Event pipeline dropped connections
38750061 - Connections were dropped by the event pipeline.
Explanation
A TCP-based protocol dropped an established connection to the system.
The number of connections that can be established by TCP-based protocols is limited to ensure that connections are established and events are forwarded. The event collection service (ECS) allows a maximum of 15,000 file handles and each TCP connection uses three file handles.
TCP protocols that provide drop connection notifications include the following protocols:
- TCP syslog protocol
- TLS syslog protocol
- TCP multi-line protocol
User response
Review the following options:
- Distribute events to more appliances. Connections to other event and flow processors distribute the work load from the console.
- Configure low priority TCP log source events to use the UDP network protocol.
- Tune the system to reduce the volume of events and flows that enter the event pipeline.