Kernel: TCP: time wait bucket table overflow problem, bucketoverflow

Kernel: TCP: time wait bucket table overflow problem, bucketoverflow
Kernel: TCP: time wait bucket table overflow

Recently, elk was used to collect system logs and many Kernel errors were reported on some machines.
Most of the online arguments are to increase the Kernel Parameter net. ipv4.tcp _ max_tw_buckets. But I didn't say how it works.

I thought about it. In fact, tw_buckets means that the table of time wait bucket table is full.
Why is it full?

Netstat-an | more

View the time_out Link
It is generally caused by port 80, which is the web server, so it is natural to think of keepalived.

My practice is to turn keepalived off, and then adjust the value of tcp_max_tw_buckets to 2 w. Then, observe that this alarm is basically absent.

In particular, some clusters need to forward backend services. I personally think it is best to disable keepalive so that fewer connections will be maintained.