We are using a Cloud Foundry for an Internal Cloud Implementation. We are migrating applications and hence using TCP streaming versus the Splunk Forwarding Agent to stream logs. The Cloud Support Team is observing errors logged because the TCP stream is backing up. I am using a vanilla TCP configuration. Are there extra configurations I can add to the stanza to increase the buffer to prevent messages from dropping?
Sample Vanilla TCP configuration:
[tcp://3301]
connection_host = dns
index = index_name
sourcetype = rfc5424_syslog
Logs from the Cloud Foundry Doppler Service:
{"timestamp":1474911116.219854593,"process_id":17528,"source":"doppler","log_level":"warn","message":"TB: Output channel too full","data":{"appId":"d41c5c78-955a-4148-b575-cf868dc0b6fe","destination":"syslog://tlaloga1.dev.prod.travp.net:3303","dropped":99,"total_dropped":496},"file":"/var/vcap/data/compile/doppler/loggregator/src/truncatingbuffer/truncating_buffer.go","line":112,"method":"truncatingbuffer.(*TruncatingBuffer).forwardMessage"}
{"timestamp":1474911142.510904074,"process_id":17528,"source":"doppler","log_level":"warn","message":"TB: Output channel too full","data":{"appId":"d41c5c78-955a-4148-b575-cf868dc0b6fe","destination":"syslog://tlaloga1.dev.prod.travp.net:3303","dropped":99,"total_dropped":595},"file":"/var/vcap/data/compile/doppler/loggregator/src/truncatingbuffer/truncating_buffer.go","line":112,"method":"truncatingbuffer.(*TruncatingBuffer).forwardMessage"}
{"timestamp":1474911161.138316393,"process_id":17528,"source":"doppler","log_level":"warn","message":"TB: Output channel too
... View more