[syslog-ng] I/O error occurred while writing; fd=\'6\', error=\'Connection refused (111)\'

[Clayton Dukes]

I think it's a source(?):
16624 write(14, "<187>Jun  8 06:59:16 vnt-cm1c.cis"..., 464) = -1
ECONNREFUSED (Connection refused)

# nslookup vnt-cm1c

Name:   vnt-cm1c.x.com
Address: 172.18.106.60

This address doesn't match any of my configured destinations, but does
match an incoming source.





On Mon, Jun 8, 2009 at 4:23 AM, Balazs Scheidler<bazsi at balabit.hu> wrote:
> On Sun, 2009-06-07 at 11:15 -0400, Clayton Dukes wrote:
>> Alrighty! I think I have the culprit...
>>
>> > Are you sure that fd=6 refers to the pipe in question? That can be
>> > checked using lsof.
>>
>> I checked lsof, but didn't find anything other than a pipe (I think)
>>
>> syslog-ng  1009       root    7w     FIFO        0,6              1232190 pipe
>>
>> However an strace did yield some good information, now that I know
>> what to look for:
>>
>> 1009  write(6, "<187>Jun  7 10:56:54 vnt-cm1d.cis"..., 277) = -1
>> ECONNREFUSED (Connection refused)
>>
>> This clued me in that, in fact, you are correct - it's not my perl
>> pipe that is the problem.
>> I'd forgotten that I had added some new destinations the other day to
>> some other servers in the lab, here's the config for that:
>>
>>
>> # Added destination for Unity servers for Scott and Joe
>>
>> # Filter all incoming messages for unity server sources
>> filter f_unitylab { (
>>     host("^vnt-cm")
>>     );
>> };
>> # Set destination to Joe's lab
>> destination d_unitylab {
>>     udp("172.16.106.206" port (514));
>> };
>> # Set destnation to Scott's server
>> destination d_ucsyslog {
>>     udp("172.16.86.112" port (514));
>> };
>>
>> # Log to configured destinations
>> log {
>>     source(s_all);
>>     filter(f_unitylab);
>>     destination(d_unitylab);
>>     destination(d_ucsyslog);
>> };
>>
>> It looks like I'm getting an ECONNREFUSED from one of the sources (vnt-cm1d)?
>> I would think the connection refused would be a destination, not a
>> source - or am I just reading that wrong?
>>
>> Thanks for your help (and sorry that I forgot about the new config!) :-)
>
> Hmm, why do you think it is a source? It seems to be a destination to
> me. And you can get the information of which one it is by checking out
> the fd output of lsof.
>
> Which syslog-ng version are you using by the way? syslog-ng 3.0 should
> properly suspend writing to such a destination as soon as it receives
> the "connection refused" error, and then continue only when
> time_reopen() time passes. (which is 1 minute by default).
>
> --
> Bazsi
>
>



-- 
______________________________________________________________

Clayton Dukes
______________________________________________________________