SO_RCVBUF error for one input

I know this question is not new for this forum, but i can’t fix it in my case.
Have a graylog instance in docker, launched via docker-compose.
Have a two netflow adapter from different cisco.
And after update to graylog 4 one of this adapter drop many event and send error:

| 2020-11-26 09:24:33,931 WARN : org.graylog2.inputs.transports.UdpTransport - receiveBufferSize (SO_RCVBUF) for input NetFlowUdpInput{title=Cisco SPB Netflow, type=org.graylog.plugins.netflow.inputs.NetFlowUdpInput, nodeId=998dccaf-8d52-4782-8294-2b4a9b160ea6} (channel [id: 0x7e47f7ca, L:/]) should be 262144 but is 524288.

I am doing sysctl -w net.core.wmem_max=262144 on host machine - nothing new.

I Know that from the docker. But why with only one input and before update all input work fine.

May be you have any solution?

The most interesting thing is that some of the logs still come in. But these are a few percent.

This doesn’t seem a real issue, but just a warning.
Try to check more things, like CPU, drop counters on NIC and so on

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.