mirror of
https://github.com/zeek/zeek.git
synced 2025-10-05 08:08:19 +00:00
effeaa5b13
Under remote communication overload conditions, the child->parent chunked IO may start rejecting chunks if over the hard cap. Some messages are made of two chunks, accepting the first part, but rejecting the second can put the parent in a bad state and the next two chunks it reads are likely to cause the error. This patch just removes the rejecting functionality completely and so now relies solely on shutting down remote peer connections to help alleviate temporary overload conditions. The "chunked_io_buffer_soft_cap" script variable can now tune when this shutting down starts happening and the default setting is now double what it used to be. For constant overload conditions, communication.log should keep stating "queue to parent filling up; shutting down heaviest connection". An alternative to completely removing the hard cap rejection code could be ensuring that messages that involve a pair of chunks can never have the second chunk be rejected when attempting to write it. Addresses BIT-1376 |
||
|---|---|---|
| .. | ||
| files | ||
| frameworks | ||
| misc | ||
| protocols | ||
| utils | ||
| init-bare.bro | ||
| init-default.bro | ||