Loading...

Knowledge Center


TCP connection error occurs on the Event Receiver
Technical Articles ID:   KB89041
Last Modified:  11/16/2018
Rated:


Environment

McAfee SIEM Event Receiver 9.5.x, 9.6.x, 10.x

Problem

​Syslog collector encounters the following error and then stops:
 
Jul 09 20:30:52 L_ERROR   24461|pthread_create failure, error: [12][Cannot allocate memory] at [tcp.c:1003 (tcp_server)]

Cause

The Event Receiver has too many TCP connections open and all available threads have been allocated. The current limit is 664 parent TCP connections to a single Event Receiver.

Solution

To correct this issue, do one of the following:
  • Reduce the number of TCP connections to the Event Receiver to a number below 664.
  • Change the protocol being used. Change from TCP to UDP. 
  • Enable all client data sources with the same parent to share the same thread.

Rate this document

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.