# Metricbeat on FreeBSD using a lot of resources **URL:** \ **Category:** Beats\ **Tags:** metricbeat\ **Created:** [July 13, 2016, 1:45pm UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412 "2016-07-13T13:45:28Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![michbsd](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Post date:** [July 13, 2016, 1:45pm UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/1 "2016-07-13T13:45:28Z")
Hi, I am running Metricbeat on FreeBSD. ❯ ./metricbeat -version [3:42:34 PM] metricbeat version 5.0.0-alpha4 (amd64), libbeat 5.0.0-alpha4 It seems to use a whole lot of resources for a simple monitoring tool: ```auto PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 12583 root 17 21 0 99776K 22784K uwait 6 40:20 41.26% metricbeat 785 root 1 52 0 61204K 6696K select 6 5:05 0.00% sshd 32240 root 1 20 0 25448K 4960K select 6 4:21 0.00% ntpd 27606 root 3 40 0 736M 714M uwait 1 3:33 0.00% redis-serv 27608 root 3 20 0 696M 672M uwait 5 3:17 0.00% redis-serv ``` Here's my conf: ❯ grep -v '^#' metricbeat.yml [3:44:15 PM] ```auto metricbeat.modules: - module: system metricsets: - cpu #- core - diskio - filesystem #- fsstat - memory - network - process enabled: true period: 10s processes: ['.*'] # if true, exports the CPU usage in ticks, together with the percentage values cpu_ticks: false - module: apache metricsets: ["status"] enabled: true period: 10s hosts: ["http://172.16.0.70"] - module: redis metricsets: ["info"] enabled: true period: 10s hosts: ["172.16.0.70:7000"] output.elasticsearch: hosts: ["172.16.0.0:9200"] template.name: "metricbeat" template.path: "metricbeat.template-es2x.json" template.overwrite: false ``` Any ideas? ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [July 13, 2016, 6:44pm UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/2 "2016-07-13T18:44:40Z")
Could you remove you filter for processes, as it seems to match all processes anyway? Comment out or remove the line `processes: ['.*']`. It could be that the regexp causes the CPU load. ---
**Author:** ![michbsd](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Post date:** [July 14, 2016, 2:39pm UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/3 "2016-07-14T14:39:59Z")
Will give it a try, and report back ---
**Author:** ![michbsd](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Post date:** [July 14, 2016, 2:55pm UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/4 "2016-07-14T14:55:39Z")
Still the same issue. I started the metricbeat process (with the new config) 4.39pm Please see attached graphs of the spike in load. ![](https://us1.discourse-cdn.com/elastic/original/2X/e/ed6bd66d9783122ef223630be2636f03db4efdd7.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/3/37f397299c9d416b11b45730295d74e0dacff6a8.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/9/9614f691e2aad88fe5059a36fd71e232544ea0a4.png) Any ideas? Thanks, Mike ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [July 18, 2016, 8:36am UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/5 "2016-07-18T08:36:48Z")
Could you try the nightly instead of alpha4? [https://beats-nightlies.s3.amazonaws.com/index.html?prefix=metricbeat/](https://beats-nightlies.s3.amazonaws.com/index.html?prefix=metricbeat/) it should not make a change but we recently had some changes in the Freebsd support in gosigar. Be aware that "official" FreeBSD is not supported yet, but we are trying to get it working: [https://github.com/elastic/beats/issues?utf8=✓&q=freebsd%20is%3Aissue%20is%3Aopen%20](https://github.com/elastic/beats/issues?utf8=%E2%9C%93&q=freebsd%20is%3Aissue%20is%3Aopen%20) Could you try to enable one metricset after the other to see which one causes the issue? @andrewkroh Perhaps you know more here? ---
**Author:** ![michbsd](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Post date:** [July 18, 2016, 10:33am UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/6 "2016-07-18T10:33:35Z")
I will give it a go, and report back. Is there a special branch to checkout from github for the nightly build ? (master?) ---
**Author:** ![michbsd](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Post date:** [July 18, 2016, 10:58am UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/7 "2016-07-18T10:58:37Z")
It seems to be the "process" metricset. When removing it from the configuration, CPU usage seems to be much more reasonable: ``` PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND 49691 root 10 20 0 55840K 18328K uwait 5 0:01 0.29% metricbeat 785 root 1 21 0 61204K 6696K select 6 5:06 0.00% sshd 32240 root 1 20 0 25448K 4960K select 6 4:25 0.00% ntpd 27606 root 3 40 0 736M 714M uwait 1 4:15 0.00% redis-serv 27608 root 3 20 0 696M 672M uwait 5 3:58 0.00% redis-serv 426 unbound 1 20 0 45296K 21168K select 1 2:15 0.00% unbound ``` Thanks, ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [July 18, 2016, 1:59pm UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/8 "2016-07-18T13:59:50Z")
There was another report of high CPU usage [here](https://discuss.elastic.co/t/metricbeat-cpu/54987). Maybe they are related. ---
**Author:** ![michbsd](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Post date:** [July 18, 2016, 2:48pm UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/9 "2016-07-18T14:48:38Z")
Hmm.. I see the CPU usage spike straight away. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [July 19, 2016, 7:13am UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/10 "2016-07-19T07:13:16Z")
Yes, best is to build your binaries off master. Sorry about the link to the nightlies as these are not available for freebsd yet. ---
**Author:** ![michbsd](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Post date:** [July 19, 2016, 7:37am UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/11 "2016-07-19T07:37:37Z")
Right. I am already running latest build ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [July 19, 2016, 7:43am UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/12 "2016-07-19T07:43:46Z")
Ok, that is great. Just as a quick summary. The minimal config that causes the issue on FreeBSD is: ```auto metricbeat.modules: - module: system metricsets: - process period: 10s ``` And the spike happens immediately after starting metricbeat. Correct? How many processes you you have? ---
**Author:** ![michbsd](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Post date:** [July 19, 2016, 8:27am UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/13 "2016-07-19T08:27:00Z")
Hi, Yes. Here is my current config: ❯ grep -v '^#' metricbeat.yml | cat -s [10:23:23 AM] ``` metricbeat.modules: - module: system metricsets: - process enabled: true period: 10s # if true, exports the CPU usage in ticks, together with the percentage values output.elasticsearch: hosts: ["172.16.0.140:9200"] template.name: "metricbeat" template.path: "metricbeat.template-es2x.json" template.overwrite: false ``` The spike happens immediately after launching the process (and remains). ``` ❯ ps -ax | wc -l [10:26:27 AM] 81 ``` ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [July 20, 2016, 8:59am UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/14 "2016-07-20T08:59:58Z")
Could you try to follow the debugging recommended by @andrewkroh here? [Metricbeat CPU](https://discuss.elastic.co/t/metricbeat-cpu/54987) ---
**Author:** ![michbsd](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Post date:** [July 20, 2016, 9:22am UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/15 "2016-07-20T09:22:12Z")
Please find the pprof file here: [https://dl.dropboxusercontent.com/u/42812/Temp/pprof.localhost%3A6060.samples.cpu.001.pb.gz](https://dl.dropboxusercontent.com/u/42812/Temp/pprof.localhost%3A6060.samples.cpu.001.pb.gz) ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [July 25, 2016, 6:26am UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/16 "2016-07-25T06:26:21Z")
@michbsd Thanks for sharing. We will have a look to see if it helps in the investigations. ---
**Author:** ![michbsd](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Post date:** [July 25, 2016, 9:21am UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/17 "2016-07-25T09:21:31Z")
Great thanks. Let me know if I can assist in any way Mike ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [August 2, 2016, 7:06am UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/18 "2016-08-02T07:06:30Z")
@michbsd There is not real progress here yet. There wasn't something very obvious yet in the data you provided. We once had a similar issue on OS X but couldn't reproduce it. The problem is that I currently don't have a FreeBSD machine at hand to test it. My assumption currently is that it is probably more a gosigar issue then metricbeat itself: [https://github.com/elastic/gosigar](https://github.com/elastic/gosigar) There were other FreeBSD challenges in the past. ---
**Author:** ![michbsd](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@michbsd](https://discuss.elastic.co/u/michbsd)\ **Post date:** [August 2, 2016, 12:31pm UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/19 "2016-08-02T12:31:04Z")
Hi @ruflin Thanks for the feedback. Do you suggest I open a ticket with gosigar? thanks, ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [August 2, 2016, 2:32pm UTC](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412/20 "2016-08-02T14:32:45Z")
@michbsd yeah, probably makes sense to open a issue in gosigar: [https://github.com/elastic/gosigar](https://github.com/elastic/gosigar) This also brings visibility to the other FreeBSD users. Make sure to link this discussion. [Next page](https://discuss.elastic.co/t/metricbeat-on-freebsd-using-a-lot-of-resources/55412.md?page=2)