It is possibly a configuration issue on our side, but we have a content switch load balancer setup to round robin between two graylog nodes. What i'm seeing is that the load balance is only distributing the number of endpoinds sending logs to each graylog node and not truly round robining the messages. this makes the graylog cluster unable to handle excessive load.
The load balancer also does not properly detect dead/alive nodes and continues to send message to offline graylog nodes (this is likely a load balancer configuration). I'm curious what graylog recommends as far as making this work as intended. On Wednesday, August 26, 2015 at 3:40:27 AM UTC-5, Jochen Schalanda wrote: > > Hi Drew, > > I know of several installations of Graylog which use load balancers in > front of a Graylog cluster. Are there any specific problems you've > encountered in regard to Graylog's part in this setup? > > Just one remark: Load balancing GELF messages sent via UDP (Graylog's GELF > UDP input) might cause some problems due to the chunking feature which > requires all chunks of a GELF message being sent to the same Graylog server > node. Also take a look at > http://docs.graylog.org/en/1.1/pages/load_balancers.html for some hints > how to configure a highly available Graylog setup. > > > Cheers, > Jochen > > On Wednesday, 26 August 2015 05:28:17 UTC+2, Drew Miranda wrote: >> >> I'm working with our network guys to setup a load balancer configuration. >> It does work, but it does not alternate which graylog node it sends >> messages too. >> >> An example of what I'd like to happen: each graylog node currently only >> effectively process up to 1000 messages per second. Server A may send a >> surge of 10,000 messages in one second and fill up a single graylog node >> until the journal is fully processed. If messages are alternated via the >> load balancer, multiple graylog nodes can share the load and process >> messages more quickly. >> > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/188b41c3-3898-4c48-886b-b7bfc473a7c1%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
