topic Re: HEC Error : Connection closed by peer in Getting Data In

HEC Error : Connection closed by peer

vishaltaneja070 — Mon, 17 Feb 2020 16:04:27 GMT

02-13-2020 02:52:43.167 +0000 WARN HttpListener - Socket error from XX.xx.xxx.xxx while accessing /services/collector: Connection closed by peer

I am getting these errors, not sure why, any one is aware of this alert? Is there any impact of this error?

Re: HEC Error : Connection closed by peer

manjunathmeti — Mon, 17 Feb 2020 16:35:13 GMT

What is XX.xx.xxx.xxx here? Is it streaming data to HEC?

Re: HEC Error : Connection closed by peer

vishaltaneja070 — Mon, 17 Feb 2020 17:08:09 GMT

Yes it is streaming data to HEC

Re: HEC Error : Connection closed by peer

manjunathmeti — Mon, 17 Feb 2020 17:15:05 GMT

You might be getting more warnings/errors in splunkd logs for this IP. See if you can find any.

Re: HEC Error : Connection closed by peer

nickhills — Mon, 17 Feb 2020 17:19:20 GMT

That error just means that the client (peer) disconnected albeit not gracefully.

It and of itself, may not indicate any issue. It may have just been that the remote client had finished sending data and dropped the connection.

Or it could be any number of other things, such as network disruption.
The challenge is working out which...

If you see it for nearly every request - that would strongly suggest that your sending application is not closing the connection when it has finished data. Again, not a massive issue, but ideally your sending application would close the connection once it has finished.

The problem is that depending on the libraries used by your client app, the requirement to close a connection can be ambiguous and abstracted away from the library in question.
See: https://stackoverflow.com/questions/10115126/python-requests-close-http-connection

If you maintain the HEC client code, review it and see if you can gracefully close the socket after the http session is finished - if you can't don't sweat it too much.

You could argue that it should be an INFO message rather than WARN, but in the case that your client does behave itself nicely, WARNs could be useful to diagnose network problems.

In short, if your environment is working and data is arriving on time then don't worry about it too much.

Re: HEC Error : Connection closed by peer

nickhills — Wed, 26 Feb 2020 22:17:15 GMT

If my answer helped, please consider accepting and/or upvoting so that other memebers of the community can see it was useful.