Getting Data In

With a [syslog] output to 3rd party using TCP, why does TCP stop talking to index cluster when 3rd party is not contactable?

lukessi
Path Finder

Hello,

I am sending some source types to a 3rd party via SYSLOG as the output as TCP not UDP. All works fine until we lose contact with their syslog server. Then it breaks all indexing even to my cluster. The queues fill up and basically shuts down inputs.

Works fine using UDP!

Wondering if anyone has came across this issue. He is output of btool.

[syslog]
maxEventSize = 1024
priority = <13>
type = udp

[syslog:syslog_indexers]
server = syslogserver:9997
timestampformat = %Y-%m-%dT%T.%S
type = tcp

[tcpout]

ackTimeoutOnShutdown = 30
autoLBFrequency = 30
autoLBVolume = 0
blockOnCloning = true
blockWarnThreshold = 100
cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES128-SHA256:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-ECDSA-AES256-SHA384:ECDH-ECDSA-AES128-SHA256
compressed = false
connectionTimeout = 20
defaultGroup = cluster_indexers
disabled = false
dropClonedEventsOnQueueFull = 5
dropEventsOnQueueFull = 5
ecdhCurves = prime256v1, secp384r1, secp521r1
forceTimebasedAutoLB = false
forwardedindex.0.whitelist = .*
forwardedindex.1.blacklist = _.*
forwardedindex.2.whitelist = (_audit|_internal|_introspection|_telemetry)
forwardedindex.filter.disable = false
heartbeatFrequency = 30
indexAndForward = false
maxConnectionsPerIndexer = 2
maxFailuresPerInterval = 2
maxQueueSize = auto
readTimeout = 300
secsInFailureInterval = 1
sendCookedData = true
sslQuietShutdown = false
sslVersions = tls1.2
tcpSendBufSz = 0
useACK = true
writeTimeout = 300
[tcpout:cluster_indexers]
server = indexer1:9997,indexer2:9997
0 Karma

FrankVl
Ultra Champion

That’s not an issue, that is by design (although for you that is then still an issue of course). Whenever one of multiple TCP destinations is unreachable, all forwarding is blocked. And as far as I know, that is not configurable.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...