Is there a limit to the number of TCP listeners we can configure on a Heavy Forwarder (HF)?

[shivarpith]

Hi ,

We have configured a couple of Bluecoats on TCP custom ports on a HF. i see the data flowing in but the Bluecoat admins frequently comment that they are receiving alerts for failed upload to Splunk.

My 1st guess is that the port is exceeding the buffer limit or has filled up its queue.

But how can I ensure there is no data loss? Can we enable multiple listeners on a HF? We are to onboard more Bluecoats to Splunk through the same HF. Is there a limit to the number of listeners we can configure on a HF?

Does it affect performance?

Thanks,
Shiv

[adonio]

i think it will be better to have a syslog receiver and have the forwarder monitor the syslog directories
read here:
http://docs.splunk.com/Documentation/AddOns/released/BlueCoatProxySG/Setup
http://docs.splunk.com/Documentation/AddOns/released/BlueCoatProxySG/Configureinputs

[jkat54]

Theoretical TCP port limit is 65535 minus your already in use ports. Can a single network card with 10baseT handle 10TB per day across that many ports? Probably not.

Does it affect performance, yes, extra network load requires extra resources like bonded network connections, load balancers, etc. but your software handling those connections will more likely be the cause of performance issues before your network is.

Your chasing a capacity question that only you can solve. It’s a professional engineering problem that’s always going to difficult to solve, but will always be best solved by yourself and a calculator and maybe some performance testing.

Start with a software designed to handle high amounts of network traffic over TCP and you’ll be off on the right foot. As @adonio suggested, rsyslog and syslog-ng are both good at handling large amounts of TCP traffic.