Event pipeline dropped connections

Explanation

A TCP-based protocol dropped an established connection to the system.

The number of connections that can be established by TCP-based protocols is limited to ensure that connections are established and events are forwarded. The event collection service (ECS) allows a maximum of 15,000 file handles and each TCP connection uses three file handles.

TCP protocols that provide drop connection notifications include the following protocols:

• TCP syslog protocol
• TLS syslog protocol
• TCP multi-line protocol

User response

Review the following options:

• Distribute events to more appliances. Connections to other event and flow processors distribute the work load from the console.
• Configure low priority TCP log source events to use the UDP network protocol.
• Tune the system to reduce the volume of events and flows that enter the event pipeline.