[syslog-ng] unidirectional unix-stream

[Balazs Scheidler]

Syslog-ng doesnt expect data on the socket on the reverse direction and
shuts down the connection if anything is received.

It is meant to work with /dev/log like devices.

I was wondering if it's correct to ignore the reverse direction, is it?

On Apr 12, 2017 2:34 PM, "Jim Hendrick" <james.r.hendrick at gmail.com> wrote:

> Do you have access to the sourcode of otherapp ?
>
> My first guess would be to look at the options of how each end handles the
> socket.
>
> Jim
>
>
> On Wed, Apr 12, 2017 at 7:21 AM, Fabien Wernli <wernli at in2p3.fr> wrote:
>
>> Hi,
>>
>> I'm trying to use the unix-stream destination to send data to another
>> application which opens the socket in line mode. The problem is that both
>> ends complain about the connection breaking all the time:
>>
>>     syslog-ng[31002]: Syslog connection broken; fd='24',
>> server='AF_UNIX(/var/run/otherapp.sock)', time_reopen='60'
>>     otherapp[123445]: failed to read from socket #10: Connection reset by
>> peer
>>
>> I tracked down the problem to the fact that otherapp sends some data
>> after receiving a line from syslog-ng: "data ok", and syslog-ng doesn't
>> seem to like that.
>>
>> If I set up a unidirectional proxy (that filters out upstream "data ok")
>> between syslog-ng and otherapp everything works fine:
>>
>>     socat -u UNIX-LISTEN:/tmp/proxy.sock,fork
>> UNIX-CONNECT:/var/run/otherapp.sock
>>
>> Am I doing something wrong here, or is this a known limitation of
>> syslog-ng?
>>
>> ____________________________________________________________
>> __________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation: http://www.balabit.com/support/documentation/?product=
>> syslog-ng
>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>>
>>
>
> ____________________________________________________________
> __________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20170412/0ab95bbe/attachment.html>