search

logstash-plugins / logstash-input-tcp

Apache License 2.0
35 stars 75 forks source link

Fix: reduce error logging (to info level) on connection resets #168

Closed kares closed 3 years ago

kares commented 3 years ago

The gist here is to reduce ERROR logging for resets to an INFO level:

[2021-02-08T13:38:14,901][ERROR][logstash.inputs.tcp      ][main][tcp-input] Error in Netty pipeline: java.io.IOException: Connection reset by peer
[2021-02-09T08:59:04,371][INFO ][logstash.inputs.tcp      ][main][tcp-input] /192.168.0.17:60074: closing (Connection reset by peer)
[2021-02-09T08:59:04,940][INFO ][logstash.inputs.tcp      ][main][tcp-input] /192.168.0.17:60080: closing (Connection reset by peer)

and when --log.level debug is enabled:

[2021-02-09T08:46:14,247][DEBUG][logstash.inputs.tcp      ][main][tcp] /192.168.0.17:59476: initialized channel
[2021-02-09T08:46:14,249][DEBUG][logstash.inputs.tcp      ][main][tcp] /192.168.0.17:59476: closing due:
java.io.IOException: Connection reset by peer
    at sun.nio.ch.FileDispatcherImpl.read0(Native Method) ~[?:1.8.0_171]
    at sun.nio.ch.SocketDispatcher.read(SocketDispatcher.java:39) ~[?:1.8.0_171]
    at sun.nio.ch.IOUtil.readIntoNativeBuffer(IOUtil.java:223) ~[?:1.8.0_171]
    at sun.nio.ch.IOUtil.read(IOUtil.java:192) ~[?:1.8.0_171]
    at sun.nio.ch.SocketChannelImpl.read(SocketChannelImpl.java:380) ~[?:1.8.0_171]

potentially, we might handle other exception types as "less error"-y e.g. a "broken pipe" message. "connection resets" seems to be a very common failure as some TCP pings (health-checks) establish a channel:

nmap -v HOST -p port: 1. NMap SYN 2. LS SYN, ACK 3. NMap ACK 4. NMap RST, ACK (reaches the Netty pipeline)

opposed to an "early reset" with HAProxy: 1. Proxy SYN 2. LS SYN, ACK 3. Proxy RST, ACK (does not hit the Netty pipeline)

resolves https://github.com/logstash-plugins/logstash-input-tcp/issues/167