# Port drop statistics

**URL:** <https://discuss.elastic.co/t/port-drop-statistics/138239>\
**Category:** Logstash\
**Created:** [July 2, 2018, 3:10pm UTC](https://discuss.elastic.co/t/port-drop-statistics/138239 "2018-07-02T15:10:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![blueren](https://avatars.discourse-cdn.com/v4/letter/b/ecae2f/32.png) [@blueren](https://discuss.elastic.co/u/blueren)\
**Post date:** [July 2, 2018, 3:10pm UTC](https://discuss.elastic.co/t/port-drop-statistics/138239/1 "2018-07-02T15:10:14Z")

</div>

Hello,

I'm currently using netflow plugin in my ELK stack. I was wondering if there is any way to figure out how many packets are being dropped when feeding netflow data to the 2055 port of logstash.

Thanks

---

<div class="post-metadata">

**Author:** ![Dheeraj\_Gupta](https://avatars.discourse-cdn.com/v4/letter/d/49beb7/32.png) [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\
**Post date:** [July 3, 2018, 6:22am UTC](https://discuss.elastic.co/t/port-drop-statistics/138239/2 "2018-07-03T06:22:48Z")

</div>

This can be monitored at OS level. The file `/proc/net/udp` keeps track of current connections and drops, you can watch it to get the cumulative number of drops.  
You can also see the size of recv-q and send-q using the command `netstat -nau`

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [July 3, 2018, 9:37am UTC](https://discuss.elastic.co/t/port-drop-statistics/138239/3 "2018-07-03T09:37:09Z")

</div>

Use `netstat -su`. You will get an output like this...

```auto
IcmpMsg:
    InType3: 148757
    OutType3: 546191
Udp:
    9365593 packets received
    9902 packets to unknown port received.
    1569 packet receive errors
    314418 packets sent
    1569 receive buffer errors
    0 send buffer errors
UdpLite:
IpExt:
    InOctets: 44163894429
    OutOctets: 45634974117
    InNoECTPkts: 151561037

```

You will see that this system has dropped `1569` of `9365593` UDP packets due to receive buffer errors (usually because the buffer is full), which is 0.02% packet loss.

Irregardless of how much tuning you do, you should not expect to achieve 0% packet loss. That will be almost impossible. However there are things that can be done to minimize it, including Linux kernel parameter tuning and Logstash tuning. This is especially important when using the Logstash Netflow or sFlow codecs, as much more processing is handled in the input, than with simple log data.

A few months ago I helped a customer go from 85% packet loss, with out-of-the-box Linux and Logstash, to 0.05%. So there is a lot of opportunity to improve on the defaults.

Rob

---

<div class="post-metadata">

**Author:** ![blueren](https://avatars.discourse-cdn.com/v4/letter/b/ecae2f/32.png) [@blueren](https://discuss.elastic.co/u/blueren)\
**Post date:** [July 3, 2018, 1:54pm UTC](https://discuss.elastic.co/t/port-drop-statistics/138239/4 "2018-07-03T13:54:29Z")

</div>

Thanks Rob and Dheeraj!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 31, 2018, 1:54pm UTC](https://discuss.elastic.co/t/port-drop-statistics/138239/5 "2018-07-31T13:54:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.