topic Re: Why has the Splunk forwarder on Windows 2008R2 created so many sessions that no new sessions can be created? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Why-has-the-Splunk-forwarder-on-Windows-2008R2-created-so-many/m-p/322132#M60044 <P>How is your indexing performance? Did you take a look at your indexer splunkd.log ?</P> Fri, 06 Apr 2018 09:29:57 GMT splunker12er 2018-04-06T09:29:57Z Why has the Splunk forwarder on Windows 2008R2 created so many sessions that no new sessions can be created? https://community.splunk.com/t5/Getting-Data-In/Why-has-the-Splunk-forwarder-on-Windows-2008R2-created-so-many/m-p/322131#M60043 <P>In my environment, there are two components like below.<BR /> Splunk 6.2.7 on Linux.<BR /> Splunk 6.2.7 on Windows 2008R2</P> <P>Yesterday, when I checked <CODE>netstat</CODE> on windows, Forwarder was creating about ten thousand sessions in status "TIME_WAIT", so couldn't create new sessions!</P> <P>For now, it has been normal, because I've rebooted it.<BR /> But I am worried that it will happen again.</P> <P>Why did it happen?<BR /> I checked splunkd.log, and I found so many <CODE>connection failed</CODE> messages while it was happening.(I don't have any idea why the connection failed.)<BR /> If the connection between Splunk and Splunk forwarder has been failing for a long time, is that why it this happened?</P> <P>I really appreciate if somebody can tell me about it.</P> <P>I checked the answer below, but I don't configure <CODE>connection_host = dns</CODE>, so I don't think that this cause applys to this phenomenon.<BR /> <A href="https://answers.splunk.com/answers/114447/splunk-to-splunk-communication-stuck-in-close-wait.html">https://answers.splunk.com/answers/114447/splunk-to-splunk-communication-stuck-in-close-wait.html</A></P> Fri, 06 Apr 2018 08:07:06 GMT https://community.splunk.com/t5/Getting-Data-In/Why-has-the-Splunk-forwarder-on-Windows-2008R2-created-so-many/m-p/322131#M60043 yutaka1005 2018-04-06T08:07:06Z Re: Why has the Splunk forwarder on Windows 2008R2 created so many sessions that no new sessions can be created? https://community.splunk.com/t5/Getting-Data-In/Why-has-the-Splunk-forwarder-on-Windows-2008R2-created-so-many/m-p/322132#M60044 <P>How is your indexing performance? Did you take a look at your indexer splunkd.log ?</P> Fri, 06 Apr 2018 09:29:57 GMT https://community.splunk.com/t5/Getting-Data-In/Why-has-the-Splunk-forwarder-on-Windows-2008R2-created-so-many/m-p/322132#M60044 splunker12er 2018-04-06T09:29:57Z