I/O error occurred while writing; fd=\'6\', error=\'Connection refused (111)\'
Hi Folks, I am the owner of php-syslog-ng... While working on one of my servers, I notice the following error getting repeated (a lot): syslog-ng[23692]: I/O error occurred while writing; fd=\'6\', error=\'Connection refused (111)\' I've done multiple searches but haven't been able to nail down why this error is constantly getting logged into my pipe. I've found google results where Baszi asked the user to try using strace and/or lsof, but I can't gleen anything useful from it (maybe I'm just too dumb :-)) Any help would be greatly appreciated :-) Here's my syslog-ng config: options { long_hostnames(off); # doesn't actually help on Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(1); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(16384); # Hosts we don't want syslog from #bad_hostname("^(ctld.|cmd|tmd|last)$"); bad_hostname("^11.16.254.134$"); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); #Use DNS so that our good names are used, not hostnames use_dns(yes); dns_cache(yes); #Use the whole DNS name use_fqdn(yes); keep_hostname(yes); chain_hostnames(no); #Read permission for everyone perm(0644); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; destination d_syslogdb { pipe("/var/log/mysql.pipe", template ("'$HOST''$FACILITY''$PRIORITY''$LEVEL''$TAG''$YEAR-$MONTH-$DAY''$HOUR:$MIN:$SEC''$PROGRAM''$MSG'\n") template_escape(yes) ); }; log { source(s_all); destination(d_syslogdb); }; -- ______________________________________________________________ Clayton Dukes ______________________________________________________________
On Sat, 2009-06-06 at 13:33 -0400, Clayton Dukes wrote:
Hi Folks, I am the owner of php-syslog-ng... While working on one of my servers, I notice the following error getting repeated (a lot): syslog-ng[23692]: I/O error occurred while writing; fd=\'6\', error=\'Connection refused (111)\'
I've done multiple searches but haven't been able to nail down why this error is constantly getting logged into my pipe. I've found google results where Baszi asked the user to try using strace and/or lsof, but I can't gleen anything useful from it (maybe I'm just too dumb :-))
hmm, for a destination pipe, "Connection refused" should not be received as an error code. Quickly checking the Linux kernel sources, I can't see this error code in the pipe driver (although this was only a quick grep) Are you sure that fd=6 refers to the pipe in question? That can be checked using lsof. An strace could reveal which system call returned ECONNREFUSED, and that could let me find the problem. If you can't make that out yourself, just send me the strace and I'll check. (possibly in private as that may contain sensitive information)
Any help would be greatly appreciated :-)
Here's my syslog-ng config:
options { long_hostnames(off);
# doesn't actually help on Solaris, log(3) truncates at 1024 chars log_msg_size(8192);
# buffer just a little for performance sync(1);
# memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(16384);
# Hosts we don't want syslog from #bad_hostname("^(ctld.|cmd|tmd|last)$"); bad_hostname("^11.16.254.134$");
# The time to wait before a dead connection is reestablished (seconds) time_reopen(10);
#Use DNS so that our good names are used, not hostnames use_dns(yes); dns_cache(yes);
#Use the whole DNS name use_fqdn(yes);
keep_hostname(yes); chain_hostnames(no);
#Read permission for everyone perm(0644); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); };
destination d_syslogdb { pipe("/var/log/mysql.pipe", template ("'$HOST''$FACILITY''$PRIORITY''$LEVEL''$TAG''$YEAR-$MONTH-$DAY''$HOUR:$MIN:$SEC''$PROGRAM''$MSG'\n") template_escape(yes) ); };
log { source(s_all); destination(d_syslogdb); };
-- Bazsi
Alrighty! I think I have the culprit...
Are you sure that fd=6 refers to the pipe in question? That can be checked using lsof.
I checked lsof, but didn't find anything other than a pipe (I think) syslog-ng 1009 root 7w FIFO 0,6 1232190 pipe However an strace did yield some good information, now that I know what to look for: 1009 write(6, "<187>Jun 7 10:56:54 vnt-cm1d.cis"..., 277) = -1 ECONNREFUSED (Connection refused) This clued me in that, in fact, you are correct - it's not my perl pipe that is the problem. I'd forgotten that I had added some new destinations the other day to some other servers in the lab, here's the config for that: # Added destination for Unity servers for Scott and Joe # Filter all incoming messages for unity server sources filter f_unitylab { ( host("^vnt-cm") ); }; # Set destination to Joe's lab destination d_unitylab { udp("172.16.106.206" port (514)); }; # Set destnation to Scott's server destination d_ucsyslog { udp("172.16.86.112" port (514)); }; # Log to configured destinations log { source(s_all); filter(f_unitylab); destination(d_unitylab); destination(d_ucsyslog); }; It looks like I'm getting an ECONNREFUSED from one of the sources (vnt-cm1d)? I would think the connection refused would be a destination, not a source - or am I just reading that wrong? Thanks for your help (and sorry that I forgot about the new config!) :-)
An strace could reveal which system call returned ECONNREFUSED, and that could let me find the problem. If you can't make that out yourself, just send me the strace and I'll check. (possibly in private as that may contain sensitive information)
On Sun, Jun 7, 2009 at 5:54 AM, Balazs Scheidler<bazsi@balabit.hu> wrote:
On Sat, 2009-06-06 at 13:33 -0400, Clayton Dukes wrote:
Hi Folks, I am the owner of php-syslog-ng... While working on one of my servers, I notice the following error getting repeated (a lot): syslog-ng[23692]: I/O error occurred while writing; fd=\'6\', error=\'Connection refused (111)\'
I've done multiple searches but haven't been able to nail down why this error is constantly getting logged into my pipe. I've found google results where Baszi asked the user to try using strace and/or lsof, but I can't gleen anything useful from it (maybe I'm just too dumb :-))
hmm, for a destination pipe, "Connection refused" should not be received as an error code.
Quickly checking the Linux kernel sources, I can't see this error code in the pipe driver (although this was only a quick grep)
Are you sure that fd=6 refers to the pipe in question? That can be checked using lsof.
An strace could reveal which system call returned ECONNREFUSED, and that could let me find the problem. If you can't make that out yourself, just send me the strace and I'll check. (possibly in private as that may contain sensitive information)
Any help would be greatly appreciated :-)
Here's my syslog-ng config:
options { long_hostnames(off);
# doesn't actually help on Solaris, log(3) truncates at 1024 chars log_msg_size(8192);
# buffer just a little for performance sync(1);
# memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(16384);
# Hosts we don't want syslog from #bad_hostname("^(ctld.|cmd|tmd|last)$"); bad_hostname("^11.16.254.134$");
# The time to wait before a dead connection is reestablished (seconds) time_reopen(10);
#Use DNS so that our good names are used, not hostnames use_dns(yes); dns_cache(yes);
#Use the whole DNS name use_fqdn(yes);
keep_hostname(yes); chain_hostnames(no);
#Read permission for everyone perm(0644); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); };
destination d_syslogdb { pipe("/var/log/mysql.pipe", template ("'$HOST''$FACILITY''$PRIORITY''$LEVEL''$TAG''$YEAR-$MONTH-$DAY''$HOUR:$MIN:$SEC''$PROGRAM''$MSG'\n") template_escape(yes) ); };
log { source(s_all); destination(d_syslogdb); };
-- Bazsi
-- ______________________________________________________________ Clayton Dukes ______________________________________________________________
Wouldn't things be a lot easier to trouble shoot if syslog-ng just logged the destination name rather than, or in addition to the fd number. Something like syslog-ng: I/O error occurred while writing; destination=d_unitylab; error=\'Connection refused (111)\' I have this problem all of the time, I can not tell which destination is having the problem, and since syslog-ng closes the channel when the error occurs, using lsof is of little help. Evan. ________________________________________ From: syslog-ng-bounces@lists.balabit.hu [syslog-ng-bounces@lists.balabit.hu] On Behalf Of Clayton Dukes [cdukes@gmail.com] Sent: Sunday, June 07, 2009 8:15 AM To: Balazs Scheidler Cc: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] I/O error occurred while writing; fd=\'6\', error=\'Connection refused (111)\' Alrighty! I think I have the culprit...
Are you sure that fd=6 refers to the pipe in question? That can be checked using lsof.
I checked lsof, but didn't find anything other than a pipe (I think) syslog-ng 1009 root 7w FIFO 0,6 1232190 pipe However an strace did yield some good information, now that I know what to look for: 1009 write(6, "<187>Jun 7 10:56:54 vnt-cm1d.cis"..., 277) = -1 ECONNREFUSED (Connection refused) This clued me in that, in fact, you are correct - it's not my perl pipe that is the problem. I'd forgotten that I had added some new destinations the other day to some other servers in the lab, here's the config for that: # Added destination for Unity servers for Scott and Joe # Filter all incoming messages for unity server sources filter f_unitylab { ( host("^vnt-cm") ); }; # Set destination to Joe's lab destination d_unitylab { udp("172.16.106.206" port (514)); }; # Set destnation to Scott's server destination d_ucsyslog { udp("172.16.86.112" port (514)); }; # Log to configured destinations log { source(s_all); filter(f_unitylab); destination(d_unitylab); destination(d_ucsyslog); }; It looks like I'm getting an ECONNREFUSED from one of the sources (vnt-cm1d)? I would think the connection refused would be a destination, not a source - or am I just reading that wrong? Thanks for your help (and sorry that I forgot about the new config!) :-)
An strace could reveal which system call returned ECONNREFUSED, and that could let me find the problem. If you can't make that out yourself, just send me the strace and I'll check. (possibly in private as that may contain sensitive information)
On Sun, Jun 7, 2009 at 5:54 AM, Balazs Scheidler<bazsi@balabit.hu> wrote:
On Sat, 2009-06-06 at 13:33 -0400, Clayton Dukes wrote:
Hi Folks, I am the owner of php-syslog-ng... While working on one of my servers, I notice the following error getting repeated (a lot): syslog-ng[23692]: I/O error occurred while writing; fd=\'6\', error=\'Connection refused (111)\'
I've done multiple searches but haven't been able to nail down why this error is constantly getting logged into my pipe. I've found google results where Baszi asked the user to try using strace and/or lsof, but I can't gleen anything useful from it (maybe I'm just too dumb :-))
hmm, for a destination pipe, "Connection refused" should not be received as an error code.
Quickly checking the Linux kernel sources, I can't see this error code in the pipe driver (although this was only a quick grep)
Are you sure that fd=6 refers to the pipe in question? That can be checked using lsof.
An strace could reveal which system call returned ECONNREFUSED, and that could let me find the problem. If you can't make that out yourself, just send me the strace and I'll check. (possibly in private as that may contain sensitive information)
Any help would be greatly appreciated :-)
Here's my syslog-ng config:
options { long_hostnames(off);
# doesn't actually help on Solaris, log(3) truncates at 1024 chars log_msg_size(8192);
# buffer just a little for performance sync(1);
# memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(16384);
# Hosts we don't want syslog from #bad_hostname("^(ctld.|cmd|tmd|last)$"); bad_hostname("^11.16.254.134$");
# The time to wait before a dead connection is reestablished (seconds) time_reopen(10);
#Use DNS so that our good names are used, not hostnames use_dns(yes); dns_cache(yes);
#Use the whole DNS name use_fqdn(yes);
keep_hostname(yes); chain_hostnames(no);
#Read permission for everyone perm(0644); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); };
destination d_syslogdb { pipe("/var/log/mysql.pipe", template ("'$HOST''$FACILITY''$PRIORITY''$LEVEL''$TAG''$YEAR-$MONTH-$DAY''$HOUR:$MIN:$SEC''$PROGRAM''$MSG'\n") template_escape(yes) ); };
log { source(s_all); destination(d_syslogdb); };
-- Bazsi
-- ______________________________________________________________ Clayton Dukes ______________________________________________________________ ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
On Sun, 2009-06-07 at 21:03 -0700, Evan Rempel wrote:
Wouldn't things be a lot easier to trouble shoot if syslog-ng just logged the destination name rather than, or in addition to the fd number. Something like
syslog-ng: I/O error occurred while writing; destination=d_unitylab; error=\'Connection refused (111)\'
I have this problem all of the time, I can not tell which destination is having the problem, and since syslog-ng closes the channel when the error occurs, using lsof is of little help.
You are right of course, it's not that easy to implement and so far I was lazy :) Can you please file a bugreport on this? Thanks. -- Bazsi
Hi, On Sun, Jun 7, 2009 at 5:15 PM, Clayton Dukes<cdukes@gmail.com> wrote:
Alrighty! I think I have the culprit...
Are you sure that fd=6 refers to the pipe in question? That can be checked using lsof.
I checked lsof, but didn't find anything other than a pipe (I think)
syslog-ng 1009 root 7w FIFO 0,6 1232190 pipe
You've misinterpreted lsof's output. This is fd 7, not 6. So, what is fd 6 then? Regards, Sandor
Hmm, I don't get it - is that what the 7w indicates? If so, there's no 6w...? syslog-ng 16624 root 0r CHR 1,3 2766 /dev/null syslog-ng 16624 root 1w CHR 1,3 2766 /dev/null syslog-ng 16624 root 2w CHR 1,3 2766 /dev/null syslog-ng 16624 root 3u unix 0xf5977a00 1630663 /dev/log syslog-ng 16624 root 4r REG 0,3 0 4026531989 /proc/kmsg syslog-ng 16624 root 5u IPv4 1630665 UDP *:syslog syslog-ng 16624 root 7w FIFO 0,6 1630666 pipe syslog-ng 16624 root 8u IPv4 1630668 UDP rtpnml-x.x.com:34385->rtpnml-cx.x.com:syslog syslog-ng 16624 root 9w REG 8,1 35140533 589847 /var/log/syslog syslog-ng 16624 root 10w REG 8,1 40295 590246 /var/log/messages syslog-ng 16624 root 11u FIFO 0,14 4729 /dev/xconsole syslog-ng 16624 root 12w REG 8,1 235784055 590214 /var/log/debug syslog-ng 16624 root 13w REG 8,1 24455288 588819 /var/log/auth.log On Mon, Jun 8, 2009 at 3:38 AM, Sandor Geller<Sandor.Geller@morganstanley.com> wrote:
Hi,
On Sun, Jun 7, 2009 at 5:15 PM, Clayton Dukes<cdukes@gmail.com> wrote:
Alrighty! I think I have the culprit...
Are you sure that fd=6 refers to the pipe in question? That can be checked using lsof.
I checked lsof, but didn't find anything other than a pipe (I think)
syslog-ng 1009 root 7w FIFO 0,6 1232190 pipe
You've misinterpreted lsof's output. This is fd 7, not 6. So, what is fd 6 then?
Regards,
Sandor
-- ______________________________________________________________ Clayton Dukes ______________________________________________________________
Hi, On Mon, Jun 8, 2009 at 3:25 PM, Clayton Dukes<cdukes@gmail.com> wrote:
Hmm, I don't get it - is that what the 7w indicates? If so, there's no 6w...?
It shows that fd 7 is opened for writing, and it's a pipe. It tells nothing about what fd 6 was. As we're still missing details about the fd in question it would be good to know what's your issue at all... Right now without information we could only guess. If you don't want to show your config then run syslog-ng under strace to see what's failing and where. The issue has to be with a destination where syslog-ng can't connect. If my guess is right then the it's the *first* destination in your config. Regards, Sandor
Sorry, I'm just confused. I'm trying to figure out the source of the error - which destination it's having trouble writing to. I don't mind showing my config: ########################################################################################### # June 06, 2009 Added by cdukes for php-syslog-ng ########################################################################################### options { long_hostnames(off); # doesn't actually help on Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(1); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(16384); # Hosts we don't want syslog from #bad_hostname("^(ctld.|cmd|tmd|last)$"); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); #Use DNS so that our good names are used, not hostnames use_dns(yes); dns_cache(yes); #Use the whole DNS name use_fqdn(yes); keep_hostname(yes); chain_hostnames(no); #Read permission for everyone perm(0644); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; # Create destination to our perl script destination d_syslogdb { program ("/www/php-syslog-ng/scripts/syslog2mysql.pl", template ("'$HOST''$FACILITY''$PRIORITY''$LEVEL''$TAG''$YEAR-$MONTH-$DAY''$HOUR:$MIN:$SEC''$PROGRAM''$MSG'\n") template_escape(yes) ); }; # Tell syslog-ng to log to our new destination log { source(s_all); destination(d_syslogdb); destination(df_debug); }; # Added destination for Unity servers for Scott and Joe # Filter all incoming messages for unity servers filter f_unitylab { ( host("^vnt-cm") ); }; # Set destination to Joe's lab destination d_unitylab { udp("172.18.106.206" port (514)); }; # Set destnation to Scott's server destination d_ucsyslog { udp("172.18.86.112" port (514)); }; # Log to configured destinations log { source(s_all); filter(f_unitylab); destination(d_unitylab); destination(d_ucsyslog); }; # END Strace output: 16624 write(14, "<187>Jun 8 06:59:16 vnt-cm1c.cis"..., 464) = -1 ECONNREFUSED (Connection refused) # nslookup vnt-cm1c Name: vnt-cm1c.x.com Address: 172.18.106.60 This address doesn't match any of my configured destinations, but does match an incoming source. On Mon, Jun 8, 2009 at 9:39 AM, Sandor Geller<Sandor.Geller@morganstanley.com> wrote:
Hi,
On Mon, Jun 8, 2009 at 3:25 PM, Clayton Dukes<cdukes@gmail.com> wrote:
Hmm, I don't get it - is that what the 7w indicates? If so, there's no 6w...?
It shows that fd 7 is opened for writing, and it's a pipe. It tells nothing about what fd 6 was. As we're still missing details about the fd in question it would be good to know what's your issue at all... Right now without information we could only guess. If you don't want to show your config then run syslog-ng under strace to see what's failing and where. The issue has to be with a destination where syslog-ng can't connect. If my guess is right then the it's the *first* destination in your config.
Regards,
Sandor
-- ______________________________________________________________ Clayton Dukes ______________________________________________________________
Hi, On Mon, Jun 8, 2009 at 4:01 PM, Clayton Dukes<cdukes@gmail.com> wrote:
Sorry, I'm just confused.
NP, we're here to help :) [ cut ]
Strace output:
16624 write(14, "<187>Jun 8 06:59:16 vnt-cm1c.cis"..., 464) = -1 ECONNREFUSED (Connection refused)
# nslookup vnt-cm1c
Name: vnt-cm1c.x.com Address: 172.18.106.60
The connection error isn't related to this host. Syslog-ng wants to log a message originating *from* the host and there is a problem with a remote destination. We still don't know what destination would be fd 14. Could you provide more strace info, where syslog-ng tries to use fd 14? I'm interested in the failing connect() call and the preceeding socket() which returned fd 14 to see what's the remote side. BTW these are the candidates:
destination d_unitylab { udp("172.18.106.206" port (514)); }; # Set destnation to Scott's server destination d_ucsyslog { udp("172.18.86.112" port (514)); };
Regards, Sandor
On Sun, 2009-06-07 at 11:15 -0400, Clayton Dukes wrote:
Alrighty! I think I have the culprit...
Are you sure that fd=6 refers to the pipe in question? That can be checked using lsof.
I checked lsof, but didn't find anything other than a pipe (I think)
syslog-ng 1009 root 7w FIFO 0,6 1232190 pipe
However an strace did yield some good information, now that I know what to look for:
1009 write(6, "<187>Jun 7 10:56:54 vnt-cm1d.cis"..., 277) = -1 ECONNREFUSED (Connection refused)
This clued me in that, in fact, you are correct - it's not my perl pipe that is the problem. I'd forgotten that I had added some new destinations the other day to some other servers in the lab, here's the config for that:
# Added destination for Unity servers for Scott and Joe
# Filter all incoming messages for unity server sources filter f_unitylab { ( host("^vnt-cm") ); }; # Set destination to Joe's lab destination d_unitylab { udp("172.16.106.206" port (514)); }; # Set destnation to Scott's server destination d_ucsyslog { udp("172.16.86.112" port (514)); };
# Log to configured destinations log { source(s_all); filter(f_unitylab); destination(d_unitylab); destination(d_ucsyslog); };
It looks like I'm getting an ECONNREFUSED from one of the sources (vnt-cm1d)? I would think the connection refused would be a destination, not a source - or am I just reading that wrong?
Thanks for your help (and sorry that I forgot about the new config!) :-)
Hmm, why do you think it is a source? It seems to be a destination to me. And you can get the information of which one it is by checking out the fd output of lsof. Which syslog-ng version are you using by the way? syslog-ng 3.0 should properly suspend writing to such a destination as soon as it receives the "connection refused" error, and then continue only when time_reopen() time passes. (which is 1 minute by default). -- Bazsi
I think it's a source(?): 16624 write(14, "<187>Jun 8 06:59:16 vnt-cm1c.cis"..., 464) = -1 ECONNREFUSED (Connection refused) # nslookup vnt-cm1c Name: vnt-cm1c.x.com Address: 172.18.106.60 This address doesn't match any of my configured destinations, but does match an incoming source. On Mon, Jun 8, 2009 at 4:23 AM, Balazs Scheidler<bazsi@balabit.hu> wrote:
On Sun, 2009-06-07 at 11:15 -0400, Clayton Dukes wrote:
Alrighty! I think I have the culprit...
Are you sure that fd=6 refers to the pipe in question? That can be checked using lsof.
I checked lsof, but didn't find anything other than a pipe (I think)
syslog-ng 1009 root 7w FIFO 0,6 1232190 pipe
However an strace did yield some good information, now that I know what to look for:
1009 write(6, "<187>Jun 7 10:56:54 vnt-cm1d.cis"..., 277) = -1 ECONNREFUSED (Connection refused)
This clued me in that, in fact, you are correct - it's not my perl pipe that is the problem. I'd forgotten that I had added some new destinations the other day to some other servers in the lab, here's the config for that:
# Added destination for Unity servers for Scott and Joe
# Filter all incoming messages for unity server sources filter f_unitylab { ( host("^vnt-cm") ); }; # Set destination to Joe's lab destination d_unitylab { udp("172.16.106.206" port (514)); }; # Set destnation to Scott's server destination d_ucsyslog { udp("172.16.86.112" port (514)); };
# Log to configured destinations log { source(s_all); filter(f_unitylab); destination(d_unitylab); destination(d_ucsyslog); };
It looks like I'm getting an ECONNREFUSED from one of the sources (vnt-cm1d)? I would think the connection refused would be a destination, not a source - or am I just reading that wrong?
Thanks for your help (and sorry that I forgot about the new config!) :-)
Hmm, why do you think it is a source? It seems to be a destination to me. And you can get the information of which one it is by checking out the fd output of lsof.
Which syslog-ng version are you using by the way? syslog-ng 3.0 should properly suspend writing to such a destination as soon as it receives the "connection refused" error, and then continue only when time_reopen() time passes. (which is 1 minute by default).
-- Bazsi
-- ______________________________________________________________ Clayton Dukes ______________________________________________________________
On Mon, 2009-06-08 at 09:31 -0400, Clayton Dukes wrote:
I think it's a source(?): 16624 write(14, "<187>Jun 8 06:59:16 vnt-cm1c.cis"..., 464) = -1 ECONNREFUSED (Connection refused)
# nslookup vnt-cm1c
Name: vnt-cm1c.x.com Address: 172.18.106.60
This address doesn't match any of my configured destinations, but does match an incoming source.
syslog-ng is trying to send _out_ a message that originally came from vnt-cm1c.x.com. -- Bazsi
participants (4)
-
Balazs Scheidler
-
Clayton Dukes
-
Evan Rempel
-
Sandor Geller