[graylog2] NGINX Proxy reports "upstream response is buffered to a temporary file" erros when accessing Graylog

[Jan]

Hi Graylog Users,

I've been running Graylog for some month now and lately I noticed delays of 
displaying the Graylog UI (even the login-page) when accessing it thru the 
NGINX proxy.
The NGINX proxy is configured as explained in the Graylog documentation 
(http://docs.graylog.org/en/2.1/pages/configuration/web_interface.html?highlight=nginx#nginx
 
) to combine the UI-Port and the API-Port behind one common URL.

During slow access I see [warn] messages printed to NGINX error.log which 
look like:

2017/01/10 14:57:30 [warn] 1846#1846: *33881 an upstream response is 
buffered to a temporary file /var/cache/nginx/proxy_temp/9/01/0000000019 
while reading upstream, client: 192.168.1.150, server: graylog.example.net, 
request: "GET 
/api/search/universal/relative?query=%2A&range=300&filter=streams%3A578e149dc6913f5e485c2216&limit=150&sort=timestamp%3Adesc
 
HTTP/1.1", upstream: 
"http://192.168.1.2:12900/search/universal/relative?query=%2A&range=300&filter=streams%3A578e149dc6913f5e485c2216&limit=150&sort=timestamp%3Adesc";,
 
host: "graylog.example.net", referrer: 
"http://graylog.example.net/streams/578e149dc6913f5e485c2216/search";

I see this both for the REST-API :12900 and also for the UI-Port :9000

Different resources on the internet say that tuneing the 
proxy_buffer*-Settings might help. As anyone encountered this warning or 
are there any recommended settings for the proxy_buffer?

My current NGINX config is:

server
{
        listen          192.168.1.2:8080 default_server;
        server_name     graylog.example.net;


        location /api/
        {
                proxy_set_header        Host $http_host;
                proxy_set_header        X-Forwarded-Host $host;
                proxy_set_header        X-Forwarded-Server $host;
                proxy_set_header        X-Forwarded-For 
$proxy_add_x_forwarded_for;
                proxy_pass              http://192.168.1.2:12900/;
                # Default proxy_buffers 8 4k|8k
                # Default proxy_buffering on;
                # Default proxy_busy_buffers_size 8K|16K

        }
        location /
        {
                proxy_set_header        Host $http_host;
                proxy_set_header        X-Forwarded-Host $host;
                proxy_set_header        X-Forwarded-Server $host;
                proxy_set_header        X-Forwarded-For 
$proxy_add_x_forwarded_for;
                proxy_set_header        X-Graylog-Server-URL http:
//graylog.example.net/api;
                proxy_pass              http://192.168.1.2:9000;
                # Default proxy_buffers 8 4k|8k
                # Default proxy_buffering on;
                # Default proxy_busy_buffers_size 8K|16K
        }
}

I would appreciate any hint or maybe sharing some practical experience from 
admins running Graylog behind NGINX.

Regards,
Jan

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/2c97aee0-30a0-4ae7-8129-810777e31a5a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.