elastic / elastic/logstash

TCP Connections in CLOSE_WAIT state

Open
#3,987 7 comments 3 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
19h 14m
Merged PRs (30d)
63

Description

We have logstash 1.5.2 deployment with approx 4.5k TCP connections to a single logstash instance. logstash is hosted on Red Hat Enterprise Linux Server release 6.4 (Santiago).
The 4.5k connections are from distributed servers hosting our own monitoring agents. SSL is enabled between the Agents and this logstash.

We have been seeing an abnormal behavior with the TCP connections. On the logstash host, we start seeing the TCP state as CLOSE_WAIT if any one of the monitoring agents is reconfigured or if it goes down. And the state remains to be CLOSE_WAIT until we restart logstash.

The TCP input plugin config we use-
tcp {
# listen on port 5530
port => 5530
ssl_enable => true
ssl_cert => "PATH_TO_FILE/server_crt.pem"
ssl_key => "PATH_TO_FILE/server_key.pem"
ssl_cacert => "PATH_TO_FILE/cacert.pem"
}

In a steady state this is all fine and we don't see the CLOSE_WAIT. But once we start seeing these CLOSE_WAITs the agent fails to connect to logstash.

Not sure if it is a bug with the TCP input plugin, or if there is a fix in any later versions.
Would like to know, if any configurations would help address this issue?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.