Getting Data In

With a [syslog] output to 3rd party using TCP, why does TCP stop talking to index cluster when 3rd party is not contactable?

lukessi
Path Finder

Hello,

I am sending some source types to a 3rd party via SYSLOG as the output as TCP not UDP. All works fine until we lose contact with their syslog server. Then it breaks all indexing even to my cluster. The queues fill up and basically shuts down inputs.

Works fine using UDP!

Wondering if anyone has came across this issue. He is output of btool.

[syslog]
maxEventSize = 1024
priority = <13>
type = udp

[syslog:syslog_indexers]
server = syslogserver:9997
timestampformat = %Y-%m-%dT%T.%S
type = tcp

[tcpout]

ackTimeoutOnShutdown = 30
autoLBFrequency = 30
autoLBVolume = 0
blockOnCloning = true
blockWarnThreshold = 100
cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES128-SHA256:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-ECDSA-AES256-SHA384:ECDH-ECDSA-AES128-SHA256
compressed = false
connectionTimeout = 20
defaultGroup = cluster_indexers
disabled = false
dropClonedEventsOnQueueFull = 5
dropEventsOnQueueFull = 5
ecdhCurves = prime256v1, secp384r1, secp521r1
forceTimebasedAutoLB = false
forwardedindex.0.whitelist = .*
forwardedindex.1.blacklist = _.*
forwardedindex.2.whitelist = (_audit|_internal|_introspection|_telemetry)
forwardedindex.filter.disable = false
heartbeatFrequency = 30
indexAndForward = false
maxConnectionsPerIndexer = 2
maxFailuresPerInterval = 2
maxQueueSize = auto
readTimeout = 300
secsInFailureInterval = 1
sendCookedData = true
sslQuietShutdown = false
sslVersions = tls1.2
tcpSendBufSz = 0
useACK = true
writeTimeout = 300
[tcpout:cluster_indexers]
server = indexer1:9997,indexer2:9997
0 Karma

FrankVl
Ultra Champion

That’s not an issue, that is by design (although for you that is then still an issue of course). Whenever one of multiple TCP destinations is unreachable, all forwarding is blocked. And as far as I know, that is not configurable.

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...