The plugin is not properly detecting client disconnections. It seems it keeps trying to read from closed sockets, making the CPU usage grow every time a client disconnects or send EOF.
The problem is happening on the socket.each method. When the client connection is closed, or it receives an EOF, the code expects it to raise an error (EOFError, ...), stopping the loop, closing the connection and removing it from the connection counter. Instead, it doesn't raise any error, and the CPU usage grows due to some internal issue.
The alternative solution is to change it to read using a non-blocking approach. The read_nonblock raises EOF/disconnect errors, making the existing code work properly.
This PR:
Changed the TCP reading mode to use the non-blocking method (read_nonblock)
Fixed all broken tests
Please hide the white spaces to compare as the indentation level changed
New tests are inside tcp receiver context
Essentially, there were no logic changes/refactoring/improvements on the existing tests, the idea was only to adapt them to work with the current ecs_compatibility matrix, as most of them were considering it was always disabled.
The should properly handle the cef codec with a custom grok_pattern was changed to what I believe is the correct usage of syslog with cef codec.
The plugin is not properly detecting client disconnections. It seems it keeps trying to read from closed sockets, making the CPU usage grow every time a client disconnects or send EOF.
The problem is happening on the socket.each method. When the client connection is closed, or it receives an EOF, the code expects it to raise an error (EOFError, ...), stopping the loop, closing the connection and removing it from the connection counter. Instead, it doesn't raise any error, and the CPU usage grows due to some internal issue.
The alternative solution is to change it to read using a non-blocking approach. The
read_nonblockraises EOF/disconnect errors, making the existing code work properly.This PR:
read_nonblock)tcp receivercontextecs_compatibilitymatrix, as most of them were considering it was always disabled.should properly handle the cef codec with a custom grok_patternwas changed to what I believe is the correct usage ofsyslogwithcefcodec.Closes: https://github.com/logstash-plugins/logstash-input-syslog/issues/74 Closes: https://github.com/logstash-plugins/logstash-input-syslog/issues/70