Alrighty! I think I have the culprit...
Are you sure that fd=6 refers to the pipe in question? That can be checked using lsof.
I checked lsof, but didn't find anything other than a pipe (I think) syslog-ng 1009 root 7w FIFO 0,6 1232190 pipe However an strace did yield some good information, now that I know what to look for: 1009 write(6, "<187>Jun 7 10:56:54 vnt-cm1d.cis"..., 277) = -1 ECONNREFUSED (Connection refused) This clued me in that, in fact, you are correct - it's not my perl pipe that is the problem. I'd forgotten that I had added some new destinations the other day to some other servers in the lab, here's the config for that: # Added destination for Unity servers for Scott and Joe # Filter all incoming messages for unity server sources filter f_unitylab { ( host("^vnt-cm") ); }; # Set destination to Joe's lab destination d_unitylab { udp("172.16.106.206" port (514)); }; # Set destnation to Scott's server destination d_ucsyslog { udp("172.16.86.112" port (514)); }; # Log to configured destinations log { source(s_all); filter(f_unitylab); destination(d_unitylab); destination(d_ucsyslog); }; It looks like I'm getting an ECONNREFUSED from one of the sources (vnt-cm1d)? I would think the connection refused would be a destination, not a source - or am I just reading that wrong? Thanks for your help (and sorry that I forgot about the new config!) :-)
An strace could reveal which system call returned ECONNREFUSED, and that could let me find the problem. If you can't make that out yourself, just send me the strace and I'll check. (possibly in private as that may contain sensitive information)
On Sun, Jun 7, 2009 at 5:54 AM, Balazs Scheidler<bazsi@balabit.hu> wrote:
On Sat, 2009-06-06 at 13:33 -0400, Clayton Dukes wrote:
Hi Folks, I am the owner of php-syslog-ng... While working on one of my servers, I notice the following error getting repeated (a lot): syslog-ng[23692]: I/O error occurred while writing; fd=\'6\', error=\'Connection refused (111)\'
I've done multiple searches but haven't been able to nail down why this error is constantly getting logged into my pipe. I've found google results where Baszi asked the user to try using strace and/or lsof, but I can't gleen anything useful from it (maybe I'm just too dumb :-))
hmm, for a destination pipe, "Connection refused" should not be received as an error code.
Quickly checking the Linux kernel sources, I can't see this error code in the pipe driver (although this was only a quick grep)
Are you sure that fd=6 refers to the pipe in question? That can be checked using lsof.
An strace could reveal which system call returned ECONNREFUSED, and that could let me find the problem. If you can't make that out yourself, just send me the strace and I'll check. (possibly in private as that may contain sensitive information)
Any help would be greatly appreciated :-)
Here's my syslog-ng config:
options { long_hostnames(off);
# doesn't actually help on Solaris, log(3) truncates at 1024 chars log_msg_size(8192);
# buffer just a little for performance sync(1);
# memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(16384);
# Hosts we don't want syslog from #bad_hostname("^(ctld.|cmd|tmd|last)$"); bad_hostname("^11.16.254.134$");
# The time to wait before a dead connection is reestablished (seconds) time_reopen(10);
#Use DNS so that our good names are used, not hostnames use_dns(yes); dns_cache(yes);
#Use the whole DNS name use_fqdn(yes);
keep_hostname(yes); chain_hostnames(no);
#Read permission for everyone perm(0644); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); };
destination d_syslogdb { pipe("/var/log/mysql.pipe", template ("'$HOST''$FACILITY''$PRIORITY''$LEVEL''$TAG''$YEAR-$MONTH-$DAY''$HOUR:$MIN:$SEC''$PROGRAM''$MSG'\n") template_escape(yes) ); };
log { source(s_all); destination(d_syslogdb); };
-- Bazsi
-- ______________________________________________________________ Clayton Dukes ______________________________________________________________