Indexer shows multiple CLOSE_WAIT sessions on 9997 with forwarders.

New Member

This is probably a follow up to the question asked 20 Mar '12, 02:49 by nebel.
ERROR TcpInputProc - Error encountered for connection
In the process of adding a number of new forwarders to our recently upgraded 5.0.2 (forwarders are still at 4.3.4) we noticed the same messages in splunkd.log on two of 5 indexers.
Further we see in netstat -a, numerous CLOSE_WAIT sessions with many forwarders new and old, forwarders, in some case multiple sessions to a forwarder.
The questions are, what causes it, and are there Splunk recommended TCP tweaks for Linux (CentOS/Redhat/Ubuntu) to resolve this system problem?

0 Karma

Splunk Employee
Splunk Employee

The symptoms you're describing are similar to a recent post here.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!