I also have the question.
I have two servers to collect syslog.
Server A was for F5 ASM security log, but it did not any plugin in it.
Server B was for cisco netflow log, it have installed netflow plugin.
Server B always has out of memory issue.
Server A have run about 14 days, it still fine.
I guess the netflow plugin cause it.
Server A, B config:
8 Cores CPU
16G Rams
100G Disk
DEFAULT_JAVA_OPTS="-Djava.library.path=${GRAYLOGCTL_DIR}/../lib/sigar
-Xms1g -Xmx2g -XX:NewRatio=1 -XX:PermSize=128m -XX:MaxPermSize=256m -server
-XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled
-XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC
-XX:-OmitStackTraceInFastThrow"
JAVA_OPTS="${JAVA_OPTS:="$DEFAULT_JAVA_OPTS"}"
Enrico於 2016年9月2日星期五 UTC+8下午8時12分11秒寫道：
>
>
>
> On Friday, July 8, 2016 at 12:45:01 PM UTC+2, Rumen Tashev wrote:
>>
>> I have a similar problem on my Graylog2 configuration. I have a cluster
>> with two nodes. The problem is with my slave node, where we capture NetFlow
>> data from our routers. The incoming messages are about 30 - 50 per second.
>> I have allowed up to 4g of heap memory for the graylog-server. With a fresh
>> start, the node uses up to 972.8 MB and this starts to grow over time. It
>> takes approximately 24 hours until the node reaches the full 4g (shown as
>> 3.8 GB) and then constantly stops and re-starts. A re-start on the node
>> (graylog-ctl stop && shutdown -r now) rectifies the problem, but then again
>> just temporary. The graylog slave node is configured as "backend".
>>
>> We have the 100% same configuration on the master node, where this
>> problem does not appear. The master node runs for weeks now, processing
>> about 10 - 30 messages per second and uses 1.1GB of heap space. It never
>> reaches any close to 3.8 GB, which would be the maximum configured. The
>> only difference is, that it does not accept any NetFlow messages.
>>
>> Previously we had the NetFlow messages go to the master node. Then the
>> exact same behaviour would appear there as well - the node gradually
>> consumes more and more memory, until it reaches a state where it constantly
>> crashes and restarts. Moving the NetFlow messages to the slave seems to
>> have rectified the problem on the master. Both nodes run the latest version
>> of Graylog2 - 2.0.3.
>>
>> Do you also run NetFlow inputs on your node? Any help is greatly
>> appreciated!
>>
>
>
> nobody has reply ?
> Thanks
> Enrico
>
>
--
CONFIDENTIALITY NOTICE:
除本電子郵件傳送之特定對象，其他人非經同意不得轉載或散佈本郵件、附件或其所含之任何訊息。
This e-mail message including any attachments of any type is confidential
and may include legally protected information. If you are not the intended
recipient or you have received this e-mail message by mistake, printing,
copying, storing or disseminating in any way is prohibited and do doing so
could subject you to civil and or criminal action.
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/9fe2a0aa-5aee-49fe-b479-1a69e5b5ee35%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
