What JRE re you using?

from graylog2-server.

java version "1.7.0_09-icedtea"
OpenJDK Runtime Environment (rhel-2.3.8.0.el6_4-x86_64)
OpenJDK 64-Bit Server VM (build 23.7-b01, mixed mode)

I've the VM machine configured with FOUR processors and 4Gb of RAM which has the CentOS 6.4. And here are the java package details:

java-1.7.0-openjdk-1.7.0.9-2.3.8.0.el6_4.x86_64
java-1.7.0-openjdk-devel-1.7.0.9-2.3.8.0.el6_4.x86_64

Let me know if you need any more details.

Best,
SFK.

from graylog2-server.

Could you start the server in debug mode (´java -jar graylog2-server.jar --debug´) and post the output it generated while starting up?

I have seen similar behaviour with Java7 on another machine and suspect it being Netty.

from graylog2-server.

Okay. I'll run the server for a while and send you the debug logs.

Regards,
SFK.

from graylog2-server.

Lennart,

I've attached the debug logs as well as the CPU usage before/after graylog2 start.

Thanks,
SFK.

GRAYLOG2 DEBUG OUTPUT:

2013-04-23 01:00:11,749 INFO : org.graylog2.Main - Graylog2 0.11.0 starting up. (JRE: Oracle Corporation 1.7.0_09-icedtea on Linux 2.6.32-358.2.1.el6.x86_64)
2013-04-23 01:00:12,805 INFO : org.graylog2.buffers.ProcessBuffer - Initialized ProcessBuffer with ring size <1024> and wait strategy .
2013-04-23 01:00:12,847 INFO : org.graylog2.buffers.OutputBuffer - Initialized OutputBuffer with ring size <1024> and wait strategy .
2013-04-23 01:00:13,679 INFO : org.elasticsearch.node - [graylog2-server] {0.20.4}[11049]: initializing ...
2013-04-23 01:00:13,680 DEBUG: org.elasticsearch.node - [graylog2-server] using home [/home/graylog2/server-0.11.0], config [/home/graylog2/server-0.11.0/config], data [[/home/graylog2/server-0.11.0/data]], logs [/var/log/elasticsearch], work [/home/graylog2/server-0.11.0/work], plugins [/home/graylog2/server-0.11.0/plugins]
2013-04-23 01:00:13,703 INFO : org.elasticsearch.plugins - [graylog2-server] loaded [], sites []
2013-04-23 01:00:13,723 DEBUG: org.elasticsearch.common.compress.lzf - using [UnsafeChunkDecoder] decoder
2013-04-23 01:00:13,738 DEBUG: org.elasticsearch.common.compress - failed to load xerial snappy-java
java.lang.NoClassDefFoundError: org/xerial/snappy/Snappy
at org.elasticsearch.common.compress.snappy.xerial.XerialSnappy.(XerialSnappy.java:42)
at org.elasticsearch.common.compress.CompressorFactory.(CompressorFactory.java:58)
at org.elasticsearch.node.internal.InternalNode.(InternalNode.java:134)
at org.elasticsearch.node.NodeBuilder.build(NodeBuilder.java:159)
at org.elasticsearch.node.NodeBuilder.node(NodeBuilder.java:166)
at org.graylog2.indexer.EmbeddedElasticSearchClient.(EmbeddedElasticSearchClient.java:89)
at org.graylog2.Core.initialize(Core.java:172)
at org.graylog2.Main.main(Main.java:144)
Caused by: java.lang.ClassNotFoundException: org.xerial.snappy.Snappy
at java.net.URLClassLoader$1.run(URLClassLoader.java:366)
at java.net.URLClassLoader$1.run(URLClassLoader.java:355)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:354)
at java.lang.ClassLoader.loadClass(ClassLoader.java:423)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308)
at java.lang.ClassLoader.loadClass(ClassLoader.java:356)
... 8 more
2013-04-23 01:00:14,706 TRACE: org.elasticsearch.monitor.sigar - failed to load sigar
java.lang.ClassNotFoundException: org.hyperic.sigar.Sigar
at java.net.URLClassLoader$1.run(URLClassLoader.java:366)
at java.net.URLClassLoader$1.run(URLClassLoader.java:355)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:354)
at java.lang.ClassLoader.loadClass(ClassLoader.java:423)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308)
at java.lang.ClassLoader.loadClass(ClassLoader.java:356)
at org.elasticsearch.monitor.MonitorModule.configure(MonitorModule.java:80)
at org.elasticsearch.common.inject.AbstractModule.configure(AbstractModule.java:60)
at org.elasticsearch.common.inject.spi.Elements$RecordingBinder.install(Elements.java:201)
at org.elasticsearch.common.inject.spi.Elements.getElements(Elements.java:82)
at org.elasticsearch.common.inject.InjectorShell$Builder.build(InjectorShell.java:130)
at org.elasticsearch.common.inject.InjectorBuilder.build(InjectorBuilder.java:99)
at org.elasticsearch.common.inject.Guice.createInjector(Guice.java:93)
at org.elasticsearch.common.inject.Guice.createInjector(Guice.java:70)
at org.elasticsearch.common.inject.ModulesBuilder.createInjector(ModulesBuilder.java:59)
at org.elasticsearch.node.internal.InternalNode.(InternalNode.java:167)
at org.elasticsearch.node.NodeBuilder.build(NodeBuilder.java:159)
at org.elasticsearch.node.NodeBuilder.node(NodeBuilder.java:166)
at org.graylog2.indexer.EmbeddedElasticSearchClient.(EmbeddedElasticSearchClient.java:89)
at org.graylog2.Core.initialize(Core.java:172)
at org.graylog2.Main.main(Main.java:144)
2013-04-23 01:00:15,541 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [generic], type [cached], keep_alive [30s]
2013-04-23 01:00:15,546 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [index], type [cached], keep_alive [5m]
2013-04-23 01:00:15,546 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [bulk], type [cached], keep_alive [5m]
2013-04-23 01:00:15,546 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [get], type [cached], keep_alive [5m]
2013-04-23 01:00:15,546 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [search], type [cached], keep_alive [5m]
2013-04-23 01:00:15,546 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [percolate], type [cached], keep_alive [5m]
2013-04-23 01:00:15,547 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [management], type [scaling], min [1], size [5], keep_alive [5m]
2013-04-23 01:00:15,559 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [flush], type [scaling], min [1], size [10], keep_alive [5m]
2013-04-23 01:00:15,559 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [merge], type [scaling], min [1], size [20], keep_alive [5m]
2013-04-23 01:00:15,560 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [refresh], type [scaling], min [1], size [10], keep_alive [5m]
2013-04-23 01:00:15,560 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [cache], type [scaling], min [1], size [4], keep_alive [5m]
2013-04-23 01:00:15,560 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [snapshot], type [scaling], min [1], size [5], keep_alive [5m]
2013-04-23 01:00:15,582 DEBUG: org.elasticsearch.transport.netty - [graylog2-server] using worker_count[8], port[9300-9400], bind_host[null], publish_host[null], compress[false], connect_timeout[30s], connections_per_node[2/6/1], receive_predictor[512kb->512kb]
2013-04-23 01:00:15,592 DEBUG: org.elasticsearch.discovery.zen.ping.multicast - [graylog2-server] using group [224.2.2.4], with port [54328], ttl [3], and address [null]
2013-04-23 01:00:15,596 DEBUG: org.elasticsearch.discovery.zen.ping.unicast - [graylog2-server] using initial hosts [], with concurrent_connects [10]
2013-04-23 01:00:15,598 DEBUG: org.elasticsearch.discovery.zen - [graylog2-server] using ping.timeout [3s], master_election.filter_client [true], master_election.filter_data [false]
2013-04-23 01:00:15,598 DEBUG: org.elasticsearch.discovery.zen.elect - [graylog2-server] using minimum_master_nodes [-1]
2013-04-23 01:00:15,599 DEBUG: org.elasticsearch.discovery.zen.fd - [graylog2-server] [master] uses ping_interval [1s], ping_timeout [30s], ping_retries [3]
2013-04-23 01:00:15,603 DEBUG: org.elasticsearch.discovery.zen.fd - [graylog2-server] [node ] uses ping_interval [1s], ping_timeout [30s], ping_retries [3]
2013-04-23 01:00:15,709 DEBUG: org.elasticsearch.monitor.jvm - [graylog2-server] enabled [true], last_gc_enabled [false], interval [1s], gc_threshold [{default=GcThreshold{name='default', warnThreshold=10000, infoThreshold=5000, debugThreshold=2000}, ParNew=GcThreshold{name='ParNew', warnThreshold=1000, infoThreshold=700, debugThreshold=400}, ConcurrentMarkSweep=GcThreshold{name='ConcurrentMarkSweep', warnThreshold=10000, infoThreshold=5000, debugThreshold=2000}}]
2013-04-23 01:00:15,710 DEBUG: org.elasticsearch.monitor.os - [graylog2-server] Using probe [org.elasticsearch.monitor.os.JmxOsProbe@31acaf6c] with refresh_interval [1s]
2013-04-23 01:00:15,711 DEBUG: org.elasticsearch.monitor.process - [graylog2-server] Using probe [org.elasticsearch.monitor.process.JmxProcessProbe@2cfa0e14] with refresh_interval [1s]
2013-04-23 01:00:15,731 DEBUG: org.elasticsearch.monitor.jvm - [graylog2-server] Using refresh_interval [1s]
2013-04-23 01:00:15,731 DEBUG: org.elasticsearch.monitor.network - [graylog2-server] Using probe [org.elasticsearch.monitor.network.JmxNetworkProbe@8859e4] with refresh_interval [5s]
2013-04-23 01:00:15,733 DEBUG: org.elasticsearch.monitor.network - [graylog2-server] net_info
host [GA1GRLGC6T001.unifiedarts.com]
eth0 display_name [eth0]
address [/fe80:0:0:0:250:56ff:fe9f:2c%2] [/192.168.3.100]
mtu [1500] multicast [true] ptp [false] loopback [false] up [true] virtual [false]
lo display_name [lo]
address [/0:0:0:0:0:0:0:1%1] [/127.0.0.1]
mtu [16436] multicast [false] ptp [false] loopback [true] up [true] virtual [false]

2013-04-23 01:00:15,733 TRACE: org.elasticsearch.monitor.network - [graylog2-server] ifconfig

NA
2013-04-23 01:00:15,735 DEBUG: org.elasticsearch.monitor.fs - [graylog2-server] Using probe [org.elasticsearch.monitor.fs.JmxFsProbe@c1fb3d5] with refresh_interval [1s]
2013-04-23 01:00:16,152 DEBUG: org.elasticsearch.indices.store - [graylog2-server] using indices.store.throttle.type [none], with index.store.throttle.max_bytes_per_sec [0b]
2013-04-23 01:00:16,191 DEBUG: org.elasticsearch.cache.memory - [graylog2-server] using bytebuffer cache with small_buffer_size [1kb], large_buffer_size [1mb], small_cache_size [10mb], large_cache_size [500mb], direct [true]
2013-04-23 01:00:16,240 DEBUG: org.elasticsearch.script - [graylog2-server] using script cache with max_size [500], expire [null]
2013-04-23 01:00:16,272 DEBUG: org.elasticsearch.cluster.routing.allocation.decider - [graylog2-server] using node_concurrent_recoveries [2], node_initial_primaries_recoveries [4]
2013-04-23 01:00:16,273 DEBUG: org.elasticsearch.cluster.routing.allocation.decider - [graylog2-server] using [cluster.routing.allocation.allow_rebalance] with [indices_all_active]
2013-04-23 01:00:16,273 DEBUG: org.elasticsearch.cluster.routing.allocation.decider - [graylog2-server] using [cluster_concurrent_rebalance] with [2]
2013-04-23 01:00:16,276 DEBUG: org.elasticsearch.gateway.local - [graylog2-server] using initial_shards [quorum], list_timeout [30s]
2013-04-23 01:00:16,372 DEBUG: org.elasticsearch.indices.recovery - [graylog2-server] using max_size_per_sec[0b], concurrent_streams [3], file_chunk_size [512kb], translog_size [512kb], translog_ops [1000], and compress [true]
2013-04-23 01:00:16,438 DEBUG: org.elasticsearch.indices.memory - [graylog2-server] using index_buffer_size [85.3mb], with min_shard_index_buffer_size [4mb], max_shard_index_buffer_size [512mb], shard_inactive_time [30m]
2013-04-23 01:00:16,439 DEBUG: org.elasticsearch.indices.cache.filter - [graylog2-server] using [node] weighted filter cache with size [20%], actual_size [170.6mb], expire [null], clean_interval [1m]
2013-04-23 01:00:16,461 DEBUG: org.elasticsearch.gateway.local.state.meta - [graylog2-server] using gateway.local.auto_import_dangled [YES], with gateway.local.dangling_timeout [2h]
2013-04-23 01:00:16,469 DEBUG: org.elasticsearch.bulk.udp - [graylog2-server] using enabled [false], host [null], port [9700-9800], bulk_actions [1000], bulk_size [5mb], flush_interval [5s], concurrent_requests [4]
2013-04-23 01:00:16,472 INFO : org.elasticsearch.node - [graylog2-server] {0.20.4}[11049]: initialized
2013-04-23 01:00:16,472 INFO : org.elasticsearch.node - [graylog2-server] {0.20.4}[11049]: starting ...
2013-04-23 01:00:16,623 DEBUG: netty.channel.socket.nio.SelectorUtil - Using select timeout of 500
2013-04-23 01:00:16,623 DEBUG: netty.channel.socket.nio.SelectorUtil - Epoll-bug workaround enabled = false
2013-04-23 01:00:16,756 DEBUG: org.elasticsearch.transport.netty - [graylog2-server] Bound to address [/0:0:0:0:0:0:0:0:9301]
2013-04-23 01:00:16,761 INFO : org.elasticsearch.transport - [graylog2-server] bound_address {inet[/0:0:0:0:0:0:0:0:9301]}, publish_address {inet[/192.168.3.100:9301]}
2013-04-23 01:00:16,784 TRACE: org.elasticsearch.discovery - [graylog2-server] waiting for 30s for the initial state to be set by the discovery
2013-04-23 01:00:16,848 TRACE: org.elasticsearch.discovery.zen.ping.multicast - [graylog2-server] [1] sending ping request
2013-04-23 01:00:16,866 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0x71b83c92, /192.168.3.100:42495 => /192.168.3.100:9301]
2013-04-23 01:00:16,872 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0x0d031fed, /192.168.3.100:42496 => /192.168.3.100:9301]
2013-04-23 01:00:16,875 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0x9e033560, /192.168.3.100:42497 => /192.168.3.100:9301]
2013-04-23 01:00:16,876 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0xe17dc743, /192.168.3.100:42498 => /192.168.3.100:9301]
2013-04-23 01:00:16,877 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0xb60bd73d, /192.168.3.100:42499 => /192.168.3.100:9301]
2013-04-23 01:00:16,886 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0x5b22ca8d, /192.168.3.100:42500 => /192.168.3.100:9301]
2013-04-23 01:00:16,889 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0x275ecef6, /192.168.3.100:42501 => /192.168.3.100:9301]
2013-04-23 01:00:16,892 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0xf842e78a, /192.168.3.100:42502 => /192.168.3.100:9301]
2013-04-23 01:00:16,894 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0x8aefb115, /192.168.3.100:42503 => /192.168.3.100:9301]
2013-04-23 01:00:16,898 TRACE: org.elasticsearch.discovery.zen.ping.multicast - [graylog2-server] [1] received ping_response{target [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}], master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}], cluster_name[graylog2]}
2013-04-23 01:00:18,358 TRACE: org.elasticsearch.discovery.zen.ping.multicast - [graylog2-server] [1] sending ping request
2013-04-23 01:00:18,361 TRACE: org.elasticsearch.discovery.zen.ping.multicast - [graylog2-server] [1] received ping_response{target [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}], master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}], cluster_name[graylog2]}
2013-04-23 01:00:19,862 TRACE: org.elasticsearch.discovery.zen - [graylog2-server] full ping responses:
--> target [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}], master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}]
2013-04-23 01:00:19,862 DEBUG: org.elasticsearch.discovery.zen - [graylog2-server] filtered ping responses: (filter_client[true], filter_data[false])
--> target [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}], master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}]
2013-04-23 01:00:19,885 DEBUG: org.elasticsearch.transport.netty - [graylog2-server] connected to node [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}]
2013-04-23 01:00:20,074 DEBUG: org.elasticsearch.discovery.zen.fd - [graylog2-server] [master] starting fault detection against master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}], reason [initial_join]
2013-04-23 01:00:20,090 DEBUG: org.elasticsearch.cluster.service - [graylog2-server] processing [zen-disco-receive(from master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}])]: execute
2013-04-23 01:00:20,092 DEBUG: org.elasticsearch.cluster.service - [graylog2-server] got first state from fresh master [ST_l1pW-TViZL9CUA_ND9A]
2013-04-23 01:00:20,094 TRACE: org.elasticsearch.cluster.service - [graylog2-server] cluster state updated:
version [236], source [zen-disco-receive(from master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}])]
nodes:
[graylog2-server][2P2vZ1O0RfaiKLlrFDnZLg][inet[/192.168.3.100:9301]]{client=true, data=false, master=false}, local
[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}, master
routing_table:
-- index [graylog2_recent]
----shard_id [graylog2_recent][0]
--------[graylog2_recent][0], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
----shard_id [graylog2_recent][1]
--------[graylog2_recent][1], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
----shard_id [graylog2_recent][2]
--------[graylog2_recent][2], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
----shard_id [graylog2_recent][3]
--------[graylog2_recent][3], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]

-- index [graylog2_0]
----shard_id [graylog2_0][0]
--------[graylog2_0][0], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
----shard_id [graylog2_0][1]
--------[graylog2_0][1], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
----shard_id [graylog2_0][2]
--------[graylog2_0][2], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
----shard_id [graylog2_0][3]
--------[graylog2_0][3], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]

routing_nodes:
-----node_id[ST_l1pW-TViZL9CUA_ND9A][V]
--------[graylog2_recent][0], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
--------[graylog2_recent][1], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
--------[graylog2_recent][2], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
--------[graylog2_recent][3], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
--------[graylog2_0][0], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
--------[graylog2_0][1], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
--------[graylog2_0][2], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
--------[graylog2_0][3], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
---- unassigned

2013-04-23 01:00:20,096 INFO : org.elasticsearch.cluster.service - [graylog2-server] detected_master [GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}, added {[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true},}, reason: zen-disco-receive(from master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}])
2013-04-23 01:00:20,106 TRACE: org.elasticsearch.discovery - [graylog2-server] initial state set from discovery
2013-04-23 01:00:20,107 INFO : org.elasticsearch.discovery - [graylog2-server] graylog2/2P2vZ1O0RfaiKLlrFDnZLg
2013-04-23 01:00:20,107 DEBUG: org.elasticsearch.cluster.service - [graylog2-server] processing [zen-disco-receive(from master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}])]: done applying updated cluster_state
2013-04-23 01:00:20,107 INFO : org.elasticsearch.node - [graylog2-server] {0.20.4}[11049]: started
2013-04-23 01:00:20,144 INFO : org.graylog2.Main - Running in local mode
2013-04-23 01:00:20,271 INFO : org.graylog2.Core - Setting up deflector.
2013-04-23 01:00:20,278 INFO : org.graylog2.indexer.Deflector - Found deflector alias <graylog2_deflector>. Using it.
2013-04-23 01:00:20,281 INFO : org.graylog2.Core - Recent index exists. Not creating it.
2013-04-23 01:00:20,474 DEBUG: org.graylog2.Core - Initialized initializer: ServerValueWriterInitializer
2013-04-23 01:00:20,475 INFO : org.graylog2.initializers.DroolsInitializer - Not using rules
2013-04-23 01:00:20,475 DEBUG: org.graylog2.Core - Initialized initializer: DroolsInitializer
2013-04-23 01:00:20,476 DEBUG: org.graylog2.Core - Initialized initializer: HostCounterCacheWriterInitializer
2013-04-23 01:00:20,477 DEBUG: org.graylog2.Core - Initialized initializer: MessageCounterInitializer
2013-04-23 01:00:20,482 DEBUG: org.graylog2.Core - Initialized initializer: AlarmScannerInitializer
2013-04-23 01:00:20,484 DEBUG: org.graylog2.Core - Initialized initializer: DeflectorThreadsInitializer
2013-04-23 01:00:20,485 DEBUG: org.graylog2.Core - Initialized initializer: AnonymousInformationCollectorInitializer
2013-04-23 01:00:20,490 DEBUG: org.graylog2.Core - Initialized initializer: IndexRetentionInitializer
2013-04-23 01:00:20,495 DEBUG: org.graylog2.Core - Initialized initializer: AMQPSyncInitializer
2013-04-23 01:00:20,506 DEBUG: org.graylog2.Core - Initialized initializer: BufferWatermarkInitializer
2013-04-23 01:00:20,517 DEBUG: org.graylog2.indexer.EmbeddedElasticSearchClient - Number of indices (1) lower than limit (50). Not performing any retention actions.
2013-04-23 01:00:20,523 DEBUG: org.graylog2.periodical.DeflectorManagerThread - Number of messages in <graylog2_0> (9003397) is lower than the limit (104857600). Not doing anything.
2013-04-23 01:00:20,541 DEBUG: org.graylog2.Core - Initialized initializer: MasterCacheWorkersInitializer
2013-04-23 01:00:20,708 INFO : org.graylog2.inputs.gelf.GELFUDPInput - Started UDP GELF server on /192.168.3.100:12201
2013-04-23 01:00:20,708 DEBUG: org.graylog2.Core - Initialized input: GELF UDP
2013-04-23 01:00:20,727 INFO : org.graylog2.inputs.gelf.GELFTCPInput - Started TCP GELF server on /192.168.3.100:12201
2013-04-23 01:00:20,727 DEBUG: org.graylog2.Core - Initialized input: GELF TCP
2013-04-23 01:00:20,774 INFO : org.graylog2.inputs.amqp.AMQPConsumer - Setting up AMQP connection to messages:systemlogs:SYSLOG
2013-04-23 01:00:20,775 DEBUG: org.graylog2.Core - Initialized input: AMQP syslog/GELF
2013-04-23 01:00:20,775 INFO : org.graylog2.inputs.amqp.AMQPConsumer - Setting up AMQP connection to messages:gelflogs:GELF
2013-04-23 01:00:20,778 DEBUG: org.graylog2.Core - Initialized output: ElasticSearch Output
2013-04-23 01:00:20,780 INFO : org.graylog2.Core - Graylog2 up and running.
2013-04-23 01:00:21,076 INFO : org.graylog2.inputs.amqp.AMQPConsumer - Connected to broker messages:systemlogs:SYSLOG
2013-04-23 01:00:21,076 INFO : org.graylog2.inputs.amqp.AMQPConsumer - Connected to broker messages:gelflogs:GELF
2013-04-23 01:00:30,493 DEBUG: org.graylog2.periodical.AlarmScannerThread - No alertable streams found. Not doing anything more.
2013-04-23 01:01:20,489 DEBUG: org.graylog2.periodical.DeflectorManagerThread - Number of messages in <graylog2_0> (9003397) is lower than the limit (104857600). Not doing anything.

2013-04-23 01:01:30,483 DEBUG: org.graylog2.periodical.AlarmScannerThread - No alertable streams found. Not doing anything more.

from graylog2-server.

Lennart,

I've tried running graylog2-server using java-1.6 and could see the CPU above 50% on idle. Here is the CPU usage and the debug logs:

Graylog2 Debug logs:

2013-04-25 03:49:10,673 INFO : org.graylog2.Main - Graylog2 0.11.0 starting up. (JRE: Sun Microsystems Inc. 1.6.0_24 on Linux 2.6.32-358.2.1.el6.x86_64)
2013-04-25 03:49:10,815 INFO : org.graylog2.buffers.ProcessBuffer - Initialized ProcessBuffer with ring size <1024> and wait strategy .
2013-04-25 03:49:10,851 INFO : org.graylog2.buffers.OutputBuffer - Initialized OutputBuffer with ring size <1024> and wait strategy .
2013-04-25 03:49:11,073 INFO : org.elasticsearch.node - [graylog2-server] {0.20.4}[19210]: initializing ...
2013-04-25 03:49:11,074 DEBUG: org.elasticsearch.node - [graylog2-server] using home [/home/graylog2/server-0.11.0], config [/home/graylog2/server-0.11.0/config], data [[/home/graylog2/server-0.11.0/data]], logs [/var/log/elasticsearch], work [/home/graylog2/server-0.11.0/work], plugins [/home/graylog2/server-0.11.0/plugins]
2013-04-25 03:49:11,079 INFO : org.elasticsearch.plugins - [graylog2-server] loaded [], sites []
2013-04-25 03:49:11,088 DEBUG: org.elasticsearch.common.compress.lzf - using [UnsafeChunkDecoder] decoder
2013-04-25 03:49:11,089 DEBUG: org.elasticsearch.common.compress - failed to load xerial snappy-java
java.lang.NoClassDefFoundError: org/xerial/snappy/Snappy
at org.elasticsearch.common.compress.snappy.xerial.XerialSnappy.(XerialSnappy.java:42)
at org.elasticsearch.common.compress.CompressorFactory.(CompressorFactory.java:58)
at org.elasticsearch.node.internal.InternalNode.(InternalNode.java:134)
at org.elasticsearch.node.NodeBuilder.build(NodeBuilder.java:159)
at org.elasticsearch.node.NodeBuilder.node(NodeBuilder.java:166)
at org.graylog2.indexer.EmbeddedElasticSearchClient.(EmbeddedElasticSearchClient.java:89)
at org.graylog2.Core.initialize(Core.java:172)
at org.graylog2.Main.main(Main.java:144)
Caused by: java.lang.ClassNotFoundException: org.xerial.snappy.Snappy
at java.net.URLClassLoader$1.run(URLClassLoader.java:217)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:205)
at java.lang.ClassLoader.loadClass(ClassLoader.java:321)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:294)
at java.lang.ClassLoader.loadClass(ClassLoader.java:266)
... 8 more
2013-04-25 03:49:11,480 TRACE: org.elasticsearch.monitor.sigar - failed to load sigar
java.lang.ClassNotFoundException: org.hyperic.sigar.Sigar
at java.net.URLClassLoader$1.run(URLClassLoader.java:217)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:205)
at java.lang.ClassLoader.loadClass(ClassLoader.java:321)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:294)
at java.lang.ClassLoader.loadClass(ClassLoader.java:266)
at org.elasticsearch.monitor.MonitorModule.configure(MonitorModule.java:80)
at org.elasticsearch.common.inject.AbstractModule.configure(AbstractModule.java:60)
at org.elasticsearch.common.inject.spi.Elements$RecordingBinder.install(Elements.java:201)
at org.elasticsearch.common.inject.spi.Elements.getElements(Elements.java:82)
at org.elasticsearch.common.inject.InjectorShell$Builder.build(InjectorShell.java:130)
at org.elasticsearch.common.inject.InjectorBuilder.build(InjectorBuilder.java:99)
at org.elasticsearch.common.inject.Guice.createInjector(Guice.java:93)
at org.elasticsearch.common.inject.Guice.createInjector(Guice.java:70)
at org.elasticsearch.common.inject.ModulesBuilder.createInjector(ModulesBuilder.java:59)
at org.elasticsearch.node.internal.InternalNode.(InternalNode.java:167)
at org.elasticsearch.node.NodeBuilder.build(NodeBuilder.java:159)
at org.elasticsearch.node.NodeBuilder.node(NodeBuilder.java:166)
at org.graylog2.indexer.EmbeddedElasticSearchClient.(EmbeddedElasticSearchClient.java:89)
at org.graylog2.Core.initialize(Core.java:172)
at org.graylog2.Main.main(Main.java:144)
2013-04-25 03:49:11,931 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [generic], type [cached], keep_alive [30s]
2013-04-25 03:49:11,935 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [index], type [cached], keep_alive [5m]
2013-04-25 03:49:11,935 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [bulk], type [cached], keep_alive [5m]
2013-04-25 03:49:11,936 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [get], type [cached], keep_alive [5m]
2013-04-25 03:49:11,936 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [search], type [cached], keep_alive [5m]
2013-04-25 03:49:11,936 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [percolate], type [cached], keep_alive [5m]
2013-04-25 03:49:11,936 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [management], type [scaling], min [1], size [5], keep_alive [5m]
2013-04-25 03:49:11,939 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [flush], type [scaling], min [1], size [10], keep_alive [5m]
2013-04-25 03:49:11,940 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [merge], type [scaling], min [1], size [20], keep_alive [5m]
2013-04-25 03:49:11,940 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [refresh], type [scaling], min [1], size [10], keep_alive [5m]
2013-04-25 03:49:11,940 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [cache], type [scaling], min [1], size [4], keep_alive [5m]
2013-04-25 03:49:11,940 DEBUG: org.elasticsearch.threadpool - [graylog2-server] creating thread_pool [snapshot], type [scaling], min [1], size [5], keep_alive [5m]
2013-04-25 03:49:11,960 DEBUG: org.elasticsearch.transport.netty - [graylog2-server] using worker_count[8], port[9300-9400], bind_host[null], publish_host[null], compress[false], connect_timeout[30s], connections_per_node[2/6/1], receive_predictor[512kb->512kb]
2013-04-25 03:49:11,968 DEBUG: org.elasticsearch.discovery.zen.ping.multicast - [graylog2-server] using group [224.2.2.4], with port [54328], ttl [3], and address [null]
2013-04-25 03:49:11,971 DEBUG: org.elasticsearch.discovery.zen.ping.unicast - [graylog2-server] using initial hosts [], with concurrent_connects [10]
2013-04-25 03:49:11,972 DEBUG: org.elasticsearch.discovery.zen - [graylog2-server] using ping.timeout [3s], master_election.filter_client [true], master_election.filter_data [false]
2013-04-25 03:49:11,972 DEBUG: org.elasticsearch.discovery.zen.elect - [graylog2-server] using minimum_master_nodes [-1]
2013-04-25 03:49:11,973 DEBUG: org.elasticsearch.discovery.zen.fd - [graylog2-server] [master] uses ping_interval [1s], ping_timeout [30s], ping_retries [3]
2013-04-25 03:49:11,976 DEBUG: org.elasticsearch.discovery.zen.fd - [graylog2-server] [node ] uses ping_interval [1s], ping_timeout [30s], ping_retries [3]
2013-04-25 03:49:12,034 DEBUG: org.elasticsearch.monitor.jvm - [graylog2-server] enabled [true], last_gc_enabled [false], interval [1s], gc_threshold [{default=GcThreshold{name='default', warnThreshold=10000, infoThreshold=5000, debugThreshold=2000}, ParNew=GcThreshold{name='ParNew', warnThreshold=1000, infoThreshold=700, debugThreshold=400}, ConcurrentMarkSweep=GcThreshold{name='ConcurrentMarkSweep', warnThreshold=10000, infoThreshold=5000, debugThreshold=2000}}]
2013-04-25 03:49:12,036 DEBUG: org.elasticsearch.monitor.os - [graylog2-server] Using probe [org.elasticsearch.monitor.os.JmxOsProbe@1547a16f] with refresh_interval [1s]
2013-04-25 03:49:12,039 DEBUG: org.elasticsearch.monitor.process - [graylog2-server] Using probe [org.elasticsearch.monitor.process.JmxProcessProbe@409bad4f] with refresh_interval [1s]
2013-04-25 03:49:12,049 DEBUG: org.elasticsearch.monitor.jvm - [graylog2-server] Using refresh_interval [1s]
2013-04-25 03:49:12,050 DEBUG: org.elasticsearch.monitor.network - [graylog2-server] Using probe [org.elasticsearch.monitor.network.JmxNetworkProbe@35703484] with refresh_interval [5s]
2013-04-25 03:49:12,051 DEBUG: org.elasticsearch.monitor.network - [graylog2-server] net_info
host [GA1GRLGC6T001.unifiedarts.com]
eth0 display_name [eth0]
address [/fe80:0:0:0:250:56ff:fe9f:2c%2] [/192.168.3.100]
mtu [1500] multicast [true] ptp [false] loopback [false] up [true] virtual [false]
lo display_name [lo]
address [/0:0:0:0:0:0:0:1%1] [/127.0.0.1]
mtu [16436] multicast [false] ptp [false] loopback [true] up [true] virtual [false]

2013-04-25 03:49:12,052 TRACE: org.elasticsearch.monitor.network - [graylog2-server] ifconfig

NA
2013-04-25 03:49:12,052 DEBUG: org.elasticsearch.monitor.fs - [graylog2-server] Using probe [org.elasticsearch.monitor.fs.JmxFsProbe@74e51bda] with refresh_interval [1s]
2013-04-25 03:49:12,330 DEBUG: org.elasticsearch.indices.store - [graylog2-server] using indices.store.throttle.type [none], with index.store.throttle.max_bytes_per_sec [0b]
2013-04-25 03:49:12,335 DEBUG: org.elasticsearch.cache.memory - [graylog2-server] using bytebuffer cache with small_buffer_size [1kb], large_buffer_size [1mb], small_cache_size [10mb], large_cache_size [500mb], direct [true]
2013-04-25 03:49:12,343 DEBUG: org.elasticsearch.script - [graylog2-server] using script cache with max_size [500], expire [null]
2013-04-25 03:49:12,369 DEBUG: org.elasticsearch.cluster.routing.allocation.decider - [graylog2-server] using node_concurrent_recoveries [2], node_initial_primaries_recoveries [4]
2013-04-25 03:49:12,370 DEBUG: org.elasticsearch.cluster.routing.allocation.decider - [graylog2-server] using [cluster.routing.allocation.allow_rebalance] with [indices_all_active]
2013-04-25 03:49:12,370 DEBUG: org.elasticsearch.cluster.routing.allocation.decider - [graylog2-server] using [cluster_concurrent_rebalance] with [2]
2013-04-25 03:49:12,373 DEBUG: org.elasticsearch.gateway.local - [graylog2-server] using initial_shards [quorum], list_timeout [30s]
2013-04-25 03:49:12,459 DEBUG: org.elasticsearch.indices.recovery - [graylog2-server] using max_size_per_sec[0b], concurrent_streams [3], file_chunk_size [512kb], translog_size [512kb], translog_ops [1000], and compress [true]
2013-04-25 03:49:12,515 DEBUG: org.elasticsearch.indices.memory - [graylog2-server] using index_buffer_size [85.3mb], with min_shard_index_buffer_size [4mb], max_shard_index_buffer_size [512mb], shard_inactive_time [30m]
2013-04-25 03:49:12,516 DEBUG: org.elasticsearch.indices.cache.filter - [graylog2-server] using [node] weighted filter cache with size [20%], actual_size [170.6mb], expire [null], clean_interval [1m]
2013-04-25 03:49:12,524 DEBUG: org.elasticsearch.gateway.local.state.meta - [graylog2-server] using gateway.local.auto_import_dangled [YES], with gateway.local.dangling_timeout [2h]
2013-04-25 03:49:12,529 DEBUG: org.elasticsearch.bulk.udp - [graylog2-server] using enabled [false], host [null], port [9700-9800], bulk_actions [1000], bulk_size [5mb], flush_interval [5s], concurrent_requests [4]
2013-04-25 03:49:12,530 INFO : org.elasticsearch.node - [graylog2-server] {0.20.4}[19210]: initialized
2013-04-25 03:49:12,530 INFO : org.elasticsearch.node - [graylog2-server] {0.20.4}[19210]: starting ...
2013-04-25 03:49:12,560 DEBUG: netty.channel.socket.nio.SelectorUtil - Using select timeout of 500
2013-04-25 03:49:12,561 DEBUG: netty.channel.socket.nio.SelectorUtil - Epoll-bug workaround enabled = false
2013-04-25 03:49:12,635 DEBUG: org.elasticsearch.transport.netty - [graylog2-server] Bound to address [/0:0:0:0:0:0:0:0:9301]
2013-04-25 03:49:12,637 INFO : org.elasticsearch.transport - [graylog2-server] bound_address {inet[/0:0:0:0:0:0:0:0:9301]}, publish_address {inet[/192.168.3.100:9301]}
2013-04-25 03:49:12,670 TRACE: org.elasticsearch.discovery - [graylog2-server] waiting for 30s for the initial state to be set by the discovery
2013-04-25 03:49:12,692 TRACE: org.elasticsearch.discovery.zen.ping.multicast - [graylog2-server] [1] sending ping request
2013-04-25 03:49:12,704 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0xa665610d, /192.168.3.100:42636 => /192.168.3.100:9301]
2013-04-25 03:49:12,704 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0x5c47dcb1, /192.168.3.100:42637 => /192.168.3.100:9301]
2013-04-25 03:49:12,705 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0xe702e252, /192.168.3.100:42638 => /192.168.3.100:9301]
2013-04-25 03:49:12,705 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0x74745374, /192.168.3.100:42639 => /192.168.3.100:9301]
2013-04-25 03:49:12,706 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0x1925a1b8, /192.168.3.100:42640 => /192.168.3.100:9301]
2013-04-25 03:49:12,707 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0xffe74985, /192.168.3.100:42641 => /192.168.3.100:9301]
2013-04-25 03:49:12,707 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0x52219cad, /192.168.3.100:42642 => /192.168.3.100:9301]
2013-04-25 03:49:12,707 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0xb254c6fa, /192.168.3.100:42643 => /192.168.3.100:9301]
2013-04-25 03:49:12,708 TRACE: org.elasticsearch.transport.netty - [graylog2-server] channel opened: [id: 0xb023ffc8, /192.168.3.100:42644 => /192.168.3.100:9301]
2013-04-25 03:49:12,719 TRACE: org.elasticsearch.discovery.zen.ping.multicast - [graylog2-server] [1] received ping_response{target [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}], master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}], cluster_name[graylog2]}
2013-04-25 03:49:14,196 TRACE: org.elasticsearch.discovery.zen.ping.multicast - [graylog2-server] [1] sending ping request
2013-04-25 03:49:14,215 TRACE: org.elasticsearch.discovery.zen.ping.multicast - [graylog2-server] [1] received ping_response{target [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}], master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}], cluster_name[graylog2]}
2013-04-25 03:49:15,699 TRACE: org.elasticsearch.discovery.zen - [graylog2-server] full ping responses:
--> target [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}], master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}]
2013-04-25 03:49:15,699 DEBUG: org.elasticsearch.discovery.zen - [graylog2-server] filtered ping responses: (filter_client[true], filter_data[false])
--> target [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}], master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}]
2013-04-25 03:49:15,726 DEBUG: org.elasticsearch.transport.netty - [graylog2-server] connected to node [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}]
2013-04-25 03:49:15,798 DEBUG: org.elasticsearch.discovery.zen.fd - [graylog2-server] [master] starting fault detection against master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}], reason [initial_join]
2013-04-25 03:49:15,806 DEBUG: org.elasticsearch.cluster.service - [graylog2-server] processing [zen-disco-receive(from master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}])]: execute
2013-04-25 03:49:15,808 DEBUG: org.elasticsearch.cluster.service - [graylog2-server] got first state from fresh master [ST_l1pW-TViZL9CUA_ND9A]
2013-04-25 03:49:15,812 TRACE: org.elasticsearch.cluster.service - [graylog2-server] cluster state updated:
version [240], source [zen-disco-receive(from master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}])]
nodes:
[graylog2-server][aBPOqhdpR_ehPBelIjComQ][inet[/192.168.3.100:9301]]{client=true, data=false, master=false}, local
[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}, master
routing_table:
-- index [graylog2_recent]
----shard_id [graylog2_recent][0]
--------[graylog2_recent][0], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
----shard_id [graylog2_recent][1]
--------[graylog2_recent][1], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
----shard_id [graylog2_recent][2]
--------[graylog2_recent][2], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
----shard_id [graylog2_recent][3]
--------[graylog2_recent][3], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]

-- index [graylog2_0]
----shard_id [graylog2_0][0]
--------[graylog2_0][0], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
----shard_id [graylog2_0][1]
--------[graylog2_0][1], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
----shard_id [graylog2_0][2]
--------[graylog2_0][2], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
----shard_id [graylog2_0][3]
--------[graylog2_0][3], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]

routing_nodes:
-----node_id[ST_l1pW-TViZL9CUA_ND9A][V]
--------[graylog2_recent][0], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
--------[graylog2_recent][1], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
--------[graylog2_recent][2], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
--------[graylog2_recent][3], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
--------[graylog2_0][0], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
--------[graylog2_0][1], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
--------[graylog2_0][2], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
--------[graylog2_0][3], node[ST_l1pW-TViZL9CUA_ND9A], [P], s[STARTED]
---- unassigned

2013-04-25 03:49:15,813 INFO : org.elasticsearch.cluster.service - [graylog2-server] detected_master [GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}, added {[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true},}, reason: zen-disco-receive(from master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}])
2013-04-25 03:49:15,824 DEBUG: org.elasticsearch.cluster.service - [graylog2-server] processing [zen-disco-receive(from master [[GA1GRLGC6T001][ST_l1pW-TViZL9CUA_ND9A][inet[/192.168.3.100:9300]]{master=true}])]: done applying updated cluster_state
2013-04-25 03:49:15,824 TRACE: org.elasticsearch.discovery - [graylog2-server] initial state set from discovery
2013-04-25 03:49:15,824 INFO : org.elasticsearch.discovery - [graylog2-server] graylog2/aBPOqhdpR_ehPBelIjComQ
2013-04-25 03:49:15,825 INFO : org.elasticsearch.node - [graylog2-server] {0.20.4}[19210]: started
2013-04-25 03:49:15,852 INFO : org.graylog2.Main - Running in local mode
2013-04-25 03:49:15,933 INFO : org.graylog2.Core - Setting up deflector.
2013-04-25 03:49:15,939 INFO : org.graylog2.indexer.Deflector - Found deflector alias <graylog2_deflector>. Using it.
2013-04-25 03:49:15,943 INFO : org.graylog2.Core - Recent index exists. Not creating it.
2013-04-25 03:49:15,964 DEBUG: org.graylog2.Core - Initialized initializer: ServerValueWriterInitializer
2013-04-25 03:49:15,964 INFO : org.graylog2.initializers.DroolsInitializer - Not using rules
2013-04-25 03:49:15,964 DEBUG: org.graylog2.Core - Initialized initializer: DroolsInitializer
2013-04-25 03:49:15,968 DEBUG: org.graylog2.Core - Initialized initializer: HostCounterCacheWriterInitializer
2013-04-25 03:49:15,969 DEBUG: org.graylog2.Core - Initialized initializer: MessageCounterInitializer
2013-04-25 03:49:15,971 DEBUG: org.graylog2.Core - Initialized initializer: AlarmScannerInitializer
2013-04-25 03:49:15,975 DEBUG: org.graylog2.Core - Initialized initializer: DeflectorThreadsInitializer
2013-04-25 03:49:15,977 DEBUG: org.graylog2.Core - Initialized initializer: AnonymousInformationCollectorInitializer
2013-04-25 03:49:15,988 DEBUG: org.graylog2.Core - Initialized initializer: IndexRetentionInitializer
2013-04-25 03:49:15,992 DEBUG: org.graylog2.indexer.EmbeddedElasticSearchClient - Number of indices (1) lower than limit (50). Not performing any retention actions.
2013-04-25 03:49:15,999 DEBUG: org.graylog2.Core - Initialized initializer: AMQPSyncInitializer
2013-04-25 03:49:16,005 DEBUG: org.graylog2.periodical.DeflectorManagerThread - Number of messages in <graylog2_0> (9003397) is lower than the limit (104857600). Not doing anything.
2013-04-25 03:49:16,006 DEBUG: org.graylog2.Core - Initialized initializer: BufferWatermarkInitializer
2013-04-25 03:49:16,012 DEBUG: org.graylog2.Core - Initialized initializer: MasterCacheWorkersInitializer
2013-04-25 03:49:16,088 INFO : org.graylog2.inputs.gelf.GELFUDPInput - Started UDP GELF server on /192.168.3.100:12201
2013-04-25 03:49:16,088 DEBUG: org.graylog2.Core - Initialized input: GELF UDP
2013-04-25 03:49:16,105 INFO : org.graylog2.inputs.gelf.GELFTCPInput - Started TCP GELF server on /192.168.3.100:12201
2013-04-25 03:49:16,105 DEBUG: org.graylog2.Core - Initialized input: GELF TCP
2013-04-25 03:49:16,115 INFO : org.graylog2.inputs.amqp.AMQPConsumer - Setting up AMQP connection to messages:systemlogs:SYSLOG
2013-04-25 03:49:16,116 DEBUG: org.graylog2.Core - Initialized input: AMQP syslog/GELF
2013-04-25 03:49:16,116 INFO : org.graylog2.inputs.amqp.AMQPConsumer - Setting up AMQP connection to messages:gelflogs:GELF
2013-04-25 03:49:16,122 DEBUG: org.graylog2.Core - Initialized output: ElasticSearch Output
2013-04-25 03:49:16,123 INFO : org.graylog2.Core - Graylog2 up and running.
2013-04-25 03:49:16,217 INFO : org.graylog2.inputs.amqp.AMQPConsumer - Connected to broker messages:gelflogs:GELF
2013-04-25 03:49:16,217 INFO : org.graylog2.inputs.amqp.AMQPConsumer - Connected to broker messages:systemlogs:SYSLOG
2013-04-25 03:49:25,982 DEBUG: org.graylog2.periodical.AlarmScannerThread - No alertable streams found. Not doing anything more.
2013-04-25 03:50:15,982 DEBUG: org.graylog2.periodical.DeflectorManagerThread - Number of messages in <graylog2_0> (9003397) is lower than the limit (104857600). Not doing anything.
2013-04-25 03:50:25,972 DEBUG: org.graylog2.periodical.AlarmScannerThread - No alertable streams found. Not doing anything more.

from graylog2-server.

Hi Lennart,

Do you need any thing else on this? Please let me know.

Thanks,
SFK.

from graylog2-server.

Testing with JDK7 on my machine now.

from graylog2-server.

Seby, thanks for reporting this. I was indeed able to reproduce a higher CPU usage with JDK7 on OSX.

I upgraded Netty and Disruptor to recent versions in a4efb53 and saw a CPU usage drop back to <1%. (cc @kroepke)

This will be released in version 0.12.0. RC version of this is released today or tomorrow.

Thank you.

from graylog2-server.

Hi Lennart,

Thanks for fixing this. I hope that the new build will be available soon.

Best regards,
Seby.

from graylog2-server.

It has been released just last night. ;)

http://blog.torch.sh/post/50936894790/new-graylog2-releases

from graylog2-server.

Okay. I've upgraded and so far, it looks good. I'll keep monitoring.

Thanks and regards,
SFK.

from graylog2-server.

Awesome. Went from consistent 14% cpu to <1%.
java version "1.7.0_13"
Java(TM) SE Runtime Environment (build 1.7.0_13-b20)
Java HotSpot(TM) 64-Bit Server VM (build 23.7-b01, mixed mode)

from graylog2-server.

Good to hear that! Thanks.

from graylog2-server.

Hi, I just installed graylog, but my CPU usage is 100%, I'm using java version "1.7.0_79" . when I start graylog-server or graylog-web, CPU gets crazy

from graylog2-server.

@mhipo1364 Please use our mailing list or our IRC channel #graylog on Freenode for general questions around Graylog.

from graylog2-server.