I figured it out eventually for a collector installed via RPM on CentOS 7 the default
initial Java heap size (-Xms) is set to 12MB maximum Java heap size (-Xmx) is set to 64MB You can configure the settings in */usr/share/graylog-collector/graylog-collector-script-config.sh *or you can run the sed command below to update the settings. Change Xms and Xmx accordingly. sed -i -e 's/-Xms12m -Xmx64m/-Xms128m -Xms256m/' /usr/share/graylog-collector/graylog-collector-script-config.sh Finally you need to restart the service. On Monday, February 22, 2016 at 9:13:09 AM UTC+2, clikcspeed wrote: > > Hello > > I am getting this error message in > */var/log/graylog-collector/collector.log:* > > 2016-02-22T08:53:19.697+0200 ERROR > [chunkreader-scheduler-thread-local-syslog-0] collector.file.ChunkReader - > Unable to allocate buffer > java.lang.OutOfMemoryError: Direct buffer memory > at java.nio.Bits.reserveMemory(Bits.java:658) ~[?:1.8.0_65] > at java.nio.DirectByteBuffer.<init>(DirectByteBuffer.java:123) > ~[?:1.8.0_65] > at java.nio.ByteBuffer.allocateDirect(ByteBuffer.java:311) > ~[?:1.8.0_65] > at > org.graylog.collector.file.ChunkReader.run(ChunkReader.java:145) > [graylog-collector.jar:?] > at > java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) > [?:1.8.0_65] > at > java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) > [?:1.8.0_65] > at > java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) > > [?:1.8.0_65] > at > java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) > > [?:1.8.0_65] > at > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) > > [?:1.8.0_65] > at > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) > > [?:1.8.0_65] > at java.lang.Thread.run(Thread.java:745) [?:1.8.0_65] > > > When this happens, the collector stops sending logs to the server until > the service (collector) is restarted. > > The configuration in */etc/graylog/collector/collector.conf *is below: > > server-url = "http://graylog-srv-01:12900"; > enable-registration = true > collector-id = "file:/etc/graylog/collector/collector-id" > > inputs { > local-syslog { > type = "file" > path = "/var/log/audit/audit.log" > //charset = "utf-8" > content-splitter = "newline" > } > } > > outputs { > gelf-tcp { > type = "gelf" > host = "graylog-srv-01" > port = 12201 > //client-tls = false > //client-tls-cert-chain-file = "/path/to/cert-chain.pem" > //client-tls-verify-cert = false > //client-queue-size = 512 > //client-connect-timeout = 5000 > //client-reconnect-delay = 1000 > //client-tcp-no-delay = true > //client-send-buffer-size = 32768 > } > } > > > Browsing around, I have seen that this issue will most likely be resolved > by increasing the heap size for JVM. I do not know where to change this for > Graylog Collector. The collector (version 1.3) was installed via RPM > packages on CentOS 7. > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/261a2d51-0322-4bf5-a2c5-c533304a1205%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
