GELF HTTP input issue after upgrading to 3.0

[pszafer (Pawel)]

Hi,
I have simple gelf http input source.
I’m sending logs from my webapp.
Since update during startup I have warning

2019-03-12T17:31:00.524+01:00 WARN  [AbstractTcpTransport] receiveBufferSize (SO_RCVBUF) for input GELFHttpInput{title=GELF WEBAPP, type=org.graylog2.inputs.gelf.http.GELFHttpInput, nodeId=null} (channel [id: 0xd06aa0e0, L:/0:0:0:0:0:0:0:0%0:9991]) should be 1048576 but is 2097152.

2097152 buffer is bigger than requested 1048576, so java cannot ask for smaller buffer?

And the real issue.
After sending 2 logs I got timeout errors:

2019-03-12T17:50:42.515+01:00 ERROR [AbstractTcpTransport] Error in Input [GELF HTTP/5a7d4219b70ddc07b378a9a7] (channel [id: 0x0fc9b4e9, L:/GRAYLOG_IP:9991 ! R:/APP_IP:51406]) (cause io.netty.handler.timeout.ReadTimeoutException)

Any idea?

[limeman38 (Nick Clark)]

@pszafer

should be 1048576 but is 2097152

Your first issues can be fixed by the following command:

sysctl -w net.core.rmem_max=262144

Your second issue can you go into input menu and make sure your TCP transport input is set to be the node for the indexer by choosing “Edit input” under the input you are having issue with. My upgrade I had an issue where it was not looking at the correct indexer once I did that I could start the input.

Let me know how you make out.

[pszafer (Pawel)]

@limeman38

sysctl -w net.core.rmem_max=262144

I had it set before and Warning still occurs. But will try once again tomorrow to be sure.

Second issue. My input is working, it is global.

Rest of window is

• Enable cors: true
• Max HTTP chunk size: 65536
• Idle writer timeout: 60
• Decompressed size limit: 8388608

I tried to increase idle writer timeout to 90 but without luck.

[igor.krug]

I have the same problem. Timeout at every 2 messages.
For me even the messages that timeout are logged, is it the same for you or do you miss messages?

Gelf Http input ReadTimeoutException

Hello, I’m running graylog v3.0.0 and receiving messages on a HTTP Gelf input. The messages are logged and I can find them in the search. My problem is that for every second message the connection hangs and then timeouts with the following error: ERROR [AbstractTcpTransport] Error in Input [GELF HTTP/5c73e434bc55cd3c3cad525c] (channel [id: 0xb89ad20a, L:/INTERNAL_IP:12201 ! R:/INTERNAL_IP:53490]) (cause io.netty.hanler.timeout.ReadTimeoutException) Even with the error, the message is still …

[jan (Jan Doberstein)]

fix is on the way and will be included in 3.0.1

FIX: https://github.com/Graylog2/graylog2-server/pull/5728
ISSUE: https://github.com/Graylog2/graylog2-server/issues/5720

[pszafer (Pawel)]

I miss messages as from my app side I have http timeout error.