Timeout Connection are not being monitored by packetbeat

Elastic Stack Beats
1

I have noticed one more issue where packetbeat is not sending data for connection timeouts on nginx running on application servers. So whenever there is any 504 on nginx logs there is no corresponding log in packetbeats.

Is that mean packetbeat is not catering connection timeouts ??

Every other http response code looks like working fine but looks like all 50X response codes got some monitoring problem.

Thanks,
Suraj

2

Hi @5uraj, how many seconds is the timeout period for your Nginx server?

3

I have 60 seconds timeout on nginx and then proxy_pass timeout is 30 seconds.

4

Timeout requests are giving me :

WARN Response from unknown transaction. Ignoring: TcpTuple src[X.0.X.X:80] dst[X.0.X.X:59509] stream_id[14]

Looks like we are ignoring those connections which are NOT getting closed properly with FIN/ACK.

5

The issue is that after 10 seconds Packetbeat stops tracking the state of a transaction. The transaction timeout is not currently configurable. I will open an issue on Github for making the timeout configurable.

6

Where can I change in code itself and re-build for now, till the time we make it configurable.

7

Got it, changed DefaultTransactionExpiration variable, It really helps.
Looking forward to make it configurable per protocol basis.

1 Like
8

Glad to hear you were able to change the timeout and that it is working. I created the following issue to track this enhancement: