[syslog-ng] I/O error occurred while writing; fd=\'6\', error=\'Connection refused (111)\'

[Balazs Scheidler]

On Sat, 2009-06-06 at 13:33 -0400, Clayton Dukes wrote:
> Hi Folks,
> I am the owner of php-syslog-ng...
> While working on one of my servers, I notice the following error
> getting repeated (a lot):
> syslog-ng[23692]: I/O error occurred while writing; fd=\'6\',
> error=\'Connection refused (111)\'
> 
> I've done multiple searches but haven't been able to nail down why
> this error is constantly getting logged into my pipe.
> I've found google results where Baszi asked the user to try using
> strace and/or lsof, but I can't gleen anything useful from it (maybe
> I'm just too dumb :-))
> 

hmm, for a destination pipe, "Connection refused" should not be received
as an error code.

Quickly checking the Linux kernel sources, I can't see this error code
in the pipe driver (although this was only a quick grep)

Are you sure that fd=6 refers to the pipe in question? That can be
checked using lsof.

An strace could reveal which system call returned ECONNREFUSED, and that
could let me find the problem. If you can't make that out  yourself,
just send me the strace and I'll check. (possibly in private as that may
contain sensitive information)


> Any help would be greatly appreciated :-)
> 
> Here's my syslog-ng config:
> 
> options {
>         long_hostnames(off);
> 
>         # doesn't actually help on Solaris, log(3) truncates at 1024 chars
>         log_msg_size(8192);
> 
>         # buffer just a little for performance
>         sync(1);
> 
>         # memory is cheap, buffer messages unable to write (like to loghost)
>         log_fifo_size(16384);
> 
>         # Hosts we don't want syslog from
>         #bad_hostname("^(ctld.|cmd|tmd|last)$");
>         bad_hostname("^11.16.254.134$");
> 
>         # The time to wait before a dead connection is reestablished (seconds)
>         time_reopen(10);
> 
>         #Use DNS so that our good names are used, not hostnames
>         use_dns(yes);
>         dns_cache(yes);
> 
>         #Use the whole DNS name
>         use_fqdn(yes);
> 
>         keep_hostname(yes);
>         chain_hostnames(no);
> 
>         #Read permission for everyone
>         perm(0644);
>        # The default action of syslog-ng 1.6.0 is to log a STATS line
>         # to the file every 10 minutes.  That's pretty ugly after a while.
>         # Change it to every 12 hours so you get a nice daily update of
>         # how many messages syslog-ng missed (0).
>         stats(43200);
>         };
> 
> destination d_syslogdb {
>         pipe("/var/log/mysql.pipe",
>         template
> ("'$HOST''$FACILITY''$PRIORITY''$LEVEL''$TAG''$YEAR-$MONTH-$DAY''$HOUR:$MIN:$SEC''$PROGRAM''$MSG'\n")
>         template_escape(yes)
>         );
> };
> 
> log {
> source(s_all); destination(d_syslogdb);
> };
> 
> 
-- 
Bazsi