Packetbeat memory and cpu consumption when monitoring cassandra

Elastic Stack Beats
1

Hi,
I have problems when I try to monitor cassandra with packetbeat, the cpu usage is round about 99.9 % and memory usage is increasing up to 90% of the available memory.
The setup is the following:

There is a network with 3 nodes, on all of them is running filebeat, packetbeat and metricbeat and also cassandra on each of them. The OS is centos7. All the beats are sending their data to an logstash instance, running on a host outside of this subnet. This works pretty good as long i did not monitor cassandra (packetbeat needs round about 3 % cpu und 1-2 % of memory).

The problem of cpu and memory usage occurs, when on one of these machines a process is started, which inserts data to cassandra via localhost interface (127.0.0.1).

2 
#################### Packetbeat Configuration #########################

# This file is an example configuration file highlighting only the most common
# options. The packetbeat.full.yml file from the same directory contains all the
# supported options with more comments. You can use it as a reference.
#
# You can find the full configuration reference here:
# https://www.elastic.co/guide/en/beats/packetbeat/index.html

#============================== Network device ================================

# Select the network interface to sniff the data. On Linux, you can use the
# "any" keyword to sniff on all connected interfaces.
packetbeat.interfaces.device: any
packetbeat.interfaces.type: af_packet
packetbeat.interfaces.buffer_size_mb: 100
packetbeat.interfaces.ignore_outgoing: true
#================================== Flows =====================================

# Set `enabled: false` or comment out all options to disable flows reporting.
#packetbeat.flows:
  # Set network flow timeout. Flow is killed if no packet is received before being
  # timed out.
  #timeout: 30s

  # Configure reporting period. If set to -1, only killed flows will be reported
  #period: 10s

#========================== Transaction protocols =============================

packetbeat.protocols.icmp:
  # Enable ICMPv4 and ICMPv6 monitoring. Default: false
  enabled: true

packetbeat.protocols.amqp:
  # Configure the ports where to listen for AMQP traffic. You can disable
  # the AMQP protocol by commenting out the list of ports.
  #ports: [5672]

packetbeat.protocols.cassandra:
  ports: [9042]
  send_request_header: true
  send_response_header: true
  compressor: "snappy"
  ignored_ops: ["SUPPORTED","OPTIONS"]

packetbeat.protocols.dns:
  # Configure the ports where to listen for DNS traffic. You can disable
  # the DNS protocol by commenting out the list of ports.
  ports: [53]

  # include_authorities controls whether or not the dns.authorities field
  # (authority resource records) is added to messages.
  include_authorities: true

  # include_additionals controls whether or not the dns.additionals field
  # (additional resource records) is added to messages.
  include_additionals: true

packetbeat.protocols.http:
  # Configure the ports where to listen for HTTP traffic. You can disable
  # the HTTP protocol by commenting out the list of ports.
  ports: [80, 8080, 8000, 5000, 8002]

packetbeat.protocols.memcache:
  # Configure the ports where to listen for memcache traffic. You can disable
  # the Memcache protocol by commenting out the list of ports.
  ports: [11211]

packetbeat.protocols.mysql:
  # Configure the ports where to listen for MySQL traffic. You can disable
  # the MySQL protocol by commenting out the list of ports.
  #ports: [3306]

packetbeat.protocols.pgsql:
  # Configure the ports where to listen for Pgsql traffic. You can disable
  # the Pgsql protocol by commenting out the list of ports.
  #ports: [5432]

packetbeat.protocols.redis:
  # Configure the ports where to listen for Redis traffic. You can disable
  # the Redis protocol by commenting out the list of ports.
  #ports: [6379]

packetbeat.protocols.thrift:
  # Configure the ports where to listen for Thrift-RPC traffic. You can disable
  # the Thrift-RPC protocol by commenting out the list of ports.
  #ports: [9090]

packetbeat.protocols.mongodb:
  # Configure the ports where to listen for MongoDB traffic. You can disable
  # the MongoDB protocol by commenting out the list of ports.
  #ports: [27017]

packetbeat.protocols.nfs:
  # Configure the ports where to listen for NFS traffic. You can disable
  # the NFS protocol by commenting out the list of ports.
  #ports: [2049]

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["172.16.50.5:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  ssl.certificate_authorities: ["/etc/filebeat/logstash-forwarder.crt"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

#================================ Logging =====================================

# Sets log level. The default log level is info.
# Available log levels are: critical, error, warning, info, debug
logging.level: info

# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
#logging.selectors: ["*"]
logging.to_files: true
logging.files:
  # Configure the path where the logs are written. The default is the logs directory
  # under the home path (the binary location).
  path: /var/log/packetbeat

  # The name of the files where the logs are written to.
  name: packetbeat

  # Configure log file size limit. If limit is reached, log file will be
  # automatically rotated
  rotateeverybytes: 10485760 # = 10MB

  # Number of rotated log files to keep. Oldest files will be deleted first.
  keepfiles: 7
3

What does 90% memory usage translates to in MB?

Packetbeat needs to keep track of transactions + connections. Plus messages/contents needs to be decompressed in packetbeat. Depending on number of connections and/or transaction rates analysis can become quite expensive. Plus, if contents pushed to cassandra is relatively large, all the uncompressed contents might be kept in buffers for decoding/shipping purposes.

Any warnings/errors in packetbeat logs about packet loss? With packet loss problems might get out of hand, as transactions/connections can not be followed correctly which eventually leads to too much stalled state in packetbeat (well, transactions timeout after 10s by default).

1 Like
4

Hi,
the machine has 2 cpus (Intel(R) Xeon(R) CPU E3-1230 V2 @ 3.30GHz) and 8gb memory.
Here you can see the stats from top:top_packetbeat

I will also provide you a debug log of this packetbeat process.

After round about 15 minutes cpu usage and memory will decrease to a normal level.

5
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.