Graylog buffer_size warning

Graylog Central (peer support)
1

Hi all,
I am receiving the below message. From OS site values are changed.
The server is based on baremetal. I dont have any addiitonal errors, log files and inputs are working fine.
I would like to have some help if issue already someone of you had. Below the error.

WARN [UdpTransport] receiveBufferSize (SO_RCVBUF) for input SyslogUDPInput{title=INPUT-TEST, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=daceb98b-5db7-4cb7-96ff-51f7dbc16259} (channel [id: 0x4b463605, L:/5514]) should be 1048576 but is 2097152.

The type is as above SYSLOG UDP and port forwarded to 5514

every time I change the values in Graylog GUI input always is showing in the log the double value.

Thank you

2

FYI I get the same thing - I have ignored and it hasn’t caused any issues that I am aware of.

3

you should investigate about the UDP Buffers on your OS, check what size the packages are you send via UDP …

It might be that you loose a messages, but that is given by design. Switch to TCP and check if you have now messages you did not have seen before.

4

I don’t seem to be missing any data, these were configured via the UI, and it seems whatever value I put in doesn’t change it.


2019-07-05T15:42:05.240+10:00 WARN  [AbstractTcpTransport] receiveBufferSize (SO_RCVBUF) for input Beats2Input{title=input_filebeat, type=org.graylog.plugins.beats.Beats2Input, nodeId=2daee9c2-cb96-40c5-a8d3-948c809c3472} (channel [id: 0x56091d20, L:/0:0:0:0:0:0:0:0%0:5000]) should be 4194303 but is 425984.
2019-07-05T15:42:05.240+10:00 WARN  [AbstractTcpTransport] receiveBufferSize (SO_RCVBUF) for input GELFTCPInput{title=EOP, type=org.graylog2.inputs.gelf.tcp.GELFTCPInput, nodeId=null} (channel [id: 0xa4399505, L:/0:0:0:0:0:0:0:0%0:5001]) should be 1048576 but is 425984.

OS is Centos7 - I’ll do some research on how to configure/look up those.

5

Hi thanks for your reply. I dont have any lost of packages either TCP/UDP.
Same packets arrival compared to tcpdump

6

Thanks lindonm for your reply.

7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.