Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!
1. Describe your incident:
Despite system configuration Graylog is unable to set a UDP buffer size bigger than 65536.
The system is configured for a UDP buffer size of 1048576 bytes.
Checked with a silly C program that does a socket(), setsockopt(), getsockopt().
% sysctl net.inet.udp.recvspace
net.inet.udp.recvspace: 1048576
./checkbuf 262144
SO_RCVBUF: requested: 262144, actual: 262144
./checkbuf 1048576
SO_RCVBUF: requested: 1048576, actual: 1048576
Fails as expected then exceeding UDP buffer size.
.
/checkbuf 2048576
setsockopt(): No buffer space available
I am not sure whether this is a limitation on OpenJDK 17, OpenJDK 17 on FreeBSD, netty or Graylog.
2. Describe your environment:
-
OS Information: FreeBSD 14.1 (amd64)
-
Package Version: Graylog 6.0.1
-
Service logs, configurations, and environment variables:
2024-06-14 10:50:21,533 WARN o.g.i.t.UdpTransport [netty-transport-0] receiveBufferSize (SO_RCVBUF) for input SyslogUDPInput{title=DNS syslog, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=XXXXXXX} (channel [id: 0x1bc943a9, L:/10.0.0.1:1312]) should be >= 1048576 but is 65536.
3. What steps have you already taken to try and solve the problem?
I have made sure the system is properly configured.
4. How can the community help?
If you are seeing these warnings on the logfile, check that your buffer size is properly configured using the attached program.
---- Check program, checkbuf.c
/*
* checkbuf.c
* Verifies UDP buffer size
*/
#include <stdio.h>
#include <stdlib.h>
#include <stddef.h>
#include <sys/types.h>
#include <sys/socket.h>
int main(int argc, char **argv)
{
int s, r;
unsigned int bufsiz, actual_bufsiz, len;
if ( argc < 2 ) {
fprintf(stderr, "Uso: %s buffer\n", argv[0]);
exit(1);
}
bufsiz = atoi(argv[1]);
s = socket(PF_INET, SOCK_DGRAM, 0);
if ( s < 0 ) {
perror("socket()");
exit(1);
}
r = setsockopt(s, SOL_SOCKET, SO_RCVBUF, &bufsiz, sizeof(bufsiz));
if ( r < 0 ) {
perror("setsockopt()");
exit(1);
}
/* Now verify */
len = sizeof(actual_bufsiz);
r = getsockopt(s, SOL_SOCKET, SO_RCVBUF, &actual_bufsiz, &len);
if ( r < 0 ) {
perror("getsockopt()");
exit(1);
}
printf("SO_RCVBUF: requested: %d, actual: %d\n", bufsiz, actual_bufsiz);
exit(0);
}
