uberAgent

Reuse of Open HTTP Connections

July 22, 2024

Contributed by:

This article explains how the uberAgent endpoint agent handles open HTTP connections.

Where HTTP is Used

uberAgent makes use of HTTP(S) to send the collected data from the endpoint to some types of backends, for example, Splunk HEC, Elasticsearch, or Apache Kafka (via Confluent REST Proxy).

HTTP Connection Reuse

All HTTP(S) communication initiated by uberAgent is performed through libcurl (a variant of curl), which is probably the highest-quality networking library available today.

Libcurl automatically caches and reuses HTTP(S) connections. As the documentation states:

Reusing a connection instead of creating a new one offers significant benefits in speed and required resources.

Requirements for HTTP Connection Reuse

For an HTTP connection to be reused, both server and client must support and enable HTTP/1.1.

Splunk HTTP Event Collector (HEC)

In its default configuration, Splunk’s HTTP Event Collector (HEC) only enables HTTP/1.1 if the client sends a user agent string. uberAgent does that starting with version 6.0 beta 2.

We recommend configuring Splunk to always enable HTTP/1.1 for all versions of uberAgent by setting the following in the HEC’s inputs.conf file, located in $SPLUNK_HOME/etc/apps/splunk_httpinput/local:

[http]
forceHttp10 = never
<!--NeedCopy-->

Server Failover and Load-Balancing

uberAgent can be configured with multiple servers per receiver. When there is more than one server per receiver, uberAgent randomly switches between servers every 100 seconds. If a server does not respond, uberAgent fails over to the next server in the list. This algorithm ensures that the load is distributed evenly between backend servers.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Reuse of Open HTTP Connections

July 22, 2024

Contributed by:

July 22, 2024

Contributed by:

Reuse of Open HTTP Connections

Where HTTP is Used

HTTP Connection Reuse

Requirements for HTTP Connection Reuse

Splunk HTTP Event Collector (HEC)

Server Failover and Load-Balancing

In this article