Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Keepalive option on GELF TCP Input Sockets #1287
When using a GELF TCP Input, it's not possible to set the TCP Keepalive option on the socket. As such, if a client connection is not explicitly closed, the server will keep the connection open indefinitely, and potentially run out of available socket descriptors.
It seems that this option can be set using Socket.setKeepAlive (http://docs.oracle.com/javase/7/docs/api/java/net/Socket.html#setKeepAlive(boolean))
added a commit
Jul 22, 2015
referenced this issue
Jul 22, 2015
This could be related to a symptom we are seeing. If I go to our graylog server directly from my browser, everything is fine. But if I go to it via our reverse-proxy (we use that to publish some internal servers to the Internet), within hours the reverse-proxy starts reporting it cannot connect to the backend server (ie graylog). If I do a "netstat -nt|grep ip.of.graylog" on the reverse proxy, I see 0-4 ESTABLISHED tcp sessions, but doing "netstat -nt|grep ip.of.reverse.proxy" on the graylog-web server shows over 1,000 ESTABLISHED tcp sessions!!!
There's a cisco ASA firewall between the two and I've been screaming at the network team - blaming them about this - but this ticket make me wonder if it was actually graylog-web itself that was the root cause? Does a lack of TCP keepalive explain this symptom?