[syslog-ng] Connection broke using remote syslog-ng clients

[Evan Rempel]

The first two lines are expected from a TCP connected client when the destination
(central server) is restarted or reloaded.

The client machine should then easily be able to reconnect, and I would not expect
the "Connection failed;..." message, however, I note that you indicate that you are seeing these
messages on the central server, so the connection must have been established again in order to
get the messages to the central server.

What you are describing will occur if your "restart" of the central log server is implemented
as;

stop
do something with log files (like rotating which is unnecessary)
start

where the "do something" takes longer than 10 seconds, but less than 20 seconds.

Evan.

LESOUEF Emmanuel wrote:
> Hello,
> 
> I'm getting this kind of logs (facility syslog) on my central syslog-ng server :
> 
> Oct 31 12:08:10 lxnetmgmt syslog-ng[8698]: EOF occurred while idle; fd='6' 
> Oct 31 12:08:10 lxnetmgmt syslog-ng[8698]: Connection broken; time_reopen='10' 
> Oct 31 12:08:20 lxnetmgmt syslog-ng[8698]: Connection failed; error='Connection refused (111)', time_reopen='10' 
> 
> It occurs after restarting the central syslog-ng server. These messages come from remote hosts sending their logs via tcp to the central syslog-ng server.
> 
> Any idea ?
> 
> Thanks for your help.
> 
> --
> Emmanuel Lesouef
> DSI | CRBN
> t : 0231069671
> m : e.lesouef at crbn.fr
> 
> _______________________________________________
> syslog-ng maillist  -  syslog-ng at lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
> 


-- 
Evan Rempel                erempel at uvic.ca
Senior Programmer Analyst        250.721.7691
Computing Services
University of Victoria