Nagios Support Forum

Hi,

I deployed the Nagios Log Server yesterday. I got distracted and had to focus on another task, but when I came back to the VM, I could see that even without any actual usage (no syslog data being pointed at it and never even logged in to it), OOM Killer had started to kill processes (it chose java).







It's made be a bit shy of continuing to test it out. Is this "OK", or do I need to do something with my setup?

This VM will (hopefully) be replacing an existing SysLog server that doesn't get much love. The resources are minimal, as we're not exactly stressing it out with work.

Cheers,
--
ChrisP

How was this set up initially? We have a pre-made VM appliance, or it can be installed from our source installer.

Also, what version of NLS are you running?

It's made be a bit shy of continuing to test it out. Is this "OK", or do I need to do something with my setup?

Are you certain that system logs weren't being sent to the IP address of Nagios Log Server before you stood it up? Typically 4GB is enough RAM to get started - but you might need to move to 8GB just to be safe. Nagios Log Server is by nature very RAM-heavy, and needs some room to breathe/build up a cache. Give 8GB a shot and let me know if you still have problems - 8 should be enough to add many hosts to and likely complete your evaluation of the product.

After you add the memory, run the following commands on the CLI:
service elasticsearch restart
service logstash restart

Best,

Jesse

Thanks for your responses,

tmcdonald wrote:How was this set up initially? We have a pre-made VM appliance... what version of NLS are you running?

@tmcdonald, it's the VA I just deployed - latest version.

jolson wrote:Are you certain that system logs weren't being sent to the IP address of Nagios Log Server before you stood it up?

@jolson, positive. Our systems send to UDP:514 and to our old SysLog server - the NLS was on a dynamic IP after deployment and had not been logged in to, or even completely configured hia HTTP.

I have now given the NLS 8GB RAM, shut down the old SysLog server, configured NLS with the IP of the old SysLog server, tweaked our Cisco routers to log to UDP:5544 and the packet/port redirection on our routers, to redirect U:514 => U:5544 (can't be bothered reconfiguring every device - some which cannot be configured away from U:514 - especially when I can just massage a port-redirection).

The NLS is now looking like this: -
No wonder it ran out of 4GB RAM, with "Mem: 8193024k total, 5491352k used"

I can continue on with my investigation, though the usual distractions will likely keep me from proper eval.

Cheers,
--
ChrisP

Let us know if you have any further questions! I hope you like the product.