After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

[archspangler]

What conf file controls the below message? I noticed the following warning message after upgrading my deployment server to 6.5.1

I cannot find in the documentation what configuration file controls this timeout.

peer=x.x.x.x idle for more than busyKeepAliveIdleTimeout=12 seconds, disconnecting. Consider raising the timeout value.

-Archie

[mirkoneverstops]

Fixed in 6.5.2.
It is not mentioned in "release notes" but error disappeared after I upgraded our instances from 6.5.1 to 6.5.2.

[jeremycarterdhs]

I was having the same issue as the original question. Dozens of clients reporting the stated error message.

I added the following stanza to my server.conf file (on my deployment server) and it resolved my issue.

[httpServer]
busyKeepAliveIdleTimeout = 30

[maraman_splunk]

Its Timeout with upper case
also reducing the timeout by a large number after upgrading to 6.5.1 from 6.4.x
[httpServer]
busyKeepAliveIdleTimeout =30

[jeremycarterdhs]

You're right. Sorry for the typo. I modified my original post.

[archspangler]

I modified this setting on my deployment server but it appears that the setting is ignored.

-bash-4.1$ splunk btool inputs list| grep busyKeepAliveIdleTimeout
busyKeepAliveIdleTimeout = 20

But i still see messages logged in splunkd.log on the deployment server.

11-29-2016 08:00:27.956 -0500 WARN  HttpListener - peer=x.x.x.x idle for more than busyKeepAliveIdleTimeout=12 seconds, disconnecting. Consider raising the timeout value.

host = xxxxxx  source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd

[snyderh01]

I have submitted a case to Splunk on this matter. I am awaiting and answer.

[swaro_ck]

Yesterday I also opened a case, this is the answer from Splunk:

--snip

These are two new parameters introduced in Splunk 6.5.1

https://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Webconf

keepAliveIdleTimeout =
* How long, in seconds, that the SplunkWeb HTTP server allows a keep-alive
connection to remain idle before forcibly disconnecting it.
* If this number is less than 7200, it will be set to 7200.
* Defaults to 7200 seconds.

busyKeepAliveIdleTimeout =
* How long, in seconds, that the SplunkWeb HTTP server allows a keep-alive
connection to remain idle while in a busy state before forcibly disconnecting it.
* Use caution when configuring this setting as a value that is too large
can result in file descriptor exhaustion due to idling connections.
* If this number is less than 12, it will be set to 12.
* Defaults to 12 seconds.

This limited are reached when the SHs is pausing receiving the data because is busy processing it. Once SH is free again it will continue from where it stopped.

If everything else works fine ,you can ignore these, however if you want to remove these errors, try to increase the value for busyKeepAliveIdleTimeout to 30

--snip

I added busyKeepAliveIdleTimeout = 30 in server.conf on a test indexer and the message is gone. At the moment I cannot see negative side effects. But on this machine there is not enough load to say is it OK for that or not.

[davebo1896]

Any update on this from support? Have you tried putting this in production?

[snyderh01]

I tried the server.conf change suggested above and the splunkd.log file continued to fill up with the same error message, the timeout was just reporting as 20 now instead of 12.

[archspangler]

I agree, I am seeing the same thing.

[snyderh01]

I tried the server.conf change suggested above and the splunkd.log file continued to fill up with the same error message, the timeout was just reporting as 20 now instead of 12.

[swaro_ck]

After the upgrade from 6.2.1 to 6.5.1 I also get the warning every 10 minutes on the indexer. According to the documentation this parameter could be changed in web-, server- or inputs.conf. https://docs.splunk.com/Special:SplunkSearch/docs?q=busyKeepAliveIdleTimeout+

[archspangler]

I tried both the inputs.conf, and web.conf (different stanzas) and it appears to have zero effect on the default of 12 seconds messages that we were seeing.

However, I made the following change to the server.conf and the warning messages stopped in the splunkd.log.

[httpServer]
busyKeepAliveIdleTimeout = 20

[snyderh01]

Its controlled through inputs.conf but something is not right as I got the same error on my deployment server after upgrading to 6.5.1. I suppressed the http message for now but I may go back to 6.5 as this is really filling up my splunkd log file when splunk is restarted.