Re: [syslog-ng] I/O error occurred while writing; fd=\'6\', error=\'Connection refused (111)\'

8 Jun 2009

      Sorry, I'm just confused.
I'm trying to figure out the source of the error - which destination
it's having trouble writing to.
I don't mind showing my config:

###########################################################################################
# June 06, 2009 Added by cdukes for php-syslog-ng
###########################################################################################
options {
        long_hostnames(off);

        # doesn't actually help on Solaris, log(3) truncates at 1024 chars
        log_msg_size(8192);

        # buffer just a little for performance
        sync(1);

        # memory is cheap, buffer messages unable to write (like to loghost)
        log_fifo_size(16384);

        # Hosts we don't want syslog from
        #bad_hostname("^(ctld.|cmd|tmd|last)$");

        # The time to wait before a dead connection is reestablished (seconds)
        time_reopen(10);

        #Use DNS so that our good names are used, not hostnames
        use_dns(yes);
        dns_cache(yes);

        #Use the whole DNS name
        use_fqdn(yes);

        keep_hostname(yes);
        chain_hostnames(no);

        #Read permission for everyone
        perm(0644);
        # The default action of syslog-ng 1.6.0 is to log a STATS line
        # to the file every 10 minutes.  That's pretty ugly after a while.
        # Change it to every 12 hours so you get a nice daily update of
        # how many messages syslog-ng missed (0).
        stats(43200);
        };

# Create destination to our perl script
destination d_syslogdb {
        program ("/www/php-syslog-ng/scripts/syslog2mysql.pl",
        template
("'$HOST''$FACILITY''$PRIORITY''$LEVEL''$TAG''$YEAR-$MONTH-$DAY''$HOUR:$MIN:$SEC''$PROGRAM''$MSG'\n")
        template_escape(yes)
        );
};

# Tell syslog-ng to log to our new destination
log {
    source(s_all);
    destination(d_syslogdb);
    destination(df_debug);
};

# Added destination for Unity servers for Scott and Joe

# Filter all incoming messages for unity servers
filter f_unitylab { (
    host("^vnt-cm")
    );
};
# Set destination to Joe's lab
destination d_unitylab {
    udp("172.18.106.206" port (514));
};
# Set destnation to Scott's server
destination d_ucsyslog {
    udp("172.18.86.112" port (514));
};

# Log to configured destinations
log {
    source(s_all);
    filter(f_unitylab);
    destination(d_unitylab);
    destination(d_ucsyslog);
};

# END

Strace output:

16624 write(14, "<187>Jun  8 06:59:16 vnt-cm1c.cis"..., 464) = -1
ECONNREFUSED (Connection refused)

# nslookup vnt-cm1c

Name:   vnt-cm1c.x.com
Address: 172.18.106.60

This address doesn't match any of my configured destinations, but does
match an incoming source.

On Mon, Jun 8, 2009 at 9:39 AM, Sandor
Geller<Sandor.Geller@morganstanley.com> wrote:
...
Hi,
On Mon, Jun 8, 2009 at 3:25 PM, Clayton Dukes<cdukes@gmail.com> wrote:
...
Hmm,
I don't get it - is that what the 7w indicates? If so, there's no 6w...?
It shows that fd 7 is opened for writing, and it's a pipe. It tells
nothing about what fd 6 was. As we're still missing details about the
fd in question it would be good to know what's your issue at all...
Right now without information we could only guess. If you don't want
to show your config then run syslog-ng under strace to see what's
failing and where. The issue has to be with a destination where
syslog-ng can't connect. If my guess is right then the it's the
*first* destination in your config.
Regards,
Sandor
-- 
______________________________________________________________

Clayton Dukes
______________________________________________________________