Well,不要刷屏了

网卡流量过大 packetbeat 频繁重启

Beats | 作者 wl30564 | 发布于2017年10月23日 | 阅读数:4114

packetbeat 的报错信息
 [root@xdl-10-7 ~]# tail -f /var/log/messages
Oct 23 17:04:02 xdl-10-7 packetbeat: panic: Too many events acked (expected=150, total=3771)
Oct 23 17:04:02 xdl-10-7 packetbeat: goroutine 89 [running]:
Oct 23 17:04:02 xdl-10-7 packetbeat: github.com/elastic/beats/libbeat/publisher/queue/memqueue.(*directEventLoop).processACK(0xc4212a34a0, 0xc42ff149c0, 0xc4293c8e80, 0x96)
Oct 23 17:04:02 xdl-10-7 packetbeat: /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/eventloop.go:262 +0x789
Oct 23 17:04:02 xdl-10-7 packetbeat: go.(interface { memqueue.processACK(github.com/elastic/beats/libbeat/publisher/queue/memqueue.chanList, int); memqueue.run() }).(github.com/elastic/beats/libbeat/publisher/queue/memqueue.processACK)-fm(0xc42ff149c0, 0xc4293c8e80, 0x96)
Oct 23 17:04:02 xdl-10-7 packetbeat: /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:134 +0x4d
Oct 23 17:04:02 xdl-10-7 packetbeat: github.com/elastic/beats/libbeat/publisher/queue/memqueue.(*ackLoop).handleBatchSig(0xc42139fe50, 0xc42161d980)
Oct 23 17:04:02 xdl-10-7 packetbeat: /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/ackloop.go:95 +0xae
Oct 23 17:04:02 xdl-10-7 packetbeat: github.com/elastic/beats/libbeat/publisher/queue/memqueue.(*ackLoop).run(0xc42139fe50)
Oct 23 17:04:02 xdl-10-7 packetbeat: /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/ackloop.go:61 +0x377
Oct 23 17:04:02 xdl-10-7 packetbeat: github.com/elastic/beats/libbeat/publisher/queue/memqueue.NewBroker.func2(0xc4214879d0, 0xc42139fe50)
Oct 23 17:04:02 xdl-10-7 packetbeat: /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:143 +0x57
Oct 23 17:04:02 xdl-10-7 packetbeat: created by github.com/elastic/beats/libbeat/publisher/queue/memqueue.NewBroker
Oct 23 17:04:02 xdl-10-7 packetbeat: /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:144 +0x423
Oct 23 17:04:02 xdl-10-7 systemd: packetbeat.service: main process exited, code=exited, status=2/INVALIDARGUMENT
Oct 23 17:04:02 xdl-10-7 systemd: Unit packetbeat.service entered failed state.
Oct 23 17:04:02 xdl-10-7 systemd: packetbeat.service failed.
Oct 23 17:04:02 xdl-10-7 systemd: packetbeat.service holdoff time over, scheduling restart.
Oct 23 17:04:02 xdl-10-7 systemd: Started packetbeat.
Oct 23 17:04:02 xdl-10-7 systemd: Starting packetbeat...
 
 
网卡流量截图
 

在packetbeat配置文件中 指定了一个流量少的网卡  就没有重启报错.....
已邀请:

ggg

赞同来自:

你的配置文件能帖一下吗?
看错误提示已经到publish event了,你每秒生成多少条日志

medcl - 今晚打老虎。

赞同来自:

packetbeat 处理不过来了,用的af_packet模式么?流量这么大,可以试试pf_ring模式。
网卡的 buffer 调过么?还可以关闭ignore_outgoing,更多看这个文档:
https://www.elastic.co/guide/e ... .html 
 

要回复问题请先登录注册