topic Re: After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value? in Deployment Architecture

After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

archspangler — Mon, 28 Nov 2016 16:05:07 GMT

What conf file controls the below message? I noticed the following warning message after upgrading my deployment server to 6.5.1

I cannot find in the documentation what configuration file controls this timeout.

peer=x.x.x.x idle for more than busyKeepAliveIdleTimeout=12 seconds, disconnecting. Consider raising the timeout value.

-Archie

Re: After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

snyderh01 — Mon, 28 Nov 2016 17:07:03 GMT

Its controlled through inputs.conf but something is not right as I got the same error on my deployment server after upgrading to 6.5.1. I suppressed the http message for now but I may go back to 6.5 as this is really filling up my splunkd log file when splunk is restarted.

Re: After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

archspangler — Tue, 29 Nov 2016 13:04:48 GMT

I modified this setting on my deployment server but it appears that the setting is ignored.

-bash-4.1$ splunk btool inputs list| grep busyKeepAliveIdleTimeout
busyKeepAliveIdleTimeout = 20

But i still see messages logged in splunkd.log on the deployment server.

11-29-2016 08:00:27.956 -0500 WARN  HttpListener - peer=x.x.x.x idle for more than busyKeepAliveIdleTimeout=12 seconds, disconnecting. Consider raising the timeout value.

host = xxxxxx  source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd

Re: After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

swaro_ck — Wed, 30 Nov 2016 14:28:38 GMT

After the upgrade from 6.2.1 to 6.5.1 I also get the warning every 10 minutes on the indexer. According to the documentation this parameter could be changed in web-, server- or inputs.conf. https://docs.splunk.com/Special:SplunkSearch/docs?q=busyKeepAliveIdleTimeout+

Re: After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

archspangler — Wed, 30 Nov 2016 15:34:11 GMT

I tried both the inputs.conf, and web.conf (different stanzas) and it appears to have zero effect on the default of 12 seconds messages that we were seeing.

However, I made the following change to the server.conf and the warning messages stopped in the splunkd.log.

[httpServer]
busyKeepAliveIdleTimeout = 20

Re: After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

snyderh01 — Wed, 30 Nov 2016 21:08:04 GMT

I tried the server.conf change suggested above and the splunkd.log file continued to fill up with the same error message, the timeout was just reporting as 20 now instead of 12.

Re: After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

snyderh01 — Wed, 30 Nov 2016 21:08:18 GMT

I tried the server.conf change suggested above and the splunkd.log file continued to fill up with the same error message, the timeout was just reporting as 20 now instead of 12.

Re: After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

archspangler — Thu, 01 Dec 2016 15:12:17 GMT

I agree, I am seeing the same thing.

Re: After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

snyderh01 — Thu, 01 Dec 2016 16:11:54 GMT

I have submitted a case to Splunk on this matter. I am awaiting and answer.

Re: After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

swaro_ck — Fri, 02 Dec 2016 06:10:18 GMT

Yesterday I also opened a case, this is the answer from Splunk:

--snip

These are two new parameters introduced in Splunk 6.5.1

https://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Webconf

keepAliveIdleTimeout =
* How long, in seconds, that the SplunkWeb HTTP server allows a keep-alive
connection to remain idle before forcibly disconnecting it.
* If this number is less than 7200, it will be set to 7200.
* Defaults to 7200 seconds.

busyKeepAliveIdleTimeout =
* How long, in seconds, that the SplunkWeb HTTP server allows a keep-alive
connection to remain idle while in a busy state before forcibly disconnecting it.
* Use caution when configuring this setting as a value that is too large
can result in file descriptor exhaustion due to idling connections.
* If this number is less than 12, it will be set to 12.
* Defaults to 12 seconds.

This limited are reached when the SHs is pausing receiving the data because is busy processing it. Once SH is free again it will continue from where it stopped.

If everything else works fine ,you can ignore these, however if you want to remove these errors, try to increase the value for busyKeepAliveIdleTimeout to 30

--snip

I added busyKeepAliveIdleTimeout = 30 in server.conf on a test indexer and the message is gone. At the moment I cannot see negative side effects. But on this machine there is not enough load to say is it OK for that or not.

Re: After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

davebo1896 — Fri, 09 Dec 2016 04:18:04 GMT

Any update on this from support? Have you tried putting this in production?

Re: After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

jeremycarterdhs — Wed, 18 Jan 2017 17:55:52 GMT

I was having the same issue as the original question. Dozens of clients reporting the stated error message.

I added the following stanza to my server.conf file (on my deployment server) and it resolved my issue.

[httpServer]
busyKeepAliveIdleTimeout = 30

Re: After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

maraman_splunk — Wed, 25 Jan 2017 11:35:39 GMT

Its Timeout with upper case
also reducing the timeout by a large number after upgrading to 6.5.1 from 6.4.x
[httpServer]
busyKeepAliveIdleTimeout =30

Re: After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

jeremycarterdhs — Wed, 25 Jan 2017 12:14:25 GMT

You're right. Sorry for the typo. I modified my original post.

Re: After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

mirkoneverstops — Wed, 01 Feb 2017 11:29:26 GMT

Fixed in 6.5.2.
It is not mentioned in "release notes" but error disappeared after I upgraded our instances from 6.5.1 to 6.5.2.