Hi Jan, the warning message simply means that the response is larger than the internal nginx buffer to store upstream responses. You can configure this buffer in your nginx configuration with the client_body_buffer_size <https://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size> setting.
See https://serverfault.com/questions/587386/an-upstream-response-is-buffered-to-a-temporary-file and https://serverfault.com/questions/511789/nginx-client-request-body-is-buffered-to-a-temporary-file for relevant answers on ServerFault. Cheers, Jochen On Wednesday, 11 January 2017 07:25:49 UTC+1, Jan wrote: > > Hi Graylog Users, > > I've been running Graylog for some month now and lately I noticed delays > of displaying the Graylog UI (even the login-page) when accessing it thru > the NGINX proxy. > The NGINX proxy is configured as explained in the Graylog documentation ( > http://docs.graylog.org/en/2.1/pages/configuration/web_interface.html?highlight=nginx#nginx > > ) to combine the UI-Port and the API-Port behind one common URL. > > During slow access I see [warn] messages printed to NGINX error.log which > look like: > > 2017/01/10 14:57:30 [warn] 1846#1846: *33881 an upstream response is > buffered to a temporary file /var/cache/nginx/proxy_temp/9/01/0000000019 > while reading upstream, client: 192.168.1.150, server: graylog.example.net, > request: "GET > /api/search/universal/relative?query=%2A&range=300&filter=streams%3A578e149dc6913f5e485c2216&limit=150&sort=timestamp%3Adesc > > HTTP/1.1", upstream: " > http://192.168.1.2:12900/search/universal/relative?query=%2A&range=300&filter=streams%3A578e149dc6913f5e485c2216&limit=150&sort=timestamp%3Adesc";, > > host: "graylog.example.net", referrer: " > http://graylog.example.net/streams/578e149dc6913f5e485c2216/search"; > > I see this both for the REST-API :12900 and also for the UI-Port :9000 > > Different resources on the internet say that tuneing the > proxy_buffer*-Settings might help. As anyone encountered this warning or > are there any recommended settings for the proxy_buffer? > > My current NGINX config is: > > server > { > listen 192.168.1.2:8080 default_server; > server_name graylog.example.net; > > > location /api/ > { > proxy_set_header Host $http_host; > proxy_set_header X-Forwarded-Host $host; > proxy_set_header X-Forwarded-Server $host; > proxy_set_header X-Forwarded-For > $proxy_add_x_forwarded_for; > proxy_pass http://192.168.1.2:12900/; > # Default proxy_buffers 8 4k|8k > # Default proxy_buffering on; > # Default proxy_busy_buffers_size 8K|16K > > } > location / > { > proxy_set_header Host $http_host; > proxy_set_header X-Forwarded-Host $host; > proxy_set_header X-Forwarded-Server $host; > proxy_set_header X-Forwarded-For > $proxy_add_x_forwarded_for; > proxy_set_header X-Graylog-Server-URL http:// > graylog.example.net/api; > proxy_pass http://192.168.1.2:9000; > # Default proxy_buffers 8 4k|8k > # Default proxy_buffering on; > # Default proxy_busy_buffers_size 8K|16K > } > } > > I would appreciate any hint or maybe sharing some practical experience > from admins running Graylog behind NGINX. > > Regards, > Jan > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/d844c0b6-9d79-4e84-a620-c51b84188fe2%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
