Trying to figure out why logstash changed to active (exited)

[rferebee]

Currently, we have set:

Optimize Indexes older than (0)
Close indexes older than (22)
Delete indexes older than (22)

Other than that, searching is going to rely on 2 things:
CPU power
and how fast you can get the data to the CPU

Ok, so upping the core count on each node might help this issue. I'm planning to upgrade from 6 cores to 12 cores for each node next week.

Here's what the ulimit -a command looks like on all three nodes (+/- a few thousand for max user processes):

Code: Select all

root@nagioslscc2:/root> ulimit -a
core file size          (blocks, -c) 0
data seg size           (kbytes, -d) unlimited
scheduling priority             (-e) 0
file size               (blocks, -f) unlimited
pending signals                 (-i) 256933
max locked memory       (kbytes, -l) 64
max memory size         (kbytes, -m) unlimited
open files                      (-n) 1024
pipe size            (512 bytes, -p) 8
POSIX message queues     (bytes, -q) 819200
real-time priority              (-r) 0
stack size              (kbytes, -s) 8192
cpu time               (seconds, -t) unlimited
max user processes              (-u) 256933
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited

Our log repository is stored on a separate storage drive, but that is only used for snapshots and old index data. Everything within the 22 day index limit is stored locally on each node.

[mbellerue]

Okay, then I think the next best bet is to see if the bump from 6 to 12 cores helps the performance, and go from there.

[rferebee]

This resource upgrade will be performed this Saturday. I will update you afterward. Thank you.

[mbellerue]

Perfect. We will keep this thread open and wait to hear back.

[rferebee]

I performed the resource upgrade on 12/21. So far so good.

I think we can lock this thread for now and if I run into anything new I'll create a new support request. Thank you.

[scottwilkerson]

I performed the resource upgrade on 12/21. So far so good.

I think we can lock this thread for now and if I run into anything new I'll create a new support request. Thank you.

Great!

Locking thread