使用elkeidup部署时报错 about elkeid

[tyraniter]

4GB太低了，不满足的，还要安装如Mongodb/Redis以及内部很多组件，系统还会占用一部分内存。麻烦按部署文档中的最低配置8C16G 200G来进行测试哈

改成16G后正常了，多谢

[EBWi11]

先不要卸载其他模块，看下 systemctl status elkeid_ac 与 journalctl -fxu elkeid_ac 是否有明显报错 ，以及agent center日志：/elkeid/agent_center/log/ 下的 sarama.log svr.log

[tyraniter]

systemctl status elkeid_ac

journalctl -fxu elkeid_ac
an 24 09:05:18 server agent_center[37740]: {"level":"error","ts":1643015118.900328,"msg":"KAFKA","info":"NewClient error:kafka: client has run out of available brokers to talk to (Is your cluster reachable?)"}
Jan 24 09:05:18 server agent_center[37740]: #### [192.168.186.135:9092] hids_svr CONNECT_KAFKA_ERROR: kafka: client has run out of available brokers to talk to (Is your cluster reachable?){"level":"fatal","ts":1643015118.900348,"msg":"InitComponents","info":"[192.168.186.135:9092] hids_svr CONNECT_KAFKA_ERROR: kafka: client has run out of available brokers to talk to (Is your cluster reachable?)"}
Jan 24 09:05:18 server systemd[1]: elkeid_ac.service: Main process exited, code=exited, status=1/FAILURE

看着是kafka的连接问题

[EBWi11]

1. 排查下kafka状态是否正常。 systemctl status elkeid_kafka 与 /elkeid/kafka/kafka_2.13-2.7.0/logs
2. 排查下是否存在网络策略导致无法连接到kafka

[tyraniter]

1. 排查下kafka状态是否正常。 systemctl status elkeid_kafka 与 /elkeid/kafka/kafka_2.13-2.7.0/logs
2. 排查下是否存在网络策略导致无法连接到kafka

2022-01-24 09:28:51,730] ERROR [KafkaServer id=0] Fatal error during KafkaServer startup. Prepare to shutdown (kafka.server.KafkaServer)
java.lang.OutOfMemoryError: Java heap space
at java.base/java.nio.HeapByteBuffer.(HeapByteBuffer.java:64)
at java.base/java.nio.ByteBuffer.allocate(ByteBuffer.java:363)
at kafka.log.SkimpyOffsetMap.(OffsetMap.scala:45)
at kafka.log.LogCleaner$CleanerThread.(LogCleaner.scala:300)
at kafka.log.LogCleaner.$anonfun$startup$2(LogCleaner.scala:155)
at kafka.log.LogCleaner.startup(LogCleaner.scala:154)
at kafka.log.LogManager.startup(LogManager.scala:435)
at kafka.server.KafkaServer.startup(KafkaServer.scala:291)
at kafka.server.KafkaServerStartable.startup(KafkaServerStartable.scala:44)
at kafka.Kafka$.main(Kafka.scala:82)
at kafka.Kafka.main(Kafka.scala)

这个kafka的配置在哪里改呢？

[EBWi11]

目前这个版本没办法手动修改的，只能依赖elkeidup根据机器free自动取，大概逻辑是取当前free的50%。请问测试机器内存多大呢

[tyraniter]

目前这个版本没办法手动修改的，只能依赖elkeidup根据机器free自动取，大概逻辑是取当前free的50%。请问测试机器内存多大呢

4GB

[EBWi11]

或者也可以部署完kafka后手动修改/etc/systemd/system/elkeid_kafka.service 中的KAFKA_HEAP_OPTS信息，不过要快。。

[EBWi11]

4GB太低了，不满足的，还要安装如Mongodb/Redis以及内部很多组件，系统还会占用一部分内存。麻烦按部署文档中的最低配置8C16G 200G来进行测试哈