On Sun, 2009-06-07 at 11:15 -0400, Clayton Dukes wrote:
Alrighty! I think I have the culprit...
Are you sure that fd=6 refers to the pipe in question? That can be checked using lsof.
I checked lsof, but didn't find anything other than a pipe (I think)
syslog-ng 1009 root 7w FIFO 0,6 1232190 pipe
However an strace did yield some good information, now that I know what to look for:
1009 write(6, "<187>Jun 7 10:56:54 vnt-cm1d.cis"..., 277) = -1 ECONNREFUSED (Connection refused)
This clued me in that, in fact, you are correct - it's not my perl pipe that is the problem. I'd forgotten that I had added some new destinations the other day to some other servers in the lab, here's the config for that:
# Added destination for Unity servers for Scott and Joe
# Filter all incoming messages for unity server sources filter f_unitylab { ( host("^vnt-cm") ); }; # Set destination to Joe's lab destination d_unitylab { udp("172.16.106.206" port (514)); }; # Set destnation to Scott's server destination d_ucsyslog { udp("172.16.86.112" port (514)); };
# Log to configured destinations log { source(s_all); filter(f_unitylab); destination(d_unitylab); destination(d_ucsyslog); };
It looks like I'm getting an ECONNREFUSED from one of the sources (vnt-cm1d)? I would think the connection refused would be a destination, not a source - or am I just reading that wrong?
Thanks for your help (and sorry that I forgot about the new config!) :-)
Hmm, why do you think it is a source? It seems to be a destination to me. And you can get the information of which one it is by checking out the fd output of lsof. Which syslog-ng version are you using by the way? syslog-ng 3.0 should properly suspend writing to such a destination as soon as it receives the "connection refused" error, and then continue only when time_reopen() time passes. (which is 1 minute by default). -- Bazsi