How to increase maximum socket receive buffer size

Graylog will generate a warning to inform you that socket receive buffer size (SO_RCVBUF) should be increased.

[[email protected] ~]$ tail -f /var/log/graylog-server/server.log
2020-04-12T12:29:48.540Z INFO  [NetworkListener] Started listener bound to [192.0.2.11:9000]
2020-04-12T12:29:48.542Z INFO  [HttpServer] [HttpServer] Started.
2020-04-12T12:29:48.542Z INFO  [JerseyService] Started REST API at <192.0.2.11:9000>
2020-04-12T12:29:48.543Z INFO  [ServiceManagerListener] Services are healthy
2020-04-12T12:29:48.544Z INFO  [ServerBootstrap] Services started, startup times in ms: {InputSetupService [RUNNING]=3, EtagService [RUNNING]=73, ConfigurationEtagService [RUNNING]=73, OutputSetupService [RUNNING]=73, JobSchedulerService [RUNNING]=73, GracefulShutdownService [RUNNING]=94, JournalReader [RUNNING]=95, UrlWhitelistService [RUNNING]=127, KafkaJournal [RUNNING]=143, MongoDBProcessingStatusRecorderService [RUNNING]=147, PeriodicalsService [RUNNING]=147, BufferSynchronizerService [RUNNING]=160, LookupTableService [RUNNING]=184, StreamCacheService [RUNNING]=420, JerseyService [RUNNING]=27175}
2020-04-12T09:29:48.546Z INFO  [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD]
to Running [LB:ALIVE]
2020-04-12T12:29:48.548Z INFO  [ServerBootstrap] Graylog server up and running.
2020-04-12T12:29:48.567Z INFO  [InputStateListener] Input [Beats/5cfe0aeaec88901911304649] is now STARTING
2020-04-12T12:29:48.864Z INFO  [InputStateListener] Input [Beats/5cfe0aeaec88901911304649] is now RUNNING
2020-04-12T12:29:48.890Z WARN  [AbstractTcpTransport] receiveBufferSize (SO_RCVBUF) for input Beats2Input{title=Filebeat, type=org.graylog.plugins.beats.Beats2Input, nodeId=null} (channel [id: 0x0dd4a4b0, L:/0:0:0:0:0:0:0:0%0:5044]) should be 1048576 but is 425984.
[...]

Inspect tcp manual page.

The maximum sizes for socket buffers declared via the SO_SNDBUF and SO_RCVBUF mechanisms are limited by the values in the /proc/sys/net/core/rmem_max and /proc/sys/net/core/wmem_max files.  Note that TCP actually allocates twice the size of the buffer  requested
in  the  setsockopt(2)  call,  and  so a succeeding getsockopt(2) call will not return the same size of buffer as requested in the setsockopt(2) call.  TCP uses the extra space for administrative purposes and internal kernel structures, and the /proc file values
reflect the larger sizes compared to the actual TCP windows.  On individual connections, the socket buffer size must be set prior to the listen(2) or connect(2) calls in order to have it take effect.  See socket(7) for more information.
tcp(7) manual page

Inspect maximum socket buffer size for SO_RCVBUF (receive, rmem_max) and SO_SNDBUF (send, wmem_max).

[[email protected] ~]$ sysctl --all --pattern "net.core.[rw]mem_max"
net.core.rmem_max = 212992
net.core.wmem_max = 212992

Update maximum socket receive buffer size.

[[email protected] ~]$ sudo sysctl --write net.core.rmem_max=524288
net.core.rmem_max = 524288

Restart graylog-server service.

[[email protected] ~]$ systemctl restart graylog-server

Inspect Graylog log file on master node.

[[email protected] ~]$ tail -f /var/log/graylog-server/server.log
2020-04-12T14:38:55.087Z INFO  [NetworkListener] Started listener bound to [192.0.2.11:9000]
2020-04-12T14:38:55.089Z INFO  [HttpServer] [HttpServer] Started.
2020-04-12T14:38:55.089Z INFO  [JerseyService] Started REST API at <192.0.2.11:9000>
2020-04-12T14:38:55.091Z INFO  [ServiceManagerListener] Services are healthy
2020-04-12T14:38:55.094Z INFO  [ServerBootstrap] Services started, startup times in ms: {InputSetupService [RUNNING]=6, ConfigurationEtagService [RUNNING]=56, BufferSynchronizerService [RUNNING]=56, OutputSetupService [RUNNING]=56, EtagService [RUNNING]=56, JobSchedulerService [RUNNING]=56, KafkaJournal [RUNNING]=58, JournalReader [RUNNING]=58, UrlWhitelistService [RUNNING]=59, GracefulShutdownService [RUNNING]=60, PeriodicalsService [RUNNING]=61, MongoDBProcessingStatusRecorderService [RUNNING]=121, LookupTableService [RUNNING]=155, StreamCacheService [RUNNING]=416, JerseyService [RUNNING]=27308}
2020-04-12T14:38:55.098Z INFO  [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Running [LB:ALIVE]
2020-04-12T14:38:55.111Z INFO  [ServerBootstrap] Graylog server up and running.
2020-04-12T14:38:55.149Z INFO  [InputStateListener] Input [Beats/5cfe0aeaec88901911304649] is now STARTING
2020-04-12T14:38:55.352Z INFO  [InputStateListener] Input [Beats/5cfe0aeaec88901911304649] is now RUNNING

Do not forget to create persistent sysctl configuration on every master node.