GELF HTTP input issue after upgrading to 3.0

Hi,
I have simple gelf http input source.
I’m sending logs from my webapp.
Since update during startup I have warning

2019-03-12T17:31:00.524+01:00 WARN  [AbstractTcpTransport] receiveBufferSize (SO_RCVBUF) for input GELFHttpInput{title=GELF WEBAPP, type=org.graylog2.inputs.gelf.http.GELFHttpInput, nodeId=null} (channel [id: 0xd06aa0e0, L:/0:0:0:0:0:0:0:0%0:9991]) should be 1048576 but is 2097152.

2097152 buffer is bigger than requested 1048576, so java cannot ask for smaller buffer?

And the real issue.
After sending 2 logs I got timeout errors:

2019-03-12T17:50:42.515+01:00 ERROR [AbstractTcpTransport] Error in Input [GELF HTTP/5a7d4219b70ddc07b378a9a7] (channel [id: 0x0fc9b4e9, L:/GRAYLOG_IP:9991 ! R:/APP_IP:51406]) (cause io.netty.handler.timeout.ReadTimeoutException)

Any idea?

Your first issues can be fixed by the following command:

sysctl -w net.core.rmem_max=262144

Your second issue can you go into input menu and make sure your TCP transport input is set to be the node for the indexer by choosing “Edit input” under the input you are having issue with. My upgrade I had an issue where it was not looking at the correct indexer once I did that I could start the input.

Let me know how you make out.

1 Like

I had it set before and Warning still occurs. But will try once again tomorrow to be sure.

Second issue. My input is working, it is global.


Rest of window is

  • Enable cors: true
  • Max HTTP chunk size: 65536
  • Idle writer timeout: 60
  • Decompressed size limit: 8388608

I tried to increase idle writer timeout to 90 but without luck.

I have the same problem. Timeout at every 2 messages.
For me even the messages that timeout are logged, is it the same for you or do you miss messages?

fix is on the way and will be included in 3.0.1

FIX: https://github.com/Graylog2/graylog2-server/pull/5728
ISSUE: https://github.com/Graylog2/graylog2-server/issues/5720

1 Like

I miss messages as from my app side I have http timeout error.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.