Graylog2 / Graylog2/graylog2-server

Lots of dead TCP ESTABLISHED connections with NXLog

Open
#3,858 3 comments 0 reactions 0 assignees View on GitHub
to-verify triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

We use NXLog as Logshipper, and we see Thousands of hung TCP connections on the Graylog Server.

The NXLog Client side doesn't have the Problem, there we only see the current connection.

![chrome_2017-05-22_10-38-08](https://cloud.githubusercontent.com/assets/15243394/26301283/02b315b8-3ee1-11e7-9b22-1e4979c72b31.png)

## Expected Behavior
Close the TCP connection when there is no Dataflow like the linux function "tcp_keepalive_time"

## Current Behavior
Dead TCP connections hang for ever.

## Possible Solution
Close the TCP connection when there is no Dataflow like the linux function "tcp_keepalive_time" ?

As described here: http://tldp.org/HOWTO/TCP-Keepalive-HOWTO/overview.html i simply need to turn on keepalive on every TCP input, to avoid this behavior?

## Steps to Reproduce (for bugs)
1. Connect a NXLog via TCP to Graylog and wait. (we see this only after some days running.)

## Configs
Input Config:
```
bind_address: 192.168.100.20
decompress_size_limit: 8388608
max_message_size: 2097152
override_source:
port: 12202
recv_buffer_size: 1048576
tcp_keepalive: false
tls_cert_file:
tls_client_auth: disabled
tls_client_auth_cert_file:
tls_enable: false
tls_key_file:
tls_key_password: ********
use_null_delimiter: true
```
NXLog Config
```

Module xm_gelf
ShortMessageLength -1

# For windows vista/2008 and above use:
Module im_msvistalog
Query \
\
*\
*\
*\
\

Module om_ssl
AllowUntrusted TRUE
Host syslog.xyz.local
Port 12202
OutputType GELF_TCP

Path systemlog => internal

```
## Your Environment
Graylog 2.2.0+d9681cb on syslog.xyz.local (Oracle Corporation 1.8.0_131 on Linux 3.10.0-514.16.1.el7.x86_64)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.