<div dir="auto">Syslog-ng doesnt expect data on the socket on the reverse direction and shuts down the connection if anything is received.<div dir="auto"><br></div><div dir="auto">It is meant to work with /dev/log like devices.</div><div dir="auto"><br></div><div dir="auto">I was wondering if it's correct to ignore the reverse direction, is it?</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Apr 12, 2017 2:34 PM, "Jim Hendrick" <<a href="mailto:james.r.hendrick@gmail.com">james.r.hendrick@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Do you have access to the sourcode of otherapp ?<div><br></div><div>My first guess would be to look at the options of how each end handles the socket.</div><div><br></div><div>Jim</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Apr 12, 2017 at 7:21 AM, Fabien Wernli <span dir="ltr"><<a href="mailto:wernli@in2p3.fr" target="_blank">wernli@in2p3.fr</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
I'm trying to use the unix-stream destination to send data to another<br>
application which opens the socket in line mode. The problem is that both<br>
ends complain about the connection breaking all the time:<br>
<br>
    syslog-ng[31002]: Syslog connection broken; fd='24', server='AF_UNIX(/var/run/other<wbr>app.sock)', time_reopen='60'<br>
    otherapp[123445]: failed to read from socket #10: Connection reset by peer<br>
<br>
I tracked down the problem to the fact that otherapp sends some data after receiving a line from syslog-ng: "data ok", and syslog-ng doesn't seem to like that.<br>
<br>
If I set up a unidirectional proxy (that filters out upstream "data ok") between syslog-ng and otherapp everything works fine:<br>
<br>
    socat -u UNIX-LISTEN:/tmp/proxy.sock,fo<wbr>rk UNIX-CONNECT:/var/run/otherapp<wbr>.sock<br>
<br>
Am I doing something wrong here, or is this a known limitation of syslog-ng?<br>
<br>
______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailm<wbr>an/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support<wbr>/documentation/?product=<wbr>syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/sy<wbr>slog-ng-faq</a><br>
<br>
</blockquote></div><br></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div></div>