Hi !!

New to the list and to Graylog2 :)

I'm running a PoC on a VM and I started adding more nodes. The thing is 
that at the top of the web page I can see the message: "Loading throughput" 
and it never stops.

I also see that when I click on "Statistics" or "Quick values" or "Generate 
chart" it takes for ever to show any result, even if it's a small query.

I imagine this is due to a HW limitation since I'm running my PoC on a VM 
(VMWare) with 1 core, 8 GB of RAM and about 1 TB of storage. When I run 
dstat (htop, top, ...) to see resource usage, I see:

CPU usage is low: 93% idle
RAM usage is high: 98% usaed
Swap usage: 0.45%

iostat gives me this ("a lot" of writes):
Device:         rrqm/s   wrqm/s     r/s     w/s   rsec/s   wsec/s avgrq-sz 
avgqu-sz   await  svctm  %util
sdb               0.00    28.83    0.13   10.48    23.05   322.56    32.56 
    0.01    0.70   0.45   0.47

Right now I've got around 20 servers logging to this PoC: mainly NFS, 
backup and Samba servers (all Linux). The idea would be to scale up to 
around 100 servers + switches + storage arrays (probably 120 HW devices in 
total). We seldom have a server spitting out log messages like crazy: some 
NFS server misconfigured once in a while but nothing "out of the normal" 
(if there is such thing as normal ;)

Graylog2 version is the latest available through the repos. Same with 
MongoDB and elasticsearch.

OS is CentOS 6.7 also upgraded to the latest version. I can't upgrade to 
7.x since it hasn't been "approved" internally :(

Reading through some docs, blogs, ... I see that some people recommend 
hosting elastic search on a different physical node to Graylog2 (some 
recommend 3 separate physical ES servers). I would like to know some of the 
opinions around here of people with similar situations.

Thanks for any tips you an share with me ;)

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/1346145a-467a-4131-8867-666c5aa3e656%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Reply via email to