Is elasticsearch on the same node? You'll definitely want to update the ES_HEAP_SIZE after adding more RAM. Same goes for adjusting the Graylog heap size.
http://docs.graylog.org/en/latest/pages/configuring_es.html If you're logging 130 servers + ASA, I think it's time to setup some load balancers and get another graylog instance going. Build out an ES cluster too. Just my opinion :) On Thursday, May 7, 2015 at 9:31:27 PM UTC-4, BKeep wrote: > > We just setup our ASA to send logs into graylog and It appears the graylog > setup is not keeping up with the incoming log data. The server currently > has 8 GB of RAM and 2vCPU's. Up until the addition of the ASA, that setup > has been keeping up pretty well. However, it looks like i am going to have > to make some adjustments. Prior to adding the ASA logs we were logging for > about 130 servers. My question is what would be the next steps? Obviously > add some Memory resources and another couple of vCPU's but once the ram is > added are there any other adjustments to be made on the server itself? > > Thanks in advance.. > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
