 +03:00 3afac49d-1641-4e00-807c-3922f9ca37a4 Started up. 2015-03-27 16:04:33.072 +02:00 3afac49d-1641-4e00-807c-3922f9ca37a4 Input [Syslog UDP/550ac062e4b00f1a0c17d857] is now RUNNING 2015-03-27 16:04:33.069 +02:00 3afac49d-1641-4e00-807c-3922f9ca37a4 Input [Syslog TCP/550ac07ee4b00f1a0c17d878] is now RUNNING 2015-03-27 16:04:32.936 +02:00 3afac49d-1641-4e00-807c-3922f9ca37a4 Input [Syslog TCP/550ac07ee4b00f1a0c17d878] is now STARTING 2015-03-27 16:04:32.912 +02:00 3afac49d-1641-4e00-807c-3922f9ca37a4 Input [Syslog UDP/550ac062e4b00f1a0c17d857] is now STARTING 2015-03-27 16:04:32.843 +02:00 3afac49d-1641-4e00-807c-3922f9ca37a4 Started up. -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
