Graylog2 / Graylog2/graylog2-server
Graylog server stops writing logs to ES/disk
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Graylog server stops writing logs to Elasticsearch even though the clients are still pushing logs to the server.
## Expected Behavior
The Graylog server should not stop writing logs.
## Steps to Reproduce (for bugs)
There are no specific steps to reproduce the problem. We have a Graylog server setup on a 100 Gig AWS server and clients pushing logs to the server regularly. After a duration of 2 weeks, we are able to see that the logs being pushed is not written and unavailable in the search.
## Your Environment
Graylog Container setup on Docker.
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
1a860b306a91 graylog/graylog:3.2 "tini -- /docker-ent…" 3 months ago Up 25 hours (healthy) 0.0.0.0:514->514/tcp, 0.0.0.0:1514->1514/tcp, 0.0.0.0:5555->5555/tcp, 0.0.0.0:9000->9000/tcp, 0.0.0.0:12201->12201/tcp graylog
3310b24fb4b8 docker.elastic.co/elasticsearch/elasticsearch-oss:6.8.5 "/usr/local/bin/dock…" 3 months ago Up 3 months 9200/tcp, 9300/tcp elasticsearch
2b5b911e6366 mongo:3 "docker-entrypoint.s…" 3 months ago Up 3 months 27017/tcp mongo
* Graylog Version: 3.2
* Elasticsearch Version: 6.8.5
* MongoDB Version: 3
[server-issue-AWS-docker-logs.txt](https://github.com/Graylog2/graylog2-server/files/5073247/server-issue-AWS-docker-logs.txt)
Notes:
I am able to see the below ERROR logs in the attached file.
2020-06-28 21:34:44,196 ERROR: org.graylog2.shared.buffers.JournallingMessageHandler - Unable to write to journal - retrying with exponential back-off
kafka.common.KafkaStorageException: I/O exception in append to log 'messagejournal-0'
2020-06-28 21:34:59,049 ERROR: org.graylog2.shared.journal.KafkaJournal - Unable to flush checkpoint recovery point offsets. Will try again.
java.io.FileNotFoundException: /usr/share/graylog/data/journal/recovery-point-offset-checkpoint.tmp (Too many open files)
020-06-28 21:36:56,118 ERROR: org.graylog2.shared.journal.KafkaJournal - Cannot write /usr/share/graylog/data/journal/graylog2-committed-read-offset to disk.
java.io.FileNotFoundException: /usr/share/graylog/data/journal/graylog2-committed-read-offset (Too many open files)
Contributor guide
Assessment
This issue has not been assessed yet.