The first two lines are expected from a TCP connected client when the destination (central server) is restarted or reloaded. The client machine should then easily be able to reconnect, and I would not expect the "Connection failed;..." message, however, I note that you indicate that you are seeing these messages on the central server, so the connection must have been established again in order to get the messages to the central server. What you are describing will occur if your "restart" of the central log server is implemented as; stop do something with log files (like rotating which is unnecessary) start where the "do something" takes longer than 10 seconds, but less than 20 seconds. Evan. LESOUEF Emmanuel wrote:
Hello,
I'm getting this kind of logs (facility syslog) on my central syslog-ng server :
Oct 31 12:08:10 lxnetmgmt syslog-ng[8698]: EOF occurred while idle; fd='6' Oct 31 12:08:10 lxnetmgmt syslog-ng[8698]: Connection broken; time_reopen='10' Oct 31 12:08:20 lxnetmgmt syslog-ng[8698]: Connection failed; error='Connection refused (111)', time_reopen='10'
It occurs after restarting the central syslog-ng server. These messages come from remote hosts sending their logs via tcp to the central syslog-ng server.
Any idea ?
Thanks for your help.
-- Emmanuel Lesouef DSI | CRBN t : 0231069671 m : e.lesouef@crbn.fr
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
-- Evan Rempel erempel@uvic.ca Senior Programmer Analyst 250.721.7691 Computing Services University of Victoria