[syslog-ng]TCP reconnections randomly failing

[Richard E. Perlotto II]

Could be the maximum number of connections for tcp.  Default is set
to 10.  Change this to a more realistic number:

source s_tcp
  { tcp(port(4800) keep-alive(yes) max_connections(100)); };


Richard

> -----Original Message-----
> From: syslog-ng-admin@lists.balabit.hu 
> [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Xavier 
> de Labouret
> Sent: Friday, March 14, 2003 1:31 AM
> To: syslog-ng@lists.balabit.hu
> Subject: [syslog-ng]TCP reconnections randomly failing
> 
> 
> 
> Hello,
> 
> We are using syslog-ng with a central loghost. Our 
> applications run on remote servers, all their syslog logs 
> being forwarded to the central loghost with TCP forwarding.
> 
> However, we are facing a problem now with TCP reconnections. 
> Sometimes, we have to restart the syslog-ng daemon on our 
> central loghost. And when this happens, some clients fail to 
> reconnect to the loghost.
> 
> The failing client syslog-ng complains about being unable to 
> reconnect, tries a variable number of reattempts, and then 
> gives up. On the server side, nothing is logged on these 
> failed attempts.
> 
> We have no clue on why this fails on some servers and not on 
> the others. The maximum number of TCP connections on our 
> loghost is set to 100, and this number is never approached, by far. 
> 
> To have the TCP connection come back again with the remote 
> server, we must restart the client syslog-ng daemon.
> 
> Here are our logs on the client daemon:
> 
> -----------------8<---------------------
> 
> Mar 10 09:41:43 java-as02 syslog-ng[23311]: io.c: do_write: 
> write() failed (errno 32), Broken pipe Mar 10 09:41:43 
> java-as02 syslog-ng[23311]: Connection broken, reopening in 1 
> seconds Mar 10 09:41:45 java-as02 syslog-ng[23311]: Error 
> connecting to remote host (62.160.234.84), reattempting in 1 
> seconds Mar 10 09:41:46 java-as02 syslog-ng[23311]: Error 
> connecting to remote host (62.160.234.84), reattempting in 1 
> seconds Mar 10 09:41:47 java-as02 syslog-ng[23311]: Error 
> connecting to remote host (62.160.234.84), reattempting in 1 
> seconds Mar 10 09:41:49 java-as02 syslog-ng[23311]: Error 
> connecting to remote host (62.160.234.84), reattempting in 1 
> seconds Mar 10 09:41:50 java-as02 syslog-ng[23311]: Error 
> connecting to remote host (62.160.234.84), reattempting in 1 
> seconds Mar 10 09:41:51 java-as02 syslog-ng[23311]: Error 
> connecting to remote host (62.160.234.84), reattempting in 1 
> seconds Mar 10 09:41:52 java-as02 syslog-ng[23311]: Error 
> connecting to remote host (62.160.234.84), reattempting in 1 
> seconds Mar 10 09:41:53 java-as02 syslog-ng[23311]: Error 
> connecting to remote host (62.160.234.84), reattempting in 1 seconds
> 
> ----------------->8---------------------
> 
> We can see 8 reconnection attempts, and then no more message.
> 
> Last precision: we are running syslog-ng 1.4.16 on 
> Debian/Linux platforms.
> 
> Here are my questions:
> 
> - could there be a weakness in the TCP reconnection procedure 
> of syslog-ng 1.4.16? 
> 
> - we don't think this comes from our network equipments. 
> Maybe we could get more traces of the syslog-ng behaviour in 
> these cases. How could we do it (options/tools)? 
> 
> - can we toggle some parameters now to make this less 
> probably happen (augmenting the reconnection delay...)?
> 
> - or maybe we should use syslog-ng 1.5.25?
> 
> Thank you in advance,
> 
> Xavier de Labouret _______________________________________________
> syslog-ng maillist  -  syslog-ng@lists.balabit.hu 
> https://lists.balabit.hu/mailman/listinfo/sysl> og-ng
> 
> Frequently asked questions at 
> http://www.campin.net/syslog-ng/faq.html
> 
> 
>