[syslog-ng] I/O error occurred while writing; fd=\'6\', error=\'Connection refused (111)\'

[Clayton Dukes]

Sorry, I'm just confused.
I'm trying to figure out the source of the error - which destination
it's having trouble writing to.
I don't mind showing my config:

###########################################################################################
# June 06, 2009 Added by cdukes for php-syslog-ng
###########################################################################################
options {
        long_hostnames(off);

        # doesn't actually help on Solaris, log(3) truncates at 1024 chars
        log_msg_size(8192);

        # buffer just a little for performance
        sync(1);

        # memory is cheap, buffer messages unable to write (like to loghost)
        log_fifo_size(16384);

        # Hosts we don't want syslog from
        #bad_hostname("^(ctld.|cmd|tmd|last)$");

        # The time to wait before a dead connection is reestablished (seconds)
        time_reopen(10);

        #Use DNS so that our good names are used, not hostnames
        use_dns(yes);
        dns_cache(yes);

        #Use the whole DNS name
        use_fqdn(yes);

        keep_hostname(yes);
        chain_hostnames(no);

        #Read permission for everyone
        perm(0644);
        # The default action of syslog-ng 1.6.0 is to log a STATS line
        # to the file every 10 minutes.  That's pretty ugly after a while.
        # Change it to every 12 hours so you get a nice daily update of
        # how many messages syslog-ng missed (0).
        stats(43200);
        };

# Create destination to our perl script
destination d_syslogdb {
        program ("/www/php-syslog-ng/scripts/syslog2mysql.pl",
        template
("'$HOST''$FACILITY''$PRIORITY''$LEVEL''$TAG''$YEAR-$MONTH-$DAY''$HOUR:$MIN:$SEC''$PROGRAM''$MSG'\n")
        template_escape(yes)
        );
};

# Tell syslog-ng to log to our new destination
log {
    source(s_all);
    destination(d_syslogdb);
    destination(df_debug);
};


# Added destination for Unity servers for Scott and Joe

# Filter all incoming messages for unity servers
filter f_unitylab { (
    host("^vnt-cm")
    );
};
# Set destination to Joe's lab
destination d_unitylab {
    udp("172.18.106.206" port (514));
};
# Set destnation to Scott's server
destination d_ucsyslog {
    udp("172.18.86.112" port (514));
};

# Log to configured destinations
log {
    source(s_all);
    filter(f_unitylab);
    destination(d_unitylab);
    destination(d_ucsyslog);
};

# END

Strace output:

16624 write(14, "<187>Jun  8 06:59:16 vnt-cm1c.cis"..., 464) = -1
ECONNREFUSED (Connection refused)

# nslookup vnt-cm1c

Name:   vnt-cm1c.x.com
Address: 172.18.106.60

This address doesn't match any of my configured destinations, but does
match an incoming source.


On Mon, Jun 8, 2009 at 9:39 AM, Sandor
Geller<Sandor.Geller at morganstanley.com> wrote:
> Hi,
>
> On Mon, Jun 8, 2009 at 3:25 PM, Clayton Dukes<cdukes at gmail.com> wrote:
>> Hmm,
>> I don't get it - is that what the 7w indicates? If so, there's no 6w...?
>
> It shows that fd 7 is opened for writing, and it's a pipe. It tells
> nothing about what fd 6 was. As we're still missing details about the
> fd in question it would be good to know what's your issue at all...
> Right now without information we could only guess. If you don't want
> to show your config then run syslog-ng under strace to see what's
> failing and where. The issue has to be with a destination where
> syslog-ng can't connect. If my guess is right then the it's the
> *first* destination in your config.
>
> Regards,
>
> Sandor
>



-- 
______________________________________________________________

Clayton Dukes
______________________________________________________________