High CPU usage periodically

Hi,
there are many topics about CPU load but I can't find an answer.
Our standalone Elasticsearch 7.12.0 node runs on a 16 GB RAM Linux server. Every 10 minutes or so elasticsearch consumes 100% CPU and queries are very slow..

I managed to get the return of the hot_threads command but I don't know how to analyze it, could you tell me what is causing this massive CPU usage and how I can solve this problem? The problem occurs whether or not there are people connected to the database.

GET _cat/nodes?v=true&s=cpu:desc
ip            heap.percent ram.percent cpu load_1m load_5m load_15m node.role   master name
XX.XX.XX.XX           55          97  17    2.90    4.47     5.80 cdfhilmrstw *      hostname.domain
GET _cat/health?v=true
epoch      timestamp cluster       stat
us node.total node.data shards  pri relo init unassign pending_tasks max_task_wait_time active_shards_percent
1695033705 10:41:45  elasticsearch green           1         1   2234 2234    0    0        0             0                  -                100.0%
GET _cluster/stats?pretty&human
{
  "_nodes" : {
    "total" : 1,
    "successful" : 1,
    "failed" : 0
  },
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "3K6hfBlWQXi-0uk-08urTw",
  "timestamp" : 1695033736725,
  "status" : "green",
  "indices" : {
    "count" : 2234,
    "shards" : {
      "total" : 2234,
      "primaries" : 2234,
      "replication" : 0.0,
      "index" : {
        "shards" : {
          "min" : 1,
          "max" : 1,
          "avg" : 1.0
        },
        "primaries" : {
          "min" : 1,
          "max" : 1,
          "avg" : 1.0
        },
        "replication" : {
          "min" : 0.0,
          "max" : 0.0,
          "avg" : 0.0
        }
      }
    },
    "docs" : {
      "count" : 126881864,
      "deleted" : 507968
    },
    "store" : {
      "size" : "68.2gb",
      "size_in_bytes" : 73271657370,
      "reserved" : "0b",
      "reserved_in_bytes" : 0
    },
    "fielddata" : {
      "memory_size" : "0b",
      "memory_size_in_bytes" : 0,
      "evictions" : 0
    },
    "query_cache" : {
      "memory_size" : "31.3mb",
      "memory_size_in_bytes" : 32873065,
      "total_count" : 390719,
      "hit_count" : 51632,
      "miss_count" : 339087,
      "cache_size" : 9507,
      "cache_count" : 11190,
      "evictions" : 1683
    },
    "completion" : {
      "size" : "0b",
      "size_in_bytes" : 0
    },
    "segments" : {
      "count" : 14260,
      "memory" : "123.7mb",
      "memory_in_bytes" : 129811504,
      "terms_memory" : "95.8mb",
      "terms_memory_in_bytes" : 100469888,
      "stored_fields_memory" : "6.7mb",
      "stored_fields_memory_in_bytes" : 7104672,
      "term_vectors_memory" : "0b",
      "term_vectors_memory_in_bytes" : 0,
      "norms_memory" : "11.6mb",
      "norms_memory_in_bytes" : 12171904,
      "points_memory" : "0b",
      "points_memory_in_bytes" : 0,
      "doc_values_memory" : "9.5mb",
      "doc_values_memory_in_bytes" : 10065040,
      "index_writer_memory" : "18.5mb",
      "index_writer_memory_in_bytes" : 19427824,
      "version_map_memory" : "140.5kb",
      "version_map_memory_in_bytes" : 143914,
      "fixed_bit_set" : "353.9kb",
      "fixed_bit_set_memory_in_bytes" : 362416,
      "max_unsafe_auto_id_timestamp" : 1695027241008,
      "file_sizes" : { }
    },
    "mappings" : {
      "field_types" : [
        {
          "name" : "binary",
          "count" : 1,
          "index_count" : 1
        },
        {
          "name" : "boolean",
          "count" : 7618,
          "index_count" : 2057
        },
        {
          "name" : "byte",
          "count" : 1,
          "index_count" : 1
        },
        {
          "name" : "date",
          "count" : 4536,
          "index_count" : 2226
        },
        {
          "name" : "date_nanos",
          "count" : 1,
          "index_count" : 1
        },
        {
          "name" : "date_range",
          "count" : 1,
          "index_count" : 1
        },
        {
          "name" : "double",
          "count" : 1,
          "index_count" : 1
        },
        {
          "name" : "double_range",
          "count" : 1,
          "index_count" : 1
        },
        {
          "name" : "float",
          "count" : 5662,
          "index_count" : 1608
        },
        {
          "name" : "float_range",
          "count" : 1,
          "index_count" : 1
        },
        {
          "name" : "geo_point",
          "count" : 1,
          "index_count" : 1
        },
        {
          "name" : "geo_shape",
          "count" : 1,
          "index_count" : 1
        },
        {
          "name" : "half_float",
          "count" : 9,
          "index_count" : 3
        },
        {
          "name" : "integer",
          "count" : 23,
          "index_count" : 2
        },
        {
          "name" : "integer_range",
          "count" : 1,
          "index_count" : 1
        },
        {
          "name" : "ip",
          "count" : 1,
          "index_count" : 1
        },
        {
          "name" : "ip_range",
          "count" : 1,
          "index_count" : 1
        },
        {
          "name" : "keyword",
          "count" : 32512,
          "index_count" : 2226
        },
        {
          "name" : "long",
          "count" : 27700,
          "index_count" : 2124
        },
        {
          "name" : "long_range",
          "count" : 1,
          "index_count" : 1
        },
        {
          "name" : "nested",
          "count" : 7,
          "index_count" : 5
        },
        {
          "name" : "object",
          "count" : 3002,
          "index_count" : 2206
        },
        {
          "name" : "shape",
          "count" : 1,
          "index_count" : 1
        },
        {
          "name" : "short",
          "count" : 1,
          "index_count" : 1
        },
        {
          "name" : "text",
          "count" : 32372,
          "index_count" : 2224
        }
      ]
    },
    "analysis" : {
      "char_filter_types" : [ ],
      "tokenizer_types" : [ ],
      "filter_types" : [ ],
      "analyzer_types" : [ ],
      "built_in_char_filters" : [ ],
      "built_in_tokenizers" : [ ],
      "built_in_filters" : [ ],
      "built_in_analyzers" : [ ]
    },
    "versions" : [
      {
        "version" : "7.12.0",
        "index_count" : 2234,
        "primary_shard_count" : 2234,
        "total_primary_size" : "68.2gb",
        "total_primary_bytes" : 73271657370
      }
    ]
  },
  "nodes" : {
    "count" : {
      "total" : 1,
      "coordinating_only" : 0,
      "data" : 1,
      "data_cold" : 1,
      "data_content" : 1,
      "data_frozen" : 1,
      "data_hot" : 1,
      "data_warm" : 1,
      "ingest" : 1,
      "master" : 1,
      "ml" : 1,
      "remote_cluster_client" : 1,
      "transform" : 1,
      "voting_only" : 0
    },
    "versions" : [
      "7.12.0"
    ],
    "os" : {
      "available_processors" : 4,
      "allocated_processors" : 4,
      "names" : [
        {
          "name" : "Linux",
          "count" : 1
        }
      ],
      "pretty_names" : [
        {
          "pretty_name" : "CentOS Linux 7 (Core)",
          "count" : 1
        }
      ],
      "architectures" : [
        {
          "arch" : "amd64",
          "count" : 1
        }
      ],
      "mem" : {
        "total" : "15.4gb",
        "total_in_bytes" : 16619679744,
        "free" : "355.2mb",
        "free_in_bytes" : 372465664,
        "used" : "15.1gb",
        "used_in_bytes" : 16247214080,
        "free_percent" : 2,
        "used_percent" : 98
      }
    },
    "process" : {
      "cpu" : {
        "percent" : 40
      },
      "open_file_descriptors" : {
        "min" : 19977,
        "max" : 19977,
        "avg" : 19977
      }
    },
    "jvm" : {
      "max_uptime" : "1.8h",
      "max_uptime_in_millis" : 6559319,
      "versions" : [
        {
          "version" : "15.0.1",
          "vm_name" : "OpenJDK 64-Bit Server VM",
          "vm_version" : "15.0.1+9",
          "vm_vendor" : "AdoptOpenJDK",
          "bundled_jdk" : true,
          "using_bundled_jdk" : true,
          "count" : 1
        }
      ],
      "mem" : {
        "heap_used" : "3.7gb",
        "heap_used_in_bytes" : 4008591864,
        "heap_max" : "8gb",
        "heap_max_in_bytes" : 8589934592
      },
      "threads" : 186
    },
    "fs" : {
      "total" : "89.9gb",
      "total_in_bytes" : 96610549760,
      "free" : "20.7gb",
      "free_in_bytes" : 22257397760,
      "available" : "20.7gb",
      "available_in_bytes" : 22257397760
    },
    "plugins" : [ ],
    "network_types" : {
      "transport_types" : {
        "security4" : 1
      },
      "http_types" : {
        "security4" : 1
      }
    },
    "discovery_types" : {
      "single-node" : 1
    },
    "packaging_types" : [
      {
        "flavor" : "default",
        "type" : "tar",
        "count" : 1
      }
    ],
    "ingest" : {
      "number_of_pipelines" : 1,
      "processor_stats" : {
        "gsub" : {
          "count" : 0,
          "failed" : 0,
          "current" : 0,
          "time" : "0s",
          "time_in_millis" : 0
        },
        "script" : {
          "count" : 0,
          "failed" : 0,
          "current" : 0,
          "time" : "0s",
          "time_in_millis" : 0
        }
      }
    }
  }
}
GET _nodes/hot_threads?pretty&human
::: {hostname.domain}{zlApshC6TROjZLKxlE3FAw}{30yJimmZSzaM-RvSwm3jJA}{XX.XX.XX.XX}{XX.XX.XX.XX:9300}{cdfhilmrstw}{ml.machine_memory=16619679744, xpack.installed=true, transform.node=true, ml.max_open_jobs=20, ml.max_jvm_size=8589934592}
   Hot threads at 2023-09-18T09:24:48.941Z, interval=500ms, busiestThreads=3, ignoreIdleThreads=true:
   
   100.7% (503.2ms out of 500ms) cpu usage by thread 'elasticsearch[hostname.domain][transport_worker][T#1]'
     7/10 snapshots sharing following 362 elements
       org.elasticsearch.xpack.core.security.authz.permission.Role.authorize(Role.java:174)
       org.elasticsearch.xpack.security.authz.RBACEngine.buildIndicesAccessControl(RBACEngine.java:555)
       org.elasticsearch.xpack.security.authz.RBACEngine.lambda$authorizeIndexAction$4(RBACEngine.java:336)
       org.elasticsearch.xpack.security.authz.RBACEngine$$Lambda$5863/0x000000080186f568.accept(Unknown Source)
       app//org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:117)
       org.elasticsearch.xpack.security.authz.AuthorizationService$CachingAsyncSupplier.lambda$getAsync$0(AuthorizationService.java:722)
       org.elasticsearch.xpack.security.authz.AuthorizationService$CachingAsyncSupplier$$Lambda$5865/0x000000080186f9c8.accept(Unknown Source)
       app//org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:117)
       org.elasticsearch.xpack.security.authz.AuthorizationService.resolveIndexNames(AuthorizationService.java:599)
       org.elasticsearch.xpack.security.authz.AuthorizationService.lambda$authorizeAction$6(AuthorizationService.java:290)
       org.elasticsearch.xpack.security.authz.AuthorizationService$$Lambda$5867/0x0000000801970040.accept(Unknown Source)
       app//org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:117)
       org.elasticsearch.xpack.security.authz.AuthorizationService$CachingAsyncSupplier.lambda$getAsync$0(AuthorizationService.java:722)
       org.elasticsearch.xpack.security.authz.AuthorizationService$CachingAsyncSupplier$$Lambda$5865/0x000000080186f9c8.accept(Unknown Source)
       app//org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:117)
       org.elasticsearch.xpack.security.authz.RBACEngine.loadAuthorizedIndices(RBACEngine.java:367)
       org.elasticsearch.xpack.security.authz.AuthorizationService.lambda$authorizeAction$5(AuthorizationService.java:286)
       org.elasticsearch.xpack.security.authz.AuthorizationService$$Lambda$5857/0x000000080186e5f0.getAsync(Unknown Source)
       org.elasticsearch.xpack.security.authz.AuthorizationService$CachingAsyncSupplier.getAsync(AuthorizationService.java:720)
       org.elasticsearch.xpack.security.authz.AuthorizationService.lambda$authorizeAction$8(AuthorizationService.java:289)
       org.elasticsearch.xpack.security.authz.AuthorizationService$$Lambda$5858/0x000000080186e818.getAsync(Unknown Source)
       org.elasticsearch.xpack.security.authz.AuthorizationService$CachingAsyncSupplier.getAsync(AuthorizationService.java:720)
       org.elasticsearch.xpack.security.authz.RBACEngine.lambda$authorizeIndexAction$5(RBACEngine.java:328)
       org.elasticsearch.xpack.security.authz.RBACEngine$$Lambda$5861/0x000000080186f108.accept(Unknown Source)
       app//org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:117)
       org.elasticsearch.xpack.security.authz.RBACEngine.authorizeIndexActionName(RBACEngine.java:352)
       org.elasticsearch.xpack.security.authz.RBACEngine.authorizeIndexAction(RBACEngine.java:325)
       org.elasticsearch.xpack.security.authz.AuthorizationService.authorizeAction(AuthorizationService.java:300)
       org.elasticsearch.xpack.security.authz.AuthorizationService.maybeAuthorizeRunAs(AuthorizationService.java:265)
       org.elasticsearch.xpack.security.authz.AuthorizationService.lambda$authorize$1(AuthorizationService.java:229)
       org.elasticsearch.xpack.security.authz.AuthorizationService$$Lambda$5851/0x000000080186d8b0.accept(Unknown Source)
       app//org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:117)
       app//org.elasticsearch.action.support.ContextPreservingActionListener.onResponse(ContextPreservingActionListener.java:32)
       org.elasticsearch.xpack.security.authz.RBACEngine.lambda$resolveAuthorizationInfo$1(RBACEngine.java:127)
       org.elasticsearch.xpack.security.authz.RBACEngine$$Lambda$5853/0x000000080186dd10.accept(Unknown Source)
       app//org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:117)
       org.elasticsearch.xpack.security.authz.store.CompositeRolesStore.roles(CompositeRolesStore.java:161)
       org.elasticsearch.xpack.security.authz.store.CompositeRolesStore.getRoles(CompositeRolesStore.java:278)
       org.elasticsearch.xpack.security.authz.RBACEngine.getRoles(RBACEngine.java:133)
       org.elasticsearch.xpack.security.authz.RBACEngine.resolveAuthorizationInfo(RBACEngine.java:121)
       org.elasticsearch.xpack.security.authz.AuthorizationService.authorize(AuthorizationService.java:231)
       org.elasticsearch.xpack.security.transport.ServerTransportFilter$NodeProfile.lambda$inbound$1(ServerTransportFilter.java:130)
       org.elasticsearch.xpack.security.transport.ServerTransportFilter$NodeProfile$$Lambda$5319/0x0000000801715bb8.accept(Unknown Source)
       app//org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:117)
       org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$authenticateAsync$2(AuthenticationService.java:330)
       org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator$$Lambda$5321/0x0000000801716b98.accept(Unknown Source)
       org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lambda$lookForExistingAuthentication$6(AuthenticationService.java:391)
       org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator$$Lambda$5322/0x0000000801716dd0.run(Unknown Source)
       org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.lookForExistingAuthentication(AuthenticationService.java:402)
       org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.authenticateAsync(AuthenticationService.java:327)
       org.elasticsearch.xpack.security.authc.AuthenticationService$Authenticator.access$000(AuthenticationService.java:268)
       org.elasticsearch.xpack.security.authc.AuthenticationService.authenticate(AuthenticationService.java:178)
       org.elasticsearch.xpack.security.transport.ServerTransportFilter$NodeProfile.inbound(ServerTransportFilter.java:121)
       org.elasticsearch.xpack.security.transport.SecurityServerTransportInterceptor$ProfileSecuredRequestHandler.messageReceived(SecurityServerTransportInterceptor.java:322)
       app//org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:61)
       app//org.elasticsearch.transport.TransportService.sendLocalRequest(TransportService.java:908)
       app//org.elasticsearch.transport.TransportService.access$100(TransportService.java:68)
       app//org.elasticsearch.transport.TransportService$3.sendRequest(TransportService.java:140)
       app//org.elasticsearch.transport.TransportService.sendRequestInternal(TransportService.java:852)
       app//org.elasticsearch.transport.TransportService$$Lambda$3918/0x0000000801575668.sendRequest(Unknown Source)
       org.elasticsearch.xpack.security.transport.SecurityServerTransportInterceptor.sendWithUser(SecurityServerTransportInterceptor.java:164)
       org.elasticsearch.xpack.security.transport.SecurityServerTransportInterceptor.access$300(SecurityServerTransportInterceptor.java:55)
       org.elasticsearch.xpack.security.transport.SecurityServerTransportInterceptor$1.sendRequest(SecurityServerTransportInterceptor.java:131)
       app//org.elasticsearch.transport.TransportService.sendRequest(TransportService.java:766)
       app//org.elasticsearch.transport.TransportService.sendChildRequest(TransportService.java:817)
       app//org.elasticsearch.action.search.SearchTransportService.sendCanMatch(SearchTransportService.java:113)
       app//org.elasticsearch.action.search.CanMatchPreFilterSearchPhase.executePhaseOnShard(CanMatchPreFilterSearchPhase.java:81)
       app//org.elasticsearch.action.search.AbstractSearchAsyncAction.lambda$performPhaseOnShard$4(AbstractSearchAsyncAction.java:273)
       app//org.elasticsearch.action.search.AbstractSearchAsyncAction$$Lambda$6011/0x000000080198aab8.run(Unknown Source)
       app//org.elasticsearch.action.search.AbstractSearchAsyncAction.performPhaseOnShard(AbstractSearchAsyncAction.java:310)
       app//org.elasticsearch.action.search.CanMatchPreFilterSearchPhase.performPhaseOnShard(CanMatchPreFilterSearchPhase.java:132)
       app//org.elasticsearch.action.search.AbstractSearchAsyncAction.run(AbstractSearchAsyncAction.java:226)
       app//org.elasticsearch.action.search.AbstractSearchAsyncAction.executePhase(AbstractSearchAsyncAction.java:397)
       app//org.elasticsearch.action.search.AbstractSearchAsyncAction.start(AbstractSearchAsyncAction.java:184)
       app//org.elasticsearch.action.search.TransportSearchAction.executeSearch(TransportSearchAction.java:668)
       app//org.elasticsearch.action.search.TransportSearchAction.executeLocalSearch(TransportSearchAction.java:489)
       app//org.elasticsearch.action.search.TransportSearchAction.lambda$executeRequest$3(TransportSearchAction.java:283)
       app//org.elasticsearch.action.search.TransportSearchAction$$Lambda$5970/0x0000000801982168.accept(Unknown Source)
       app//org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:117)
       app//org.elasticsearch.index.query.Rewriteable.rewriteAndFetch(Rewriteable.java:103)
       app//org.elasticsearch.index.query.Rewriteable.rewriteAndFetch(Rewriteable.java:76)
       app//org.elasticsearch.action.search.TransportSearchAction.executeRequest(TransportSearchAction.java:324)
       app//org.elasticsearch.action.search.TransportSearchAction.doExecute(TransportSearchAction.java:212)
       app//org.elasticsearch.action.search.TransportSearchAction.doExecute(TransportSearchAction.java:91)
       app//org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:173)
       app//org.elasticsearch.action.support.ActionFilter$Simple.apply(ActionFilter.java:42)
       app//org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:171)
       org.elasticsearch.xpack.security.action.filter.SecurityActionFilter.lambda$applyInternal$3(SecurityActionFilter.java:161)
       org.elasticsearch.xpack.security.action.filter.SecurityActionFilter$$Lambda$5452/0x0000000801717690.accept(Unknown Source)
       app//org.elasticsearch.action.ActionListener$3.onResponse(ActionListener.java:167)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture$1.doRun(ListenableFuture.java:101)
       app//org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:26)
       app//org.elasticsearch.common.util.concurrent.EsExecutors$DirectExecutorService.execute(EsExecutors.java:215)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.notifyListener(ListenableFuture.java:95)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.lambda$done$0(ListenableFuture.java:87)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture$$Lambda$5433/0x0000000801805358.accept(Unknown Source)
       java.base@15.0.1/java.util.ArrayList.forEach(ArrayList.java:1511)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.done(ListenableFuture.java:87)
       app//org.elasticsearch.common.util.concurrent.BaseFuture.set(BaseFuture.java:133)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.onResponse(ListenableFuture.java:116)
       app//org.elasticsearch.action.StepListener.innerOnResponse(StepListener.java:53)
       app//org.elasticsearch.action.NotifyOnceListener.onResponse(NotifyOnceListener.java:29)
       org.elasticsearch.xpack.security.authz.interceptor.IndicesAliasesRequestInterceptor.intercept(IndicesAliasesRequestInterceptor.java:107)
       org.elasticsearch.xpack.security.authz.AuthorizationService.lambda$runRequestInterceptors$14(AuthorizationService.java:379)
       org.elasticsearch.xpack.security.authz.AuthorizationService$$Lambda$5873/0x00000008019704a0.accept(Unknown Source)
       app//org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:117)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture$1.doRun(ListenableFuture.java:101)
       app//org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:26)
       app//org.elasticsearch.common.util.concurrent.EsExecutors$DirectExecutorService.execute(EsExecutors.java:215)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.notifyListener(ListenableFuture.java:95)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.lambda$done$0(ListenableFuture.java:87)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture$$Lambda$5433/0x0000000801805358.accept(Unknown Source)
       java.base@15.0.1/java.util.ArrayList.forEach(ArrayList.java:1511)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.done(ListenableFuture.java:87)
       app//org.elasticsearch.common.util.concurrent.BaseFuture.set(BaseFuture.java:133)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.onResponse(ListenableFuture.java:116)
       app//org.elasticsearch.action.StepListener.innerOnResponse(StepListener.java:53)
       app//org.elasticsearch.action.NotifyOnceListener.onResponse(NotifyOnceListener.java:29)
       org.elasticsearch.xpack.security.authz.interceptor.ResizeRequestInterceptor.intercept(ResizeRequestInterceptor.java:87)
       org.elasticsearch.xpack.security.authz.AuthorizationService.lambda$runRequestInterceptors$14(AuthorizationService.java:379)
       org.elasticsearch.xpack.security.authz.AuthorizationService$$Lambda$5873/0x00000008019704a0.accept(Unknown Source)
       app//org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:117)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture$1.doRun(ListenableFuture.java:101)
       app//org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:26)
       app//org.elasticsearch.common.util.concurrent.EsExecutors$DirectExecutorService.execute(EsExecutors.java:215)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.notifyListener(ListenableFuture.java:95)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.lambda$done$0(ListenableFuture.java:87)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture$$Lambda$5433/0x0000000801805358.accept(Unknown Source)
       java.base@15.0.1/java.util.ArrayList.forEach(ArrayList.java:1511)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.done(ListenableFuture.java:87)
       app//org.elasticsearch.common.util.concurrent.BaseFuture.set(BaseFuture.java:133)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.onResponse(ListenableFuture.java:116)
       app//org.elasticsearch.action.StepListener.innerOnResponse(StepListener.java:53)
       app//org.elasticsearch.action.NotifyOnceListener.onResponse(NotifyOnceListener.java:29)
       org.elasticsearch.xpack.security.authz.interceptor.FieldAndDocumentLevelSecurityRequestInterceptor.intercept(FieldAndDocumentLevelSecurityRequestInterceptor.java:77)
       org.elasticsearch.xpack.security.authz.interceptor.UpdateRequestInterceptor.intercept(UpdateRequestInterceptor.java:24)
       org.elasticsearch.xpack.security.authz.AuthorizationService.lambda$runRequestInterceptors$14(AuthorizationService.java:379)
       org.elasticsearch.xpack.security.authz.AuthorizationService$$Lambda$5873/0x00000008019704a0.accept(Unknown Source)
       app//org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:117)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture$1.doRun(ListenableFuture.java:101)
       app//org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:26)
       app//org.elasticsearch.common.util.concurrent.EsExecutors$DirectExecutorService.execute(EsExecutors.java:215)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.notifyListener(ListenableFuture.java:95)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.lambda$done$0(ListenableFuture.java:87)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture$$Lambda$5433/0x0000000801805358.accept(Unknown Source)
       java.base@15.0.1/java.util.ArrayList.forEach(ArrayList.java:1511)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.done(ListenableFuture.java:87)
       app//org.elasticsearch.common.util.concurrent.BaseFuture.set(BaseFuture.java:133)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.onResponse(ListenableFuture.java:116)
       app//org.elasticsearch.action.StepListener.innerOnResponse(StepListener.java:53)
       app//org.elasticsearch.action.NotifyOnceListener.onResponse(NotifyOnceListener.java:29)
       org.elasticsearch.xpack.security.authz.interceptor.BulkShardRequestInterceptor.intercept(BulkShardRequestInterceptor.java:77)
       org.elasticsearch.xpack.security.authz.AuthorizationService.lambda$runRequestInterceptors$14(AuthorizationService.java:379)
       org.elasticsearch.xpack.security.authz.AuthorizationService$$Lambda$5873/0x00000008019704a0.accept(Unknown Source)
       app//org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:117)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture$1.doRun(ListenableFuture.java:101)
       app//org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:26)
       app//org.elasticsearch.common.util.concurrent.EsExecutors$DirectExecutorService.execute(EsExecutors.java:215)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.notifyListener(ListenableFuture.java:95)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.lambda$done$0(ListenableFuture.java:87)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture$$Lambda$5433/0x0000000801805358.accept(Unknown Source)
       java.base@15.0.1/java.util.ArrayList.forEach(ArrayList.java:1511)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.done(ListenableFuture.java:87)
       app//org.elasticsearch.common.util.concurrent.BaseFuture.set(BaseFuture.java:133)
       app//org.elasticsearch.common.util.concurrent.ListenableFuture.onResponse(ListenableFuture.java:116)
       app//org.elasticsearch.action.StepListener.innerOnResponse(StepListener.java:53)
       app//org.elasticsearch.action.NotifyOnceListener.onResponse(NotifyOnceListener.java:29)
       org.elasticsearch.xpack.security.authz.interceptor.FieldAndDocumentLevelSecurityRequestInterceptor.intercept(FieldAndDocumentLevelSecurityRequestInterceptor.java:77)
       org.elasticsearch.xpack.security.authz.interceptor.SearchRequestInterceptor.intercept(SearchRequestInterceptor.java:22)
       org.elasticsearch.xpack.security.authz.AuthorizationService.runRequestInterceptors(AuthorizationService.java:385)
       org.elasticsearch.xpack.security.authz.AuthorizationService.handleIndexActionAuthorizationResult(AuthorizationService.java:362)
       org.elasticsearch.xpack.security.authz.AuthorizationService.lambda$authorizeAction$9(AuthorizationService.java:302)
       org.elasticsearch.xpack.security.authz.AuthorizationService$$Lambda$5859/0x000000080186ec98.accept(Unknown Source)
       org.elasticsearch.xpack.security.authz.AuthorizationService$AuthorizationResultListener.onResponse(AuthorizationService.java:684)
       org.elasticsearch.xpack.security.authz.AuthorizationService$AuthorizationResultListener.onResponse(AuthorizationService.java:659)
       app//org.elasticsearch.action.support.ContextPreservingActionListener.onResponse(ContextPreservingActionListener.java:32)
       org.elasticsearch.xpack.security.authz.RBACEngine.buildIndicesAccessControl(RBACEngine.java:556)
       org.elasticsearch.xpack.security.authz.RBACEngine.lambda$authorizeIndexAction$3(RBACEngine.java:320)
       org.elasticsearch.xpack.security.authz.RBACEngine$$Lambda$5962/0x0000000801979ac8.accept(Unknown Source)
       app//org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:117)
       org.elasticsearch.xpack.security.authz.AuthorizationService$CachingAsyncSupplier.lambda$getAsync$0(AuthorizationService.java:722)
       org.elasticsearch.xpack.security.authz.AuthorizationService$CachingAsyncSupplier$$Lambda$5865/0x000000080186f9c8.accept(Unknown Source)
       app//org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:117)

hot_threads output is truncated due to message character limit

Hi @xCeLfr

It all depends on your use case, but apparently it is an architectural problem, in which you only have a single node and there is no way to allocate replicas for query performance. It is important to take into account hardware configurations, including SSDs, to achieve good performance. Below is the link to the official documentation that goes into more detail:

Scalability and resilience: clusters, nodes, and shards | Elasticsearch Guide [8.10] | Elastic

Hi,

thanks for your answer, but the problem occurs every 15 minutes without anyone running any queries, it seems like an internal routine. Can we identify what Elastic does when CPU reaches 100%?

There are some issues here that can impact the performance in your cluster.

The first one is that your cluster is oversharded, you have too many shards and should find some way to heavily decrease the number of shards in your cluster, or add more nodes.

You have just one node with 8 GB of Heap and you are using version 7.X, on this version the recommendation is to aim to have fewer than 20 shards per GB of Heap, so with 8 GB of Heap you should aim to have fewer than 160 shards, you have almost 15x this number.

Also, another recommendation is to keep the shard size between 10 GB and 50 GB, but you have too many small shards.

The total size used in your cluster is something around 70 GB and considering that you have 2234 shards, this would mean an average shard size of just 32 MB.

You seem to be using self-monitoring in your cluster, this is another thing that can impact the performance because it can produce a lot of shards and a lot of I/O, which can impact in ther performance as well.

Basically your server does not have enough resources anymore, one indication of this is that you have a 4 core machine and your 15min load is higher than the number of cores.

What are you indexing? How are you creating your indices? What is your index and shard strategy? Can you share the response of GET _cat/shards?v?

You will need to rethink your index and shard strategy, I recommend that you check this part of the documentation for some guidance on how to do that.

1 Like

Thank you for this detailed response, we will apply the recommendations and significantly reduce the number of indexes
and see if the CPU load decreases.
Here is the result of "GET _cat/shards?v" without the index name and host name

0	p	STARTED	113196	105.9mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	12302	4.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2288100	1.5gb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2	53.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2	56.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	19	62.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1440	515.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3761	1.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8211	2.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	104867	89.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	13432	3.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2	34.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	583	387.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	75	56.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	24	77.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	11062	6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	126287	54.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5131	1.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3200	1.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7097	3.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	143302	71.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7750	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3837	1.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	719402	330.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	11980	5.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	17462	6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5	58.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1	19.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	715	427.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	834	413.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	692	253.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3861	1.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	15	73.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	55	200.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	410	240kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1346	561.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1	19.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5955	1.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1739193	341.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2	40.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	762	292.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5893	3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3	45kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8138	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1625	487.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	556	335.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7655	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2759	1.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1	19.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8597	3.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	12572	5.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8711	2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3727	1.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	98936	37.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	393	339.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8099	2.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	821	245.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1634	496.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1532	634.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1344	387.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1480	915.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	409	154.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	967974	436.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	410	210.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8527	3.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	16549	7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7774	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	186584	163.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3996	1.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4765	1.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	6890	2.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7903	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	240621	137.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	662	300.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7965	2.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7342	2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	722	272.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	90	307.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1455	456.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	107	119.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	12074	4.9mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	398	123.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	12198	4.9mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5691	2.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8246	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1	17.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1420	689.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	277359	157.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7862	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	833	644.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3265	962.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	115	110.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	26	31.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	606	470.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8158	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	11436	5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	14294	3.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	95	128kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7587	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3	48.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	16780	6.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	62212	30.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2095	1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7399	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4	153.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1492	476.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7774	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1379	386kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	58	147.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	10	166.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	22	55kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	973	675.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2354	999kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8448	2.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	846	737.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2959	875.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2579	944.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	6	111.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8018	2.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2103	677.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	124	232.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	636043	686.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	763	261.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	32836	14.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8398	2.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8624	4.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1256	593.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	940	421.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7111	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7754	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2647	878.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1447	465.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1488	434.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7278	2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1483	475.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	33884	16.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1475	744.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1352	381.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	646297	692.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	16	108.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4197	1.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8047	2.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3	43.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8887	2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	6293	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3635	1.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	16	80.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	255387	99.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	269	227.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	31048	9.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2876	1010.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	106	221.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3983	1018.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	30435	20.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	123	221.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3836	1.9mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3710	1.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4466	1.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	16	102.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	742	221.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	781	524kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	120009	110.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2190	973kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	14475	3.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	718	248.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	36853	14.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	132639	60.9mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	485	268.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7899	3.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	717	405kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	754	258.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5548	2.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5	49.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7711	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	185	325.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	140645	118.9mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4026	1.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7858	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	733	219kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1597	784.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	62	240.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2869	891.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	14	122.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	222682	104.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8096	3.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	102739	35.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5469	2.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7827	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8604	3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1488	429.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	35075	13.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	629	244.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7400	2.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	494	428.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1097	385.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7489	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	20428	9.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7898	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7870	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	24290	10.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	50991	37.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8955	3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2689	796.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4216	1.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	15741	5.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1376	611.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8148	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7010	2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1	17.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8208	3.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	699	330.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1513	484.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1	17.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1629	546.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	81	185.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	23287	12.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1	17.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1940	1013.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	10515	3.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	516299	226.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1344	388.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3990	1.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1283	402.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	739	316.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1602	818.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	101	139.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8872	2.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4427	1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	25528	9.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	61918	30.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8538	3.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	834	263.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1483	476.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	16075	6.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3289	3.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	36448	14.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8863	3.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	736	360.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	12256	5.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	137603	63.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	573	313.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2886	797.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	203787	94.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7872	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3527	1.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8801	2.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4780	1.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1268	480kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2	51.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	710	362.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1285	422.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	817	330.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	853	279.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	399	240.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	38229	15.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2777	1.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5212	1.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	301878	67.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8117	2.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7255	2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1448	479.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	26806	11.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1485	500.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	14115	6.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8691	3.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7956	2.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	13204	5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1325	547.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8160	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	0	208b	xx.xx.xx.xx	hostname.domain
0	p	STARTED	50991	38.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1476	757.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1491	700.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1441	499.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7938	2.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	820	341.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	222	211.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	6706	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8131	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1421	764.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3922	1.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1483	480.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2397312	438.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1	15.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1674	703.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	384	167.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8013	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	425	218.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	13215	3.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1666	881.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	14345	7.9mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8886	7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7580	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	124370	125.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4274	1.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	23757	13mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3595	1.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4424	1.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1696	549.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7935	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	406	268.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3	47kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	17363	6.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1453	635.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4211	1.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	73	252.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	10754	3.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	6987	1.9mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2977	1.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	20398	4.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7	166.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	36355	14.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	16	136.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	893	409.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	214047	119.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	736	292.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	15131	8.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2893	773.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	258	266.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	215601	89.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	276362	122.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	738	294kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	102461	35.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	90730	31.9mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4402	1.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	747	280.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	712	297kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	35206	22.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4	73.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2292838	1.4gb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1443	416.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	30	46.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	68038	48.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	50879	20.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1455	456.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	28	87.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	378	450kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	673	251.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1	40.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	13063	5.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2459	1.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	289	281.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4462	1.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2354	1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1505	972.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1973	968kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2115	746.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7638	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8072	2.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1537	752.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	493	373.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1482	467.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7298	2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	21003	9mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	17774	6.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1358	442.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8029	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	34	92.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	94305	95.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	166	123.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	312434	64.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7381	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4728	1.9mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1483	475.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	26571	9.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8159	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1331	826.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1372	611.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	700	255.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7951	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	717298	697.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	9195	3.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	14647	6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	12842	11.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	518254	237.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2621	1.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	668	268.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4452	1.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	20690	11.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3555	1.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	53	189.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1478	603.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	93365	46.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	432	199.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3770	1.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1	38.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1439	476.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1104	598.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3758	1.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8145	2.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	736	271.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2112	984.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1	19.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4013	1.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1183	619.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	820	341.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	22	54.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	26472	9.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1979	815.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3813	1.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3278	1.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	739	299.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8041	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	20758	11.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	13161	5.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	19974	9.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1352	383.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7219	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	685	289.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	846	413.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5009	2.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5668	3.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7717	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	13550	5.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	384	160.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7539	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2444	1.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	108467	75.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1840	537.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	137560	55.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2882	836.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5887	3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7596	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	682	332kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	103562	103.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2317847	457.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4204	1.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4033	1.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8213	3.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	560	155.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1482	455.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7404	2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7857	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1352	380.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3310	1.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5182	1.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1537	748.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8656	3.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1482	461.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	398	203.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	64121	31mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	48	156.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	16	88.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	835	588.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	102649	33.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	27383	11.9mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5904	3.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	6	107.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4311	1.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7658	3.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	39850	21.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3746	1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	312609	70.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4311	1.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1718	808.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8807	2.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1485	506.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2490	1.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4094	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	62	243.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1351	475.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4643	1.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1516	425.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1696	601.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	394	189.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	426	144.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4464	1.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	742	225.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	716	237.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2309	2.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7838	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	99140	81.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	58	150.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	649	376.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	733	227.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	258	194.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8554	2.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1456	443.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	720	287.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	96733	48.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	101311	35.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	19628	8.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2845	1.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	11984	5.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3703	1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8774	2.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	312336	70.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	740	208.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	110852	49mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8107	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3238	1.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	157860	148.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1351	476.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8767	2.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5922	1.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2355	1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1344	387.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	750	214.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7866	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4316	1.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	750	299kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2036	885.2kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	822	257.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1452	418.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	34	92kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	28749	11.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8538	2.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	247	178.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7774	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	94555	51.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2407	794.5kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	93804	40.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7118	2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	23	66.3kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1	40.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7853	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	102900	109.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	44928	17.9mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4070	1.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2117	661.9kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4394	1.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	3157	968.8kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7864	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2179	780.6kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	14934	5.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	26558	9.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7232	2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	10408	3.4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5911	2.6mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4309	1.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4444	2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	25414	9.8mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7647	2.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	2462	754.4kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7200	6.5mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	7750	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	630554	662.9mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	78	205.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	17302	6.7mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1941	1010kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	755050	355.3mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	271917	243mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8186	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1466	483.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	11897	4mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	18387	10mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1530	1.1mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	1414	492.1kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	100429	85mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	43875	18mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	8089	2.2mb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	5	53.7kb	xx.xx.xx.xx	hostname.domain
0	p	STARTED	4733	1.4mb	xx.xx.xx.xx	hostname.domain

(..)

output is truncated due to message character limit

While @grfneto and @leandrojmp make valid points (and to make another valid point, you're using a fairly ancient version and should upgrade ASAP), the fundamental question is this:

Answering this almost certainly involves looking at the full hot threads output. Unless it's just GC, in which case you'll want to look at the GC logs and a heap dump.

What kind of data are you indexing and how? You redacted the indices names, it makes pretty hard to guess what kind of data you have.

Are you using daily indices? Or are you using one index per host name?

@DavidTurner yes we will upgrade soon to 7.17 then 8.9.1, we are testing it at the moment.
how can I send you the files, they cannot be published here due to forum limitations.

@DavidTurner I can't share index names, but thanks, you already point the "too much indexes" problem, we will merge a lot of indexes maybe per month/year

Hello, just an update on our situation.
Simply upgrading from 7.12 to 7.17 fixed our CPU load issue. We have started merging our indexes so we have both merge and original indexes in the database and no CPU issues. So I come to the conclusion that this was a 7.12 issue. We plan to upgrade to 8.9.1 soon.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.