Graylog2 / Graylog2/graylog2-server

Graylog server stops writing logs to ES/disk

Open
#8,798 4 comments 0 reactions 0 assignees View on GitHub
bug documentation triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Graylog server stops writing logs to Elasticsearch even though the clients are still pushing logs to the server.

## Expected Behavior
The Graylog server should not stop writing logs.

## Steps to Reproduce (for bugs)
There are no specific steps to reproduce the problem. We have a Graylog server setup on a 100 Gig AWS server and clients pushing logs to the server regularly. After a duration of 2 weeks, we are able to see that the logs being pushed is not written and unavailable in the search.

## Your Environment
Graylog Container setup on Docker.

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
1a860b306a91 graylog/graylog:3.2 "tini -- /docker-ent…" 3 months ago Up 25 hours (healthy) 0.0.0.0:514->514/tcp, 0.0.0.0:1514->1514/tcp, 0.0.0.0:5555->5555/tcp, 0.0.0.0:9000->9000/tcp, 0.0.0.0:12201->12201/tcp graylog
3310b24fb4b8 docker.elastic.co/elasticsearch/elasticsearch-oss:6.8.5 "/usr/local/bin/dock…" 3 months ago Up 3 months 9200/tcp, 9300/tcp elasticsearch
2b5b911e6366 mongo:3 "docker-entrypoint.s…" 3 months ago Up 3 months 27017/tcp mongo

* Graylog Version: 3.2
* Elasticsearch Version: 6.8.5
* MongoDB Version: 3

[server-issue-AWS-docker-logs.txt](https://github.com/Graylog2/graylog2-server/files/5073247/server-issue-AWS-docker-logs.txt)

Notes:

I am able to see the below ERROR logs in the attached file.
2020-06-28 21:34:44,196 ERROR: org.graylog2.shared.buffers.JournallingMessageHandler - Unable to write to journal - retrying with exponential back-off
kafka.common.KafkaStorageException: I/O exception in append to log 'messagejournal-0'

2020-06-28 21:34:59,049 ERROR: org.graylog2.shared.journal.KafkaJournal - Unable to flush checkpoint recovery point offsets. Will try again.
java.io.FileNotFoundException: /usr/share/graylog/data/journal/recovery-point-offset-checkpoint.tmp (Too many open files)

020-06-28 21:36:56,118 ERROR: org.graylog2.shared.journal.KafkaJournal - Cannot write /usr/share/graylog/data/journal/graylog2-committed-read-offset to disk.
java.io.FileNotFoundException: /usr/share/graylog/data/journal/graylog2-committed-read-offset (Too many open files)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.