<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Normally, there should be no restriction on the poll period, unless maybe if you are executing it in a busy loop. 4 times every minute should be fine.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Technically: every syslog-ng-ctl command runs in syslog-ng main loop. Therefore it is best to do jobs that do not do much thing to avoid holding up the main loop. None of the ctl commands take long in practice, but stats is one of those that has most things
to do, collecting all statistics. If you are runnig with stats-level(3)`, then there might be a lot of counters. Still it should not cause such problem.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
If you want to be more gentle with syslog-ng, and you are using recent enough version (it is available from 3.18), you can use syslog-ng-ctl show-license-info, which just returns a static text. It should be better option, if you just need a health check.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
So what else could go wrong? I suspect something starves the mainloop.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Just randomly guessing, but if you happen to have an older system, then you might be using an older ivykis version too. Syslog-ng uses ivykis for event loop. There was an ivykis bug, where timers registered with zero or negative timeout starved the other tasks.
I believe only ivykis below 0.39 was affected, but I can look this up properly if needed.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Other than that, there were deadlock bugs with patterndb, that was fixed recently. That or similar kind of things may mess things up.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Can you share more information of your system? Syslog-ng version, ivykis version, platform? Syslog-ng config? Any information about the network load? cpu consumption?<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
If you can create a minimal config example, that I could use to reproduce at my side, I can look further into this problem.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Br,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Antal<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Ahmed Soyef <Soyef.Ahmed34@homeoffice.gov.uk><br>
<b>Sent:</b> Tuesday, March 31, 2020 19:50<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> Re: [syslog-ng] Regular occurrences of Error writing control channel; error='Broken pipe (32)'</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
a:link, span.x_MsoHyperlink
{color:blue;
text-decoration:underline}
a:visited, span.x_MsoHyperlinkFollowed
{color:purple;
text-decoration:underline}
p.x_msonormal0, li.x_msonormal0, div.x_msonormal0
{margin-right:0cm;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
span.x_EmailStyle18
{font-family:"Calibri",sans-serif;
color:windowtext}
.x_MsoChpDefault
{font-family:"Calibri",sans-serif}
@page WordSection1
{margin:72.0pt 72.0pt 72.0pt 72.0pt}
div.x_WordSection1
{}
-->
</style>
<div lang="EN-GB" link="blue" vlink="purple">
<div style="background-color:#FFEB9C; width:100%; border-style:solid; border-color:#9C6500; border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:'Calibri'; color:Black; text-align:left">
<span style="color:#9C6500; font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div class="x_WordSection1">
<p class="x_MsoNormal"><span style="">Hi Bazis,</span></p>
<p class="x_MsoNormal"><span style=""> </span></p>
<p class="x_MsoNormal"><span style="">Thanks for your response. There is a Prometheus exporter that is polling the socket and we have a health check bash script running that polls the socket approximately 4 times every minute. I am trying to figure out how
often the Prometheus exporter polls the socket although is there a recommended number in terms of polling the socket?</span></p>
<p class="x_MsoNormal"><span style=""> </span></p>
<p class="x_MsoNormal"><span style="">Regards,</span></p>
<p class="x_MsoNormal"><span style=""> </span></p>
<p class="x_MsoNormal"><span style="">Soyef</span></p>
<p class="x_MsoNormal"><span style=""> </span></p>
<p class="x_MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> syslog-ng <syslog-ng-bounces@lists.balabit.hu>
<b>On Behalf Of </b>Balazs Scheidler<br>
<b>Sent:</b> 31 March 2020 18:47<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> Re: [syslog-ng] Regular occurrences of Error writing control channel; error='Broken pipe (32)'</span></p>
<p class="x_MsoNormal"> </p>
<div>
<div>
<p class="x_MsoNormal">Hi,</p>
</div>
<div>
<p class="x_MsoNormal"> </p>
</div>
<div>
<p class="x_MsoNormal">this means that the client connecting to the control socket /var/run/syslog-ng/syslog-ng.ctl (or similar, depending on your platform), so this client disconnected while syslog-ng was still writing its result.</p>
</div>
<div>
<p class="x_MsoNormal"> </p>
</div>
<div>
<p class="x_MsoNormal">syslog-ng-ctl uses blocking I/O to query this socket, so it shouldn't do this (unless it is killed by something on your system). is there anything else that polls the control socket?</p>
</div>
<div>
<p class="x_MsoNormal"> </p>
</div>
<div>
<p class="x_MsoNormal">Bazis</p>
</div>
</div>
<p class="x_MsoNormal"> </p>
<div>
<div>
<p class="x_MsoNormal">On Tue, Mar 31, 2020 at 3:58 PM Ahmed Soyef <<a href="mailto:Soyef.Ahmed34@homeoffice.gov.uk">Soyef.Ahmed34@homeoffice.gov.uk</a>> wrote:</p>
</div>
<blockquote style="border:none; border-left:solid #CCCCCC 1.0pt; padding:0cm 0cm 0cm 6.0pt; margin-left:4.8pt; margin-right:0cm">
<div>
<div>
<p class="x_MsoNormal" style="">Hi All,</p>
<p class="x_MsoNormal" style=""> </p>
<p class="x_MsoNormal" style="">We’ve been running syslog-ng and have recently started to see the above message in our logs. Sometimes running syslog-ng-ctl stats takes very long and results in similar error messages. Does anyone know why this may be the case?
Do these errors cause any issues with log flows through the syslog-ng service? Do they cause issues with recording of stats?</p>
<p class="x_MsoNormal" style=""> </p>
<p class="x_MsoNormal" style="">Kind regards,</p>
<p class="x_MsoNormal" style=""> </p>
<p class="x_MsoNormal" style="">Soyef</p>
</div>
<p class="x_MsoNormal">**********************************************************************<br>
This email and any files transmitted with it are private and intended<br>
solely for the use of the individual or entity to whom they are addressed.<br>
If you have received this email in error please return it to the address<br>
it came from telling them it is not for you and then delete it from your system.<br>
This email message has been swept for computer viruses.<br>
********************************************************************** </p>
</div>
<p class="x_MsoNormal" style="margin-bottom:12.0pt">______________________________________________________________________________<br>
Member info: <a href="https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Cantal.nemes%40oneidentity.com%7C4c44ed1fe757486fce6208d7d59bf609%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637212738152636925&sdata=qMFe2sP7qDyYSjwJVes3z38mVpN9PZDz7Gfp%2FC2SCeA%3D&reserved=0" originalsrc="https://lists.balabit.hu/mailman/listinfo/syslog-ng" shash="RyU53oqfyMc8mTJc0Hz4TXXYETmv1bZtd4U7mYcK0c+j0UTD+QwFEATeRYR8206KC5aLoOzcCMqZmswkdIpXmKvKu2kJR6iDGGCzE1jyXShRrC4056F5YesoGLMXr+0dSF6/csYcI0DMSKcVjaze9rOQ9iLD66VxSuxDQi+f2yA=" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Cantal.nemes%40oneidentity.com%7C4c44ed1fe757486fce6208d7d59bf609%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637212738152646880&sdata=wjM4bWiorMsSD%2BtU877LhNS8LJ51QJl6WPjRZ4lykMA%3D&reserved=0" originalsrc="http://www.balabit.com/support/documentation/?product=syslog-ng" shash="pgCN8GVB51r+yiR92Y6/5Ji92EAgn37wR/ejef2TI1kc0ZvAyivXA8svhfOtSmjCzsl+B0xXUZe9oi5qOef0J3SulFunqeGcPDZUYeFBvK6BOIPXF6VKalqDLROeYYpwAcYVBkDsjTnutyT8vn/nMlvjAfckrnVpgcWzBRKxMVQ=" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Cantal.nemes%40oneidentity.com%7C4c44ed1fe757486fce6208d7d59bf609%7C91c369b51c9e439c989c1867ec606603%7C0%7C1%7C637212738152646880&sdata=%2BjeHBYvJyqtYICVZXXodHTunUVPTeWc1RP45TtCvYD4%3D&reserved=0" originalsrc="http://www.balabit.com/wiki/syslog-ng-faq" shash="u3fSF2tZzGV1VHrS2O5otodbianXRp1nqvSVQwQ3YVVYocOOXIbGkxpxRT2hKxBC4vKM9nklzE3CBCjWlmJRT1ziIVTpCQ4CBsNzULz5nkdaWRRkU/zRiNlUkignQ2pME+yMUJMJobFAFAxSS/wZhM+jNbWHrvuOYYpwhy3I+QI=" target="_blank">
http://www.balabit.com/wiki/syslog-ng-faq</a></p>
</blockquote>
</div>
<p class="x_MsoNormal"><br clear="all">
<br>
-- </p>
<div>
<p class="x_MsoNormal">Bazsi</p>
</div>
<p class="x_MsoNormal"><br>
______________________________________________________________________<br>
This email has been scanned by the Symantec Email Security.cloud service.<br>
For more information please visit http://www.symanteccloud.com<br>
______________________________________________________________________</p>
</div>
**********************************************************************<br>
This email and any files transmitted with it are private and intended<br>
solely for the use of the individual or entity to whom they are addressed.<br>
If you have received this email in error please return it to the address<br>
it came from telling them it is not for you and then delete it from your system.<br>
This email message has been swept for computer viruses.<br>
********************************************************************** </div>
</div>
</body>
</html>