[syslog-ng]client couldn't reconnect to loghost after failure

Ed Ravin syslog-ng@lists.balabit.hu
Thu, 3 Mar 2005 12:56:01 -0500


We're using syslog-ng 1.5.13 (yes, I know) on a bunch of diskless
clients to send log messages to a central host.  The main switch in
our machine room had a hardware problem, and refused to pass packets
for 20 minutes or so until we rebooted it.

On two of my clients, syslog-ng subsequently stopped sending log messages
to the central host after the switch recovered.  Here's what was in the log:

 Mar  1 08:55:38  syslog-ng[13050]: io.c: do_write: write() failed (errno 9), Broken pipe
 Mar  1 08:55:38  syslog-ng[13050]: pkt_buffer::do_flush(): Error flushing data
 Mar  1 08:55:38  syslog-ng[13050]: Connection broken to AF_INET(loghost.example.com:514), reopening in 60 seconds
 Mar  1 08:57:53  syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds
 Mar  1 09:00:08  syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds
 Mar  1 09:02:24  syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds
 Mar  1 09:04:39  syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds
 Mar  1 09:05:38  syslog-ng[13050]: STATS: dropped 0
 Mar  1 09:06:54  syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds
 Mar  1 09:09:10  syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds
 Mar  1 09:25:39  syslog-ng[13050]: STATS: dropped 0
 Mar  1 09:35:39  syslog-ng[13050]: STATS: dropped 0
 
The other host has a remarkably similar log.  After 9:25:39, the only
messages that made it to the central host are the "STATS: dropped 0"
messages.

Is this a bug that has been fixed in more recent versions?  We've been
meaning to upgrade the clients for a while (the central server is using
a current syslog-ng), but haven't gotten to it yet.