How can I determine the correct sizing (memory, cpu) and java settings for my graylog (v2.1.1-1) nodes?
Some details about the 5 nodes (Ubuntu 14.04 VMs), each node has: - 4G memory - 4 cpus (2700Mhz) - Java settings: GRAYLOG_SERVER_JAVA_OPTS="-Xms1g -Xmx2g -Djava.net.preferIPV4stack=true The Elasticsearch cluster beneath it runs on physical hardware and has no problems taking in all the data, it is also very stable. On average in total the cluster receives 5000 msg/s but on peaks this can go to 13000 msg/s. There are 85 similar active streams were stream does two regexp for incoming messages, for example: - *source* must match regular expression *^UGA-|^UGDHCP **ap-name* must match regular expression *^UGA-* When the input reaches above 1000 msg/s I get Zabbix high CPU alerts for the graylog nodes. Also I had to get this error for nodes regarding Garbage Collection: There are Graylog nodes on which the garbage collector runs too long. Garbage collection runs should be as short as possible. Please check whether those nodes are healthy. (Node: *3e0e271a-3a0b-4b48-8b82-ac8c6e714b09*, GC duration: *1113 ms*, GC threshold : *1000 ms*) There are tons of things I can adjust, for example: increase memory, cpus, java heap size, et cetera. I'd like to have some guidance on what to adjust and the reasoning behind it. Thank you! Sander -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/bcf39609-e948-40fa-87d9-14c597ad6c45%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
