# Ubuntu 20.04 ELK 8.10.2 Consuming all the RAM **URL:** \ **Category:** Kibana\ **Created:** [March 5, 2024, 6:52pm UTC](https://discuss.elastic.co/t/ubuntu-20-04-elk-8-10-2-consuming-all-the-ram/354769 "2024-03-05T18:52:53Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![RobertC1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robertc1/32/98051_2.png) [@RobertC1](https://discuss.elastic.co/u/RobertC1)\ **Post date:** [March 5, 2024, 6:52pm UTC](https://discuss.elastic.co/t/ubuntu-20-04-elk-8-10-2-consuming-all-the-ram/354769/1 "2024-03-05T18:52:53Z")
There are 241 threads of /usr/share/elasticsearch/jdk/bin/java and this is consumig the RAM progressively. The ingestion process is executed every hour. ![RAM](https://us1.discourse-cdn.com/elastic/original/3X/d/f/df55e68562657a863d6aff7a87102ebc3c0dd20d.png) ```auto root@SRV-ELK:/etc/elasticsearch# ps -feaL | grep '/usr/share/elasticsearch/jdk/bin/java' | wc -l 241 ``` The VM has 8 processors, 38GB RAM. /etc/elasticsearch/elasticsearch.yml has the following sentences. ```auto indices.queries.cache.size: 10% indices.fielddata.cache.size: 10% ``` The jvm.options: ```auto -Xms10g -Xmx14g ``` When I stop the instances of elasticsearch and kibana,also execute the following command ```auto sudo sync && sudo sh -c 'echo 3 > /proc/sys/vm/drop_caches' ``` This clean the RAM Cache and Buffers, but almost immediately start to increase consuming the RAM. What am I missing.? Thanks in advance. (See Image attached from Grafana). ---
**Author:** ![RobertC1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robertc1/32/98051_2.png) [@RobertC1](https://discuss.elastic.co/u/RobertC1)\ **Post date:** [March 6, 2024, 5:20pm UTC](https://discuss.elastic.co/t/ubuntu-20-04-elk-8-10-2-consuming-all-the-ram/354769/2 "2024-03-06T17:20:06Z")
This is another hint that the elasticsearch is the problem ```auto root@SRV-ELK:/opt/trabaja/csv# ps aux --sort=-%mem | head -n 11 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND elastic+ 831921 298 86.4 314512984 35460424 ? Sl 13:05 219:57 /usr/share/elasticsearch/jdk/bin/java -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -Djava.security.manager=allow -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Dlog4j2.formatMsgNoLookups=true -Djava.locale.providers=SPI,COMPAT --add-opens=java.base/java.io=org.elasticsearch.preallocate -Xms10g -Xmx14g -XX:+UseG1GC -Djava.io.tmpdir=/tmp/elasticsearch-9783747863161313092 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/lib/elasticsearch -XX:ErrorFile=/var/log/elasticsearch/hs_err_pid%p.log -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/elasticsearch/gc.log:utctime,pid,tags:filecount=32,filesize=64m -Xms10g -Xmx14g -server -XX:MaxDirectMemorySize=7516192768 -XX:InitiatingHeapOccupancyPercent=30 -XX:G1ReservePercent=25 -Des.distribution.type=deb --module-path /usr/share/elasticsearch/lib --add-modules=jdk.net --add-modules=org.elasticsearch.preallocate -m org.elasticsearch.server/org.elasticsearch.bootstrap.Elasticsearch ``` ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [March 6, 2024, 5:48pm UTC](https://discuss.elastic.co/t/ubuntu-20-04-elk-8-10-2-consuming-all-the-ram/354769/3 "2024-03-06T17:48:57Z")
Are you having any issue? The image you shared show just around 14 GB of memory used and the majority of the remaining RAM is in the cache. This looks like normal behavior for me. For example, my hot nodes have 64 GB and 30 GB of heap, the majority of memory used is the HEAP memory and the rest will appear as cached in the monitoring. ![Screenshot from 2024-03-06 14-42-28](https://us1.discourse-cdn.com/elastic/original/3X/d/2/d2ce2d2e1c8760d97b71596c2fe646f5b9bf4aeb.png) It says that it has only 880 MB free, but if you check on the server with `free -h` you have this: ```auto total used free shared buff/cache available Mem: 62Gi 37Gi 1.1Gi 16Mi 23Gi 24Gi Swap: 0B 0B 0B ``` So, in my case 24 GB is available, buffered/cached memory does not count as used. What is the response of `free -h` in your server? ---
**Author:** ![RobertC1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robertc1/32/98051_2.png) [@RobertC1](https://discuss.elastic.co/u/RobertC1)\ **Post date:** [March 6, 2024, 5:52pm UTC](https://discuss.elastic.co/t/ubuntu-20-04-elk-8-10-2-consuming-all-the-ram/354769/4 "2024-03-06T17:52:55Z")
```auto total usado libre compartido búfer/caché disponible Memoria: 39Gi 5,4Gi 8,7Gi 4,0Mi 25Gi 33Gi Swap: 15Gi 4,0Mi 15Gi ``` ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [March 6, 2024, 5:57pm UTC](https://discuss.elastic.co/t/ubuntu-20-04-elk-8-10-2-consuming-all-the-ram/354769/5 "2024-03-06T17:57:41Z")
Your system has 38 GB and it says that 33 GB are available, not sure what is the issue here. Memory that shows up as buffered/cached will be used by the kernel if an application needs it. A better explanation can be found here: [https://www.linuxatemyram.com](https://www.linuxatemyram.com) ---
**Author:** ![RobertC1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robertc1/32/98051_2.png) [@RobertC1](https://discuss.elastic.co/u/RobertC1)\ **Post date:** [March 6, 2024, 5:58pm UTC](https://discuss.elastic.co/t/ubuntu-20-04-elk-8-10-2-consuming-all-the-ram/354769/6 "2024-03-06T17:58:31Z")
The last information that a shared, is not accurate. Give me 15 minutes. ---
**Author:** ![RobertC1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robertc1/32/98051_2.png) [@RobertC1](https://discuss.elastic.co/u/RobertC1)\ **Post date:** [March 6, 2024, 6:20pm UTC](https://discuss.elastic.co/t/ubuntu-20-04-elk-8-10-2-consuming-all-the-ram/354769/7 "2024-03-06T18:20:30Z")
Thanks @leandrojmp I will follow the articel shared. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 3, 2024, 6:20pm UTC](https://discuss.elastic.co/t/ubuntu-20-04-elk-8-10-2-consuming-all-the-ram/354769/8 "2024-04-03T18:20:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.