The linux kernel automatically allocates unused ram to buffers and cache and adjusts each as ram is needed by other processes. This is not evidence of an issue. You don't say how many cpus are in your system, but the elasticsearch java instance is running at 100%.
>From your 'top' output, it shows "load average: 2.29, 4.56, 7.07" and if you only have 2 cpus, your host has more work to do than it can handle easily. I had a similar system (a VM) running graylog-server, graylog-web, and elasticsearch, and it didn't take much to overwhelm it. Splitting elasticsearch out onto its own host would be the first thing I do. On Sun, Feb 21, 2016 at 9:47 PM, Scarlet Eza <[email protected]> wrote: > Dear Jochen, > Thanks for your answering. As you see, RAM for my system is about 20GB but > cache being used is about 15GB and can increase in next time. Free RAM is > slow, when I access my server, I see it more slowly. Do you have any exp > for customizing graylog system. Please advise me for this case!!!. My > server receive about 200msg/s. > > > On Saturday, February 20, 2016 at 12:09:35 AM UTC+7, Jochen Schalanda > wrote: >> >> Hi Scarlet, >> >> in general it is preferable that as much memory as possible is being used >> on a system. Unused memory is useless memory. ;-) >> >> Do you have any specific problems with this memory consumption? As far as >> I see, there's very little swap being used (which is good). It is also >> advisable to let Elasticsearch and Graylog not hog all memory on the system >> so that the OS can still use some memory for buffering disk access. >> >> Cheers, >> Jochen >> >> On Friday, 19 February 2016 09:59:47 UTC+1, Scarlet Eza wrote: >>> >>> Dear all, >>> I have a physical server that running Graylog and Elasticsearch on it. >>> Everything is ok until I check performance on my server today. RAM use for >>> caching and buffering very high as below >>> >>> # top >>> top - 15:40:13 up 30 days, 6:44, 2 users, load average: 2.29, 4.56, >>> 7.07 >>> Tasks: 158 total, 1 running, 153 sleeping, 4 stopped, 0 zombie >>> %Cpu(s): 6.6 us, 6.5 sy, 0.0 ni, 80.8 id, 5.6 wa, 0.0 hi, 0.2 si, >>> 0.4 st >>> *KiB Mem : 20395564 total, 1006040 free, 3987692 used, 15401832 >>> buff/cache* >>> KiB Swap: 7812092 total, 7685912 free, 126180 used. 16038748 avail >>> Mem >>> >>> PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ >>> COMMAND >>> >>> 10410 elastic+ 20 0 20.595g 793212 15252 S 99.0 3.9 0:59.48 java >>> >>> >>> 9691 graylog 20 0 9976.5m 2.279g 18428 S 18.2 11.7 6:46.44 java >>> >>> >>> 1578 mongod 20 0 0.099t 93120 47688 S 3.6 0.5 1716:51 >>> mongod >>> >>> 17336 graylog+ 20 0 6739964 548860 6204 S 2.0 2.7 559:14.84 java >>> >>> >>> 406 root 0 -20 0 0 0 S 1.3 0.0 84:47.82 >>> kworker/4:1H >>> >>> Anyone have exp about it!!! Please help me to resolve it. >>> >> -- > You received this message because you are subscribed to the Google Groups > "Graylog Users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/graylog2/8ad5d8af-4224-4bd4-b610-ffa6ea166ae1%40googlegroups.com > <https://groups.google.com/d/msgid/graylog2/8ad5d8af-4224-4bd4-b610-ffa6ea166ae1%40googlegroups.com?utm_medium=email&utm_source=footer> > . > > For more options, visit https://groups.google.com/d/optout. > -- No matter what we think of Linux versus FreeBSD, etc., the one thing I really like about Linux is that it has Microsoft worried. Anything that kicks a monopoly in the pants has got to be good for something. - Chris Johnson -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/CAL5rfGWSmodFZoka20%2BhMdpbucqyGMtt2ggyvUkQuYn6Lx-_mQ%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
