Templates seem to be worker specific...
robcowart opened this issue · 4 comments
I was comparing a few different environments and noticed issues with the 4.1.x versions of the codec. The number of flows was only a few/sec, and netstat showed no UDP packet loss so that was not the issue.
The 4.1.x instances were producing significantly fewer flows than the 4.0.x and earlier instances. The logs of the 4.1.x instances also always showed Can't (yet) decode flowset id... messages although some flows of the indicated flowset ids did make it through.
It is as if the UDP input worker that first processed the template had access to it, but no other workers do. So some flows are decoded and passed to the pipeline, and the others are always dropped.
Installing v4.0.2 of the codec fixes the problem and works fine, and was confirmed in multiple environments. I think it may have been e9575ef which introduced the issue.
To test this make sure to use multiple UDP input workers.
@robcowart I've identified the issue and created a PR to address (#160).
This was my fault. In refactoring the template registry into its own class, I failed to pass the @ttl of the TemplateRegistry through to the volatile hashes that stored the templates, allowing the Vash default of 60s to win.
Ok merged in master.
Release will follow when I have some more time.
@jorritfolmer I created a PR to bump the version and edit the changelog, let me know if this is ok with your standards #161
Yep, thanks! I've just pushed the 4.1.2 gem to rubygems