Member
Bro 3 source no problem. I run 5 source to one 768MB before. Key is set batch size small in promtail config, dont send too often. And use gzip. Default promtail want send every 1 second, change to 10 or 30 second. Less connection, less memory.
This but unironically. Every "cloud native" tool defaults to "we assume you have 16GB and a team of three." You spend first two days just turning things off.
Loki is actually better than most here. Try running Elasticsearch with default heap on 1GB. JVM alone wants 50% of available RAM and still complains.
Has anyone tried Vector instead? It can replace both promtail and loki in some setups. Vector has disk buffers and can ship to a cheap S3-compatible store, then you query with something else. Not exactly aggregation but for "search later" it works.
Vector is only ship no? I am confuse about this. I read documentation but it say "transform" and "sink" but no storage. So I still need somewhere to put logs, Loki or Elasticsearch or S3. Or I misunderstand?
You understand correctly. Vector is pipeline, not database. It can replace promtail + maybe fluentd, but not Loki itself. If you want central search without heavy backend, maybe look at quickwit? But I never try on 1GB.
Member
I run Loki with filesystem storage on 512MB ARM box. No swap even. But only one sender, and I query maybe once per week. For 3 senders with regular search, agree with others: add swap, limit memory, forget Grafana (https://grafana.com). Logcli is enough.
Let me correct myself after actually checking. On 1GB with swap, your constraint becomes swap thrashing, which is I/O. So I was accidentally right. NVMe helps. Spinning rust would murder this setup.
Also Hetzner to OVHcloud: you are crossing ASNs. Latency from Helsinki to Gravelines is ~35ms. Not terrible but promtail batching matters more.
Careful with swappiness. Default 60 on Debian means it swaps too eagerly. Set vm.swappiness=10 so it only swaps when really need. Otherwise you get lag spike for no reason.
What about syslog-ng or rsyslog to central server, then grep/awk? Old school but 1GB is old school territory. You lose structured query but gain "it actually works without swap death."
This. My NAS has 512MB real RAM, no swap. Rsyslog central collector since 2019. nginx logs, home automation, everything. I search with grep and pipe to awk. Is it fast? No. Does it work on hardware older than some forum members? Yes.
Not every problem needs a "cloud native" solution. Sometimes problem needs less software.
