SO_RCVBUF error for one input

Graylog Central (peer support)
1

Hello,
I know this question is not new for this forum, but i can’t fix it in my case.
Have a graylog instance in docker, launched via docker-compose.
Have a two netflow adapter from different cisco.
And after update to graylog 4 one of this adapter drop many event and send error:

| 2020-11-26 09:24:33,931 WARN : org.graylog2.inputs.transports.UdpTransport - receiveBufferSize (SO_RCVBUF) for input NetFlowUdpInput{title=Cisco SPB Netflow, type=org.graylog.plugins.netflow.inputs.NetFlowUdpInput, nodeId=998dccaf-8d52-4782-8294-2b4a9b160ea6} (channel [id: 0x7e47f7ca, L:/0.0.0.0:9999]) should be 262144 but is 524288.

I am doing sysctl -w net.core.wmem_max=262144 on host machine - nothing new.

I Know that from the docker. But why with only one input and before update all input work fine.

May be you have any solution?

2

The most interesting thing is that some of the logs still come in. But these are a few percent.

3

This doesn’t seem a real issue, but just a warning.
Try to check more things, like CPU, drop counters on NIC and so on

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.