Thanks for the reply. How do I clear the journal of old messages before I
restart it?
On Wednesday, February 25, 2015 at 10:54:42 PM UTC-8, Bernd Ahlers wrote:
Ed,
as Tristan already said, if you constantly sending in more messages
than Graylog or Elasticsearch can process, you will always fill up
your journal.
Disabling the journal does not really fix the problem, because you
will now lose messages.
Please check the node details page (System - Nodes - click on the
node name) and check the disk journal stats. If you writing more into
the journal than reading from it, you have a problem with processing
throughput.
Regards,
Bernd
On 26 February 2015 at 00:50, Tristan Rhodes tristan...@gmail.com
javascript: wrote:
Ed,
I had this same problem. However, increasing the journal size will only
help if your rate of messages periodically decreases below what your
system
can process. (For example, you will grow the journal during peak hours
of
the day, and drain the journal when fewer logs are being sent to
Graylog).
If you are always sending more messages than your Elasticsearch can
ingest,
the journal will not help. I increased my Elasticsearch ingesting
performance by changing this setting in elasticsearch.yml:
index.refresh_interval: 30s
You can read more about this setting here:
http://blog.sematext.com/2013/07/08/elasticsearch-refresh-interval-vs-indexing-performance/
http://www.elasticsearch.org/blog/performance-considerations-elasticsearch-indexing/
Disclaimer: I am new to graylog+elastisearch and barely know what I am
doing. :)
Cheers!
Tristan
On Mon, Feb 23, 2015 at 10:41 AM, Ed Totman eto...@gmail.com
javascript: wrote:
I deployed the latest appliance from the ova file. Graylog2 worked
fine
for several days, but then the journal files grew to 5GB which is the
default limit and search returns no current results. On the System
page
this error appeared:
Journal utilization is too high a few seconds ago
Journal utilization is too high and may go over the limit soon. Please
verify that your Elasticsearch cluster is healthy and fast enough. You
may
also want to review your Graylog journal settings and set a higher
limit.
(Node: 43a9cc82-dc5a-4492-936b-418e1bc98f5e, journal utilization:
96.0%)
I increased the journal limit to 10GB but this did not fix the problem.
I
restarted all services and checked the logs, but could not find any
obvious
problem. The VM is running on very fast storage with lots of CPU and
memory. I set message_journal_enabled = false which seems to have
temporarily resolved the problem.
How do I troubleshoot the journal? All of the other components are
working fine.
--
You received this message because you are subscribed to the Google
Groups
graylog2 group.
To unsubscribe from this group and stop receiving emails from it, send
an
email to graylog2+u...@googlegroups.com javascript:.
For more options, visit https://groups.google.com/d/optout.
--
Tristan Rhodes
--
You received this message because you are subscribed to the Google
Groups
graylog2 group.
To unsubscribe from this group and stop receiving emails from it, send
an
email to graylog2+u...@googlegroups.com javascript:.
For more options, visit https://groups.google.com/d/optout.
--
Developer
Tel.: +49 (0)40 609 452 077
Fax.: +49 (0)40 609 452 078
TORCH GmbH - A Graylog company
Steckelhörn 11
20457 Hamburg
Germany
Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175
Geschäftsführer: Lennart Koopmann (CEO)
--
You received this message because you are subscribed to the Google Groups
graylog2 group.
To unsubscribe from this group and stop receiving emails from it, send an email
to graylog2+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
