https://community.splunk.com/t5/Getting-Data-In/Indexer-Problem-ERROR-TcpChannel-Fatal-error-on-accept-socket/m-p/61919#M12383 <P>According to Splunk support this Issue wil be fixed in 4.3.1.<BR /> Apparently the root cause of the problem is, that busy indexers can't send TCP Acks fast enough.</P> Thu, 02 Feb 2012 07:32:00 GMT chris 2012-02-02T07:32:00Z https://community.splunk.com/t5/Getting-Data-In/Indexer-Problem-ERROR-TcpChannel-Fatal-error-on-accept-socket/m-p/61918#M12382 <P>Hi </P> <P>we get the following error message from time to time on our Indexers (Solaris 10 x86 64bit Splunk 4.2.5 or 4.3):</P> <P>ERROR TcpChannel - Fatal error on accept socket: Software caused connection abort</P> <P>If this occurs netstat shows that the port is still listening:<BR /><BR /> <CODE><BR /> ~:netstat -an | grep 99<BR /> <EM>.9997 *.</EM> 0 0 49152 0 LISTEN<BR /> </CODE></P> <P>But i do not get a connection when telneting to the port, the forwarders can't connect to the indexer anymore and it has to be restarted.</P> <P>Is there anyone else with the same problem somewhere? Is there a fix for this?</P> <P>Thanks for helping </P> <P>Chris</P> <P>Edit:<BR /><BR /> We have downgraded to 4.2.4 on one of our indexers, we haven't had the problem since then. But it has only been running for a couple of hours now. I will update this when more time has passed</P> Wed, 01 Feb 2012 10:32:44 GMT https://community.splunk.com/t5/Getting-Data-In/Indexer-Problem-ERROR-TcpChannel-Fatal-error-on-accept-socket/m-p/61918#M12382 chris 2012-02-01T10:32:44Z https://community.splunk.com/t5/Getting-Data-In/Indexer-Problem-ERROR-TcpChannel-Fatal-error-on-accept-socket/m-p/61919#M12383 <P>According to Splunk support this Issue wil be fixed in 4.3.1.<BR /> Apparently the root cause of the problem is, that busy indexers can't send TCP Acks fast enough.</P> Thu, 02 Feb 2012 07:32:00 GMT https://community.splunk.com/t5/Getting-Data-In/Indexer-Problem-ERROR-TcpChannel-Fatal-error-on-accept-socket/m-p/61919#M12383 chris 2012-02-02T07:32:00Z