[syslog-ng] I/O error occurred while writing; fd=\'6\', error=\'Connection refused (111)\'

[Balazs Scheidler]

On Sun, 2009-06-07 at 11:15 -0400, Clayton Dukes wrote:
> Alrighty! I think I have the culprit...
> 
> > Are you sure that fd=6 refers to the pipe in question? That can be
> > checked using lsof.
> 
> I checked lsof, but didn't find anything other than a pipe (I think)
> 
> syslog-ng  1009       root    7w     FIFO        0,6              1232190 pipe
> 
> However an strace did yield some good information, now that I know
> what to look for:
> 
> 1009  write(6, "<187>Jun  7 10:56:54 vnt-cm1d.cis"..., 277) = -1
> ECONNREFUSED (Connection refused)
> 
> This clued me in that, in fact, you are correct - it's not my perl
> pipe that is the problem.
> I'd forgotten that I had added some new destinations the other day to
> some other servers in the lab, here's the config for that:
> 
> 
> # Added destination for Unity servers for Scott and Joe
> 
> # Filter all incoming messages for unity server sources
> filter f_unitylab { (
>     host("^vnt-cm")
>     );
> };
> # Set destination to Joe's lab
> destination d_unitylab {
>     udp("172.16.106.206" port (514));
> };
> # Set destnation to Scott's server
> destination d_ucsyslog {
>     udp("172.16.86.112" port (514));
> };
> 
> # Log to configured destinations
> log {
>     source(s_all);
>     filter(f_unitylab);
>     destination(d_unitylab);
>     destination(d_ucsyslog);
> };
> 
> It looks like I'm getting an ECONNREFUSED from one of the sources (vnt-cm1d)?
> I would think the connection refused would be a destination, not a
> source - or am I just reading that wrong?
> 
> Thanks for your help (and sorry that I forgot about the new config!) :-)

Hmm, why do you think it is a source? It seems to be a destination to
me. And you can get the information of which one it is by checking out
the fd output of lsof.

Which syslog-ng version are you using by the way? syslog-ng 3.0 should
properly suspend writing to such a destination as soon as it receives
the "connection refused" error, and then continue only when
time_reopen() time passes. (which is 1 minute by default).

-- 
Bazsi