Day-two work on a running Graylog: monitoring the cluster, journal and buffer problems, support bundles, backups and capacity checks.
Watching Graylog health from outside: enabling the Prometheus exporter, bind address and scrape config, the gl_ metrics that matter for throughput, journal and buffers, and alerting before ingestion stalls.
What high journal utilization means and how to fix it: a slow or unreachable search backend, processing bottlenecks in pipelines, disk space, and the risk of uncommitted messages being dropped.
Getting more throughput from Graylog nodes: process and output buffer processors, CPU-based defaults since 6.0, expensive pipeline rules and regular expressions, and when to add nodes instead.
Collecting and reading a Graylog support bundle: what each file shows, a step-by-step diagnosis order, certificate expiry checks and redacting secrets before sharing it.
Backing up Graylog so the cluster can be rebuilt: MongoDB configuration data, Data Node or OpenSearch snapshots, server configuration and certificates, restore order and testing restores.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.