I send logs to logstash using input syslog tcp. I can not overcome the EPS limit for one TCP session (2500 eps). Each TCP session provides a linear increase in EPS. The load on the processor is minimal, the sysctl settings do not help. Is it possible to increase the rate for one tcp session? Maybe java options?
Something (java) uses 100% of one processor core. other processor cores are not loaded. Maybe there are problems with multithreading on input? I use input tcp or input syslog + codec cef. Without codec, the rate increases, but does not solve the problem.
Any ideas?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.