Fluentbit creates TCP connections

user_353379 0
Viewed 157

Fluentbit creates TCP connections to itself?

What are these used for?

fluent.conf file:

[SERVICE]
    Flush       5
    Daemon      Off
    Log_Level   debug
    
[INPUT]
    Name    tail
    Tag     format.logging
    path    C:\Logs\*main.log
    DB      C:\Logs\main_logs.db

[OUTPUT]
    Name    stdout
    Match   *

enter image description here

fluent-bit windows
1 Answers

This seems to boil down to an implementation detail where it uses unix sockets on Linux for its event loop, but on Windows it has opted to using localhost-connections.

Comment from https://github.com/fluent/fluent-bit/blob/37aa680d32384c1179f02ee08a5bef4cd278513e/lib/monkey/mk_core/deps/libevent/include/event2/util.h#L380

/** Create two new sockets that are connected to each other.
    On Unix, this simply calls socketpair().  On Windows, it uses the
    loopback network interface on 127.0.0.1, and only
    AF_INET,SOCK_STREAM are supported.
    (This may fail on some Windows hosts where firewall software has cleverly
    decided to keep 127.0.0.1 from talking to itself.)
    Parameters and return values are as for socketpair()
*/

The actual implementation is here: https://github.com/fluent/fluent-bit/blob/37aa680d32384c1179f02ee08a5bef4cd278513e/lib/monkey/mk_core/deps/libevent/evutil.c#L207

It matches the pattern when looking at the netstat output:

netstat -anop tcp | findstr <fluentbit pid>
  TCP    127.0.0.1:54645        127.0.0.1:54646        ESTABLISHED     12012  \
  TCP    127.0.0.1:54646        127.0.0.1:54645        ESTABLISHED     12012  ´` Pair

  TCP    127.0.0.1:54647        127.0.0.1:54648        ESTABLISHED     12012  \
  TCP    127.0.0.1:54648        127.0.0.1:54647        ESTABLISHED     12012  ´` Pair
user_165905390
Related