# sgadmin opens 14 tcp sessions with 50 ms. Please help.

**URL:** <https://forum.search-guard.com/t/sgadmin-opens-14-tcp-sessions-with-50-ms-please-help/850>\
**Category:** Search Guard\
**Created:** [March 30, 2018, 10:12pm UTC](https://forum.search-guard.com/t/sgadmin-opens-14-tcp-sessions-with-50-ms-please-help/850 "2018-03-30T22:12:15Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jala](https://avatars.discourse-cdn.com/v4/letter/j/cdc98d/32.png) [@jala](https://forum.search-guard.com/u/jala)\
**Post date:** [March 30, 2018, 10:12pm UTC](https://forum.search-guard.com/t/sgadmin-opens-14-tcp-sessions-with-50-ms-please-help/850/1 "2018-03-30T22:12:15Z")

</div>

Hello,

SG Version:search-guard-6-6.1.1-20.1.zip

ES version:6.1.1

1. 

sgadmin.sh opens like 14 TCP sessions within 50 milliseconds (Sends like 14 consecutive Hellos).

Other than pushing the given below config ymls, is there anything else sg\_admin does.?

sg\_action\_groups.yml sg\_config.yml sg\_internal\_users.yml sg\_roles.yml sg\_roles\_mapping.yml

1. 

We follow cert-based auth and hence my sg\_config.yml looks like this. Is there a way we can push the given below config dynamically?. Roles and users, we have the REST API interface. ([https://docs.search-guard.com/latest/rest-api.html](https://docs.search-guard.com/latest/rest-api.html)). If there is a way to dynamically configure the sg\_config.yml, I dont have to invoke sgadmin.sh to push the initial config is the idea. We have our own Java implementation and it is having trouble dealing with 14 consecutive Hellos.

# cat sg\_config.yml

searchguard:

dynamic:

authc:

clientcert\_auth\_domain:

http\_enabled: true

transport\_enabled: false

order: 1

http\_authenticator:

type: clientcert

config:

username\_attribute: cn #optional, if omitted DN becomes username

challenge: false

authentication\_backend:

type: noop

cat /elasticsearch/plugins/search-guard-6/tools/sgadmin.sh

#!/bin/bash

DIR=“$( cd “$( dirname “${BASH\_SOURCE[0]}” )” && pwd )”

BIN\_PATH=“java”

if [-z “$JAVA\_HOME”]; then

echo “WARNING: JAVA\_HOME not set, will use $(which $BIN\_PATH)”

else

BIN\_PATH=“$JAVA\_HOME/bin/java”

fi

“$BIN\_PATH” $JAVA\_OPTS -Dorg.apache.logging.log4j.simplelog.StatusLogger.level=OFF -cp “$DIR/../_:$DIR/../../../lib/_:$DIR/../deps/\*” com.floragunn.searchguard.tools.SearchGuardAdmin “$@”

thanks.

Jalaja

# netstat -atn | grep 9300 | grep TIME\_WAIT

tcp6 0 0 10.0.0.1:52212 10.0.0.1:9300 TIME\_WAIT

tcp6 0 0 10.0.0.1:52224 10.0.0.1:9300 TIME\_WAIT

tcp6 0 0 10.0.0.1:52210 10.0.0.1:9300 TIME\_WAIT

tcp6 0 0 10.0.0.1:52218 10.0.0.1:9300 TIME\_WAIT

tcp6 0 0 10.0.0.1:52204 10.0.0.1:9300 TIME\_WAIT

tcp6 0 0 10.0.0.1:52214 10.0.0.1:9300 TIME\_WAIT

tcp6 0 0 10.0.0.1:52202 10.0.0.1:9300 TIME\_WAIT

tcp6 0 0 10.0.0.1:52216 10.0.0.1:9300 TIME\_WAIT

tcp6 0 0 10.0.0.1:52222 10.0.0.1:9300 TIME\_WAIT

tcp6 0 0 10.0.0.1:52206 10.0.0.1:9300 TIME\_WAIT

tcp6 0 0 10.0.0.1:52220 10.0.0.1:9300 TIME\_WAIT

tcp6 0 0 10.0.0.1:52194 10.0.0.1:9300 TIME\_WAIT

tcp6 0 0 10.0.0.1:52200 10.0.0.1:9300 TIME\_WAIT

tcp6 0 0 10.0.0.1:52208 10.0.0.1:9300 TIME\_WAIT

When asking questions, please provide the following information:

- Search Guard and Elasticsearch version

- Installed and used enterprise modules, if any

- JVM version and operating system version

- Search Guard configuration files

- Elasticsearch log messages on debug level

- Other installed Elasticsearch or Kibana plugins, if any