This is probably a follow up to the question asked 20 Mar '12, 02:49 by nebel.
ERROR TcpInputProc - Error encountered for connection
In the process of adding a number of new forwarders to our recently upgraded 5.0.2 (forwarders are still at 4.3.4) we noticed the same messages in splunkd.log on two of 5 indexers.
Further we see in netstat -a, numerous CLOSE_WAIT sessions with many forwarders new and old, forwarders, in some case multiple sessions to a forwarder.
The questions are, what causes it, and are there Splunk recommended TCP tweaks for Linux (CentOS/Redhat/Ubuntu) to resolve this system problem?
