New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Keepalive option on GELF TCP Input Sockets #1287

andrewzk opened this Issue Jul 3, 2015 · 4 comments


None yet
4 participants

andrewzk commented Jul 3, 2015

When using a GELF TCP Input, it's not possible to set the TCP Keepalive option on the socket. As such, if a client connection is not explicitly closed, the server will keep the connection open indefinitely, and potentially run out of available socket descriptors.

It seems that this option can be set using Socket.setKeepAlive (


This comment has been minimized.


joschi commented Jul 3, 2015


This comment has been minimized.


bernd commented Jul 3, 2015

@andrewzk Thanks for the hint and the link. We are using Netty for the inputs, tough. We will check if that can be included in the coming releases.

joschi added a commit that referenced this issue Jul 22, 2015

@joschi joschi added this to the 1.2.0 milestone Jul 22, 2015

@joschi joschi self-assigned this Jul 22, 2015

@bernd bernd closed this in #1318 Jul 23, 2015


This comment has been minimized.


bernd commented Jul 23, 2015

@andrewzk This will be included in the upcoming 1.2 release.


This comment has been minimized.

jhaar commented Aug 4, 2015

This could be related to a symptom we are seeing. If I go to our graylog server directly from my browser, everything is fine. But if I go to it via our reverse-proxy (we use that to publish some internal servers to the Internet), within hours the reverse-proxy starts reporting it cannot connect to the backend server (ie graylog). If I do a "netstat -nt|grep ip.of.graylog" on the reverse proxy, I see 0-4 ESTABLISHED tcp sessions, but doing "netstat -nt|grep ip.of.reverse.proxy" on the graylog-web server shows over 1,000 ESTABLISHED tcp sessions!!!

There's a cisco ASA firewall between the two and I've been screaming at the network team - blaming them about this - but this ticket make me wonder if it was actually graylog-web itself that was the root cause? Does a lack of TCP keepalive explain this symptom?


Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment