search

Graylog2 / graylog-docker

Official Graylog Docker image
https://hub.docker.com/r/graylog/graylog/
Apache License 2.0
361 stars 133 forks source link

SO_RCVBUF warn on Graylog 4 #135

Closed malinkinsa closed 3 years ago

malinkinsa commented 3 years ago

I duplicate my question from the forum. After update Graylog from 3.3.8 to 4.0.0 with change ES version to 7.10.0 one of my Netflow UDP input started to lose almost all data with next warning in log: | 2020-11-26 09:24:33,931 WARN : org.graylog2.inputs.transports.UdpTransport - receiveBufferSize (SO_RCVBUF) for input NetFlowUdpInput{title=Office Netflow, type=org.graylog.plugins.netflow.inputs.NetFlowUdpInput, nodeId=998dccaf-8d52-4782-8294-2b4a9b160ea6} (channel [id: 0x7e47f7ca, L:/0.0.0.0:2056]) should be 262144 but is 524288.

I am doing sysctl -w net.core.wmem_max=262144 on host machine - nothing.

Some of the logs still come in. But these are a few percent. But if i stop this input - i have a similar warn on my second netflow connector, but no problems with logs.

May be you have any solution for this case?

mariussturm commented 3 years ago

@malinkinsa could you please re-open this issue in the Graylog server repo as this repo is only for the Docker container creation.

https://github.com/Graylog2/graylog2-server/issues