HttpEventCollectorSender creates thousands of sockets under load

[maxiptah]

I am using your package with HttpEventCollectorTraceListener in order to send logs to Splunk from an Azure app. There are bursts in logs where thousands of messages are sent in a couple of minutes. It looks like HttpClient inside HttpEventCollectorSender is not reusing open sockets and number of sockets in TIME_WAIT is increasing rapidly. After 2 minutes the app runs out of sockets (see screenshot).

Can you please comment on this behavior? Is this expected? I'm aware that it's normal for a socket to stay in TIME_WAIT, but why new sockets are being opened? Cannot the HttpEventCollectorSender just push messages on one/several sockets that are always open?

I've tried to feed a SocketsHttpHandler into HttpEventCollectorSender with pooled connection settings, but to no avail.

[shakeelmohamed]

Hi @maxiptah,

This seems like a valid issue, thanks for bringing it to our attention.
We're open to a PR if you're interested in getting this resolved sooner

[stojan00]

I saw this issue as well it is because the HttpEventCollectorSender continually news up HttpClient() instances. A known longstanding issue with HttpClient is that each instance will take up a socket which will rapidly lead to running out of sockets when under heavy load. The solution would be to make the HttpClient static and not dispose of it.