Idle Connection Timeout Configuration

[williamb1024]

Is there a means by which to adjust the Idle Connection timeout that is being used with Http.sys when Seq is running on a Windows Server host? It seems that this value is being configured to 5 seconds, overriding the default Http.sys 120 seconds value.

A little bit of background:

I have about 500 Windows Server 2016 hosts running Seq Forwarder, all of which forward their buffered events and diagnostics logs to a single Seq instance. The target Seq instance is also running on Windows Server 2016.

Frequently, the Seq Forwarder instances are logging "HTTP request failed when sending a batch from the log shipper" events. These events all appear to be the result of a 10054 socket error (WSAECONNRESET), indicating that HTTP.sys on the Seq instance likely reset the connection. The Seq Forwarder instances all have a direct path to the Seq instance, no proxy or other software fiddling with the connections.

In an attempt to determine a possible cause for the connection reset, I searched through the HTTPERR log files. All recorded log entries indicated connections were closed due to the Timer_ConnectionIdle reason. This lead to noticing the Idle Timeout configuration for Seq is 5 seconds rather than the default 120 seconds.

My current theory is that these events are the result of a race condition between the idle connection timeout and the next batch of events to be sent from the forwarder instance. I suspect that an attempt to write to the socket is occurring prior to the HttpClient code being able to process the notification that the existing socket connection state has changed.

I believe that a longer idle connection timeout would likely decrease the frequency at which this condition occurs -and- not be counterproductive given that I expect the connections to be reused consistently.