syslog-ng syslog connection broken on udpStarting syslog-ngHow to exclude given lines in syslog-ng?Log...
The most awesome army: 80 men left and 81 returned. Is it true?
California: "For quality assurance, this phone call is being recorded"
How can I offer a test ride while selling a bike?
Orientable with respect to complex cobordism?
what's the equivalent of helper in LWC?
What is the most important characteristic of New Weird as a genre?
What does it mean by "d-ism of Leibniz" and "dotage of Newton" in simple English?
The term for the person/group a political party aligns themselves with to appear concerned about the general public
Select * from View takes 4 minutes
Strange math syntax in old basic listing
How to detach yourself from a character you're going to kill?
Opposite of "Squeaky wheel gets the grease"
What is the intuition behind uniform continuity?
Is having a hidden directory under /etc safe?
Why don't I have ground wiring on any of my outlets?
Looking for an old image of designing a cpu with plan laid out / being edited on a literal floor
The qvolume of an integer
Does a component pouch automatically contain components?
Estimate related to the Möbius function
Can you use a concentration spell while using Mantle of Majesty?
Rotated Position of Integers
Why would Lupin kill Pettigrew?
How can a single Member of the House block a Congressional bill?
What's the most polite way to tell a manager "shut up and let me work"?
syslog-ng syslog connection broken on udp
Starting syslog-ngHow to exclude given lines in syslog-ng?Log transfer using syslog-ng 3.3.5Syslog service fails to startSyslog-ng destination not workingDon't read specified file source in syslog-ng?syslog-ng make error - iv.h: No such file or directorysyslog message format & syslog-ngsyslog-ng permissions to read /var/log
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0;
}
We have following remote logging configuration:
destination d_jenkins { network("x.x.x.x" transport("udp") port(514) template(t_jenkins)); };
log { source(s_system); destination(d_jenkins); };
This is a syslog-ng server to syslog-ng client communication. Occasionally we are getting following errors. Seems like EINVAL (22) is coming from write() call.
2016-10-19T15:12:39.393+00:00 axis-accc8e59xxxx [ ERR ] syslog-ng[1707]: I/O error occurred while writing; fd='28', error='Invalid argument (22)'
2016-10-19T15:12:39.394+00:00 axis-accc8e59xxxx [ NOTICE ] syslog-ng[1707]: Syslog connection broken; fd='28', server='AF_INET(172.27.0.34:514)', time_reopen=’60'
- Is it that network is problematic or am I missing some configuration?
- Could it be that syslog-ng server is being HUPed without our
knowledge, dropping the connections. - Could using TCP with keep-alive help the problem?
syslog-ng
asked Oct 20 '16 at 9:40
UmutUmut
1917
bumped to the homepage by Community♦ 18 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
We have following remote logging configuration:
destination d_jenkins { network("x.x.x.x" transport("udp") port(514) template(t_jenkins)); };
log { source(s_system); destination(d_jenkins); };
This is a syslog-ng server to syslog-ng client communication. Occasionally we are getting following errors. Seems like EINVAL (22) is coming from write() call.
2016-10-19T15:12:39.393+00:00 axis-accc8e59xxxx [ ERR ] syslog-ng[1707]: I/O error occurred while writing; fd='28', error='Invalid argument (22)'
2016-10-19T15:12:39.394+00:00 axis-accc8e59xxxx [ NOTICE ] syslog-ng[1707]: Syslog connection broken; fd='28', server='AF_INET(172.27.0.34:514)', time_reopen=’60'
- Is it that network is problematic or am I missing some configuration?
- Could it be that syslog-ng server is being HUPed without our
knowledge, dropping the connections. - Could using TCP with keep-alive help the problem?
syslog-ng
asked Oct 20 '16 at 9:40
UmutUmut
1917
bumped to the homepage by Community♦ 18 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
1
UDP is connectionless, which should negate anything about "dropped connections". Using TCP might give you clearer problem reports.
– a CVn
Oct 20 '16 at 9:51
Whilst UDP is connectionless, additional checks can be done at layer 7 in certain apllications. TCP keepalives well, are for TCP connections. Could it be syslog restarts? How many servers are you pointing to the remote syslog?
– Rui F Ribeiro
Oct 21 '16 at 2:25
add a comment |
We have following remote logging configuration:
destination d_jenkins { network("x.x.x.x" transport("udp") port(514) template(t_jenkins)); };
log { source(s_system); destination(d_jenkins); };
This is a syslog-ng server to syslog-ng client communication. Occasionally we are getting following errors. Seems like EINVAL (22) is coming from write() call.
2016-10-19T15:12:39.393+00:00 axis-accc8e59xxxx [ ERR ] syslog-ng[1707]: I/O error occurred while writing; fd='28', error='Invalid argument (22)'
2016-10-19T15:12:39.394+00:00 axis-accc8e59xxxx [ NOTICE ] syslog-ng[1707]: Syslog connection broken; fd='28', server='AF_INET(172.27.0.34:514)', time_reopen=’60'
- Is it that network is problematic or am I missing some configuration?
- Could it be that syslog-ng server is being HUPed without our
knowledge, dropping the connections. - Could using TCP with keep-alive help the problem?
syslog-ng
asked Oct 20 '16 at 9:40
UmutUmut
1917
We have following remote logging configuration:
destination d_jenkins { network("x.x.x.x" transport("udp") port(514) template(t_jenkins)); };
log { source(s_system); destination(d_jenkins); };
This is a syslog-ng server to syslog-ng client communication. Occasionally we are getting following errors. Seems like EINVAL (22) is coming from write() call.
2016-10-19T15:12:39.393+00:00 axis-accc8e59xxxx [ ERR ] syslog-ng[1707]: I/O error occurred while writing; fd='28', error='Invalid argument (22)'
2016-10-19T15:12:39.394+00:00 axis-accc8e59xxxx [ NOTICE ] syslog-ng[1707]: Syslog connection broken; fd='28', server='AF_INET(172.27.0.34:514)', time_reopen=’60'
- Is it that network is problematic or am I missing some configuration?
- Could it be that syslog-ng server is being HUPed without our
knowledge, dropping the connections. - Could using TCP with keep-alive help the problem?
syslog-ng
syslog-ng
asked Oct 20 '16 at 9:40
UmutUmut
1917
asked Oct 20 '16 at 9:40
UmutUmut
1917
asked Oct 20 '16 at 9:40
UmutUmut
1917
asked Oct 20 '16 at 9:40
UmutUmut
1917
asked Oct 20 '16 at 9:40
UmutUmut
1917
1917
bumped to the homepage by Community♦ 18 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
bumped to the homepage by Community♦ 18 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
1
UDP is connectionless, which should negate anything about "dropped connections". Using TCP might give you clearer problem reports.
– a CVn
Oct 20 '16 at 9:51
Whilst UDP is connectionless, additional checks can be done at layer 7 in certain apllications. TCP keepalives well, are for TCP connections. Could it be syslog restarts? How many servers are you pointing to the remote syslog?
– Rui F Ribeiro
Oct 21 '16 at 2:25
add a comment |
1
UDP is connectionless, which should negate anything about "dropped connections". Using TCP might give you clearer problem reports.
– a CVn
Oct 20 '16 at 9:51
Whilst UDP is connectionless, additional checks can be done at layer 7 in certain apllications. TCP keepalives well, are for TCP connections. Could it be syslog restarts? How many servers are you pointing to the remote syslog?
– Rui F Ribeiro
Oct 21 '16 at 2:25
1
1
UDP is connectionless, which should negate anything about "dropped connections". Using TCP might give you clearer problem reports.
– a CVn
Oct 20 '16 at 9:51
UDP is connectionless, which should negate anything about "dropped connections". Using TCP might give you clearer problem reports.
– a CVn
Oct 20 '16 at 9:51
Whilst UDP is connectionless, additional checks can be done at layer 7 in certain apllications. TCP keepalives well, are for TCP connections. Could it be syslog restarts? How many servers are you pointing to the remote syslog?
– Rui F Ribeiro
Oct 21 '16 at 2:25
Whilst UDP is connectionless, additional checks can be done at layer 7 in certain apllications. TCP keepalives well, are for TCP connections. Could it be syslog restarts? How many servers are you pointing to the remote syslog?
– Rui F Ribeiro
Oct 21 '16 at 2:25
add a comment |
1 Answer
1
active
oldest
votes
What is the message rate of the sender host? Are there any other destinations?
Turn on verbose logging on the client to see if there are some additional messages that might help (syslog-ng-ctl verbose --set=on ), and try to increase the so-sndbuf() option of the destination.
(Sorry for posting this as an answer, I'm not allowed to comment)
answered Oct 21 '16 at 7:50
Robert FeketeRobert Fekete
1755
Rate shouldn't be a problem, it is no more than 10 message per second. I will try your recommendations.
– Umut
Oct 22 '16 at 6:28
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f317656%2fsyslog-ng-syslog-connection-broken-on-udp%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
What is the message rate of the sender host? Are there any other destinations?
Turn on verbose logging on the client to see if there are some additional messages that might help (syslog-ng-ctl verbose --set=on ), and try to increase the so-sndbuf() option of the destination.
(Sorry for posting this as an answer, I'm not allowed to comment)
answered Oct 21 '16 at 7:50
Robert FeketeRobert Fekete
1755
Rate shouldn't be a problem, it is no more than 10 message per second. I will try your recommendations.
– Umut
Oct 22 '16 at 6:28
add a comment |
What is the message rate of the sender host? Are there any other destinations?
Turn on verbose logging on the client to see if there are some additional messages that might help (syslog-ng-ctl verbose --set=on ), and try to increase the so-sndbuf() option of the destination.
(Sorry for posting this as an answer, I'm not allowed to comment)
answered Oct 21 '16 at 7:50
Robert FeketeRobert Fekete
1755
Rate shouldn't be a problem, it is no more than 10 message per second. I will try your recommendations.
– Umut
Oct 22 '16 at 6:28
add a comment |
What is the message rate of the sender host? Are there any other destinations?
Turn on verbose logging on the client to see if there are some additional messages that might help (syslog-ng-ctl verbose --set=on ), and try to increase the so-sndbuf() option of the destination.
(Sorry for posting this as an answer, I'm not allowed to comment)
answered Oct 21 '16 at 7:50
Robert FeketeRobert Fekete
1755
What is the message rate of the sender host? Are there any other destinations?
Turn on verbose logging on the client to see if there are some additional messages that might help (syslog-ng-ctl verbose --set=on ), and try to increase the so-sndbuf() option of the destination.
(Sorry for posting this as an answer, I'm not allowed to comment)
answered Oct 21 '16 at 7:50
Robert FeketeRobert Fekete
1755
answered Oct 21 '16 at 7:50
Robert FeketeRobert Fekete
1755
answered Oct 21 '16 at 7:50
Robert FeketeRobert Fekete
1755
answered Oct 21 '16 at 7:50
Robert FeketeRobert Fekete
1755
1755
Rate shouldn't be a problem, it is no more than 10 message per second. I will try your recommendations.
– Umut
Oct 22 '16 at 6:28
add a comment |
Rate shouldn't be a problem, it is no more than 10 message per second. I will try your recommendations.
– Umut
Oct 22 '16 at 6:28
Rate shouldn't be a problem, it is no more than 10 message per second. I will try your recommendations.
– Umut
Oct 22 '16 at 6:28
Rate shouldn't be a problem, it is no more than 10 message per second. I will try your recommendations.
– Umut
Oct 22 '16 at 6:28
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f317656%2fsyslog-ng-syslog-connection-broken-on-udp%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
UDP is connectionless, which should negate anything about "dropped connections". Using TCP might give you clearer problem reports.
– a CVn
Oct 20 '16 at 9:51
Whilst UDP is connectionless, additional checks can be done at layer 7 in certain apllications. TCP keepalives well, are for TCP connections. Could it be syslog restarts? How many servers are you pointing to the remote syslog?
– Rui F Ribeiro
Oct 21 '16 at 2:25