Here is the full env_file SC4S_SOURCE_SYSLOG_PORTS=514,32514,32601,41514,41601,42514,42601 SC4S_DEST_SPLUNK_HEC_DEFAULT_URL=https://<>:3001/services/collector/event SC4S_DEST_SPLUNK_HEC_DEFAULT_TOKEN=<> SC4S_DEST_SPLUNK_HEC_DEFAULT_INDEX=<> # SC4S_DEST_SPLUNK_HEC_DEFAULT_MODE=GLOBAL # SC4S_DEST_SPLUNK_HEC_DEFAULT_FORMAT=json # SC4S_DEST_SPLUNK_HEC_DEFAULT_TLS_VERIFY=no SC4S_DEST_SPLUNK_HEC_TLS_CA_FILE=/etc/ssl/certs/ca-certificates.crt SC4S_DEST_SPLUNK_HEC_TLS_CLIENT_CERT=/etc/syslog-ng/tls/splunk.crt SC4S_DEST_SPLUNK_HEC_TLS_CLIENT_KEY=/etc/syslog-ng/tls/splunk.key SC4S_SOURCE_TLS_ENABLE=yes SC4S_SOURCE_TLS_KEY=/etc/syslog-ng/tls/server.key SC4S_SOURCE_TLS_CERT=/etc/syslog-ng/tls/server.pem SC4S_DEST_SPLUNK_HEC_DEFAULT_DISKBUFF_ENABLE=yes SC4S_DEST_SPLUNK_HEC_DEFAULT_DISKBUFF_DIR=/var/lib/sc4s/disk-buffer SC4S_HEALTH_CHECK_ENABLE=true SC4S_LISTEN_INTERNAL_HEALTH_PORT=9129 SC4S_ETC=/etc/syslog-ng SC4S_LISTEN_CHECKPOINT_SPLUNK_NOISE_CONTROL_SECONDS=30 SC4S_LISTEN_STATUS_PORT=9129 SC4S_LISTEN_DEFAULT_TCP_PORT=41514 SC4S_LISTEN_DEFAULT_UDP_PORT=42514 SC4S_LISTEN_DEFAULT_TLS_PORT=7514 SC4S_LISTEN_DEFAULT_RFC5426_PORT=41601 SC4S_LISTEN_DEFAULT_RFC6587_PORT=42601 SC4S_LISTEN_DEFAULT_RFC5425_PORT=7425 SC4S_HEALTH_CHECK_ENABLE=true SC4S_DEST_SPLUNK_HEC_BATCH_SIZE=1 SC4S_DEST_SPLUNK_HEC_RETRY_LIMIT=1 SC4S_DEST_SPLUNK_HEC_RETRY_INTERVAL=5 SOURCE_ALL_SET=DEFAULT_TCP,DEFAULT_UDP # SC4S_SEND_METRICS_TERMINAL=no SC4S_DEBUG=false SC4S_LOG_LEVEL=false SC4S_DEFAULT_TIMEZONE=Europe/Berlin PYTHONPATH=/var/lib/python-venv/lib/python3.12/site-packages:/etc/syslog-ng/python:/etc/syslog-ng/pylib # Tunning settings SC4S_DEST_SPLUNK_HEC_TIME_REOPEN=30 SC4S_DEST_SPLUNK_HEC_BATCH_LINES=100 SC4S_DEST_SPLUNK_HEC_BATCH_TIMEOUT=5000 SC4S_DEST_SPLUNK_HEC_KEEPALIVE=yes SC4S_DEST_SPLUNK_HEC_WORKERS=8 SC4S_DEST_SPLUNK_HEC_DISKBUFF_ENABLE=yes SC4S_DEST_SPLUNK_HEC_DISKBUFF_RELIABLE=yes SC4S_DEST_SPLUNK_HEC_DISKBUFF_MEMBUFLENGTH=10000 SC4S_DEST_SPLUNK_HEC_DISKBUFF_DISKBUFSIZE=200000000 ... View more

no it is not busy - it is getting basically a 400 error which means format if i take and only have the default destionation be d_hec_default or d_hec_other basically if i go only 2 one of the splunk HEC site it is fine.  It only gets the busy or format error on the second site if only the second site is configured so if i switch it whatever is the first site works and whatever is the second site doesnt work.  So no it is not busy or that it can not injest the logs it is sc4s doesnt seem to work well with multi destinations.  I am looking for help with someone that has done that. ... View more

same problem.  The index is correct # docker logs -f sc4s SC4S_ENV_CHECK_HEC: Splunk HEC connection test successful to index=sddc_internal for sourcetype=sc4s:fallback... SC4S_ENV_CHECK_HEC: Splunk HEC connection test successful to index=sddc_internal for sourcetype=sc4s:events... syslog-ng checking config sc4s version=3.34.1 Configuring the health check port to: 8080 [2025-01-21 13:54:30 +0000] [129] [INFO] Starting gunicorn 23.0.0 [2025-01-21 13:54:30 +0000] [129] [INFO] Listening at: http://0.0.0.0:8080 (129) [2025-01-21 13:54:30 +0000] [129] [INFO] Using worker: sync [2025-01-21 13:54:30 +0000] [138] [INFO] Booting worker with pid: 138 starting syslog-ng  no errors on startup but still these sc4s:events keep coming no idea what they are and the are annoying.  The index is correct. ... View more

It is clean at startup   SC4S_ENV_CHECK_HEC: Splunk HEC connection test successful to index=sddc_internal for sourcetype=sc4s:fallback... SC4S_ENV_CHECK_HEC: Splunk HEC connection test successful to index=sddc_internal for sourcetype=sc4s:events... syslog-ng checking config sc4s version=3.34.1 Configuring the health check port to: 8080 [2025-01-21 13:36:54 +0000] [135] [INFO] Starting gunicorn 23.0.0 [2025-01-21 13:36:54 +0000] [135] [INFO] Listening at: http://0.0.0.0:8080 (135) [2025-01-21 13:36:54 +0000] [135] [INFO] Using worker: sync [2025-01-21 13:36:54 +0000] [138] [INFO] Booting worker with pid: 138 starting syslog-ng ... View more

errors - - syslog-ng 149 - [meta sequenceId="100"]Server disconnected while preparing messages for sending, trying again; driver='d_hec_fmt_other#0', location='root generator dest_hec:5:5', worker_index='3', time_reopen='10', batch_size='2' host = dev-ipz001-splunk05 source = sc4s sourcetype = sc4s:events   1/21/25 2:41:42.705 PM   - - syslog-ng 149 - [meta sequenceId="100"]http: error sending HTTP request; url='https://somehost.com:3001/services/collector/event', error='Failed sending data to the peer', worker_index='3', driver='d_hec_fmt_other#0', location='root generator dest_hec:5:5' host = splunk05 source = sc4s sourcetype = sc4s:events ... View more

I am getting this all of the time and A the index exists and i can test it with curl and when sc4s starts it shows it is able to connect - it is annoying.  what else can i check it is not well documented. ... View more