Deployment Architecture

After upgrading deployment server to 6.5.1, "busyKeepAliveIdleTimeout...Consider raising timeout value" warning displays. Which configuration file do I edit to raise the timeout value?

archspangler
Path Finder

What conf file controls the below message? I noticed the following warning message after upgrading my deployment server to 6.5.1

I cannot find in the documentation what configuration file controls this timeout.

peer=x.x.x.x idle for more than busyKeepAliveIdleTimeout=12 seconds, disconnecting. Consider raising the timeout value.

-Archie

mirkoneverstops
Path Finder

Fixed in 6.5.2.
It is not mentioned in "release notes" but error disappeared after I upgraded our instances from 6.5.1 to 6.5.2.

0 Karma

jeremycarterdhs
Explorer

I was having the same issue as the original question. Dozens of clients reporting the stated error message.

I added the following stanza to my server.conf file (on my deployment server) and it resolved my issue.

[httpServer]
busyKeepAliveIdleTimeout = 30

maraman_splunk
Splunk Employee
Splunk Employee

Its Timeout with upper case
also reducing the timeout by a large number after upgrading to 6.5.1 from 6.4.x
[httpServer]
busyKeepAliveIdleTimeout =30

0 Karma

jeremycarterdhs
Explorer

You're right. Sorry for the typo. I modified my original post.

0 Karma

archspangler
Path Finder

I modified this setting on my deployment server but it appears that the setting is ignored.

-bash-4.1$ splunk btool inputs list| grep busyKeepAliveIdleTimeout
busyKeepAliveIdleTimeout = 20

But i still see messages logged in splunkd.log on the deployment server.

11-29-2016 08:00:27.956 -0500 WARN  HttpListener - peer=x.x.x.x idle for more than busyKeepAliveIdleTimeout=12 seconds, disconnecting. Consider raising the timeout value.

host = xxxxxx  source = /opt/splunk/var/log/splunk/splunkd.log sourcetype = splunkd

snyderh01
Explorer

I have submitted a case to Splunk on this matter. I am awaiting and answer.

0 Karma

swaro_ck
Path Finder

Yesterday I also opened a case, this is the answer from Splunk:

--snip

These are two new parameters introduced in Splunk 6.5.1

https://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Webconf

keepAliveIdleTimeout =
* How long, in seconds, that the SplunkWeb HTTP server allows a keep-alive
connection to remain idle before forcibly disconnecting it.
* If this number is less than 7200, it will be set to 7200.
* Defaults to 7200 seconds.

busyKeepAliveIdleTimeout =
* How long, in seconds, that the SplunkWeb HTTP server allows a keep-alive
connection to remain idle while in a busy state before forcibly disconnecting it.
* Use caution when configuring this setting as a value that is too large
can result in file descriptor exhaustion due to idling connections.
* If this number is less than 12, it will be set to 12.
* Defaults to 12 seconds.

This limited are reached when the SHs is pausing receiving the data because is busy processing it. Once SH is free again it will continue from where it stopped.

If everything else works fine ,you can ignore these, however if you want to remove these errors, try to increase the value for busyKeepAliveIdleTimeout to 30

--snip

I added busyKeepAliveIdleTimeout = 30 in server.conf on a test indexer and the message is gone. At the moment I cannot see negative side effects. But on this machine there is not enough load to say is it OK for that or not.

davebo1896
Communicator

Any update on this from support? Have you tried putting this in production?

0 Karma

snyderh01
Explorer

I tried the server.conf change suggested above and the splunkd.log file continued to fill up with the same error message, the timeout was just reporting as 20 now instead of 12.

0 Karma

archspangler
Path Finder

I agree, I am seeing the same thing.

0 Karma

snyderh01
Explorer

I tried the server.conf change suggested above and the splunkd.log file continued to fill up with the same error message, the timeout was just reporting as 20 now instead of 12.

0 Karma

swaro_ck
Path Finder

After the upgrade from 6.2.1 to 6.5.1 I also get the warning every 10 minutes on the indexer. According to the documentation this parameter could be changed in web-, server- or inputs.conf. https://docs.splunk.com/Special:SplunkSearch/docs?q=busyKeepAliveIdleTimeout+

0 Karma

archspangler
Path Finder

I tried both the inputs.conf, and web.conf (different stanzas) and it appears to have zero effect on the default of 12 seconds messages that we were seeing.

However, I made the following change to the server.conf and the warning messages stopped in the splunkd.log.

[httpServer]
busyKeepAliveIdleTimeout = 20

0 Karma

snyderh01
Explorer

Its controlled through inputs.conf but something is not right as I got the same error on my deployment server after upgrading to 6.5.1. I suppressed the http message for now but I may go back to 6.5 as this is really filling up my splunkd log file when splunk is restarted.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!