1

We have following remote logging configuration:

destination d_jenkins { network("x.x.x.x" transport("udp") port(514) template(t_jenkins)); };
log { source(s_system); destination(d_jenkins); };

This is a syslog-ng server to syslog-ng client communication. Occasionally we are getting following errors. Seems like EINVAL (22) is coming from write() call.

2016-10-19T15:12:39.393+00:00 axis-accc8e59xxxx [ ERR     ] syslog-ng[1707]: I/O error occurred while writing; fd='28', error='Invalid argument (22)'
2016-10-19T15:12:39.394+00:00 axis-accc8e59xxxx [ NOTICE  ] syslog-ng[1707]: Syslog connection broken; fd='28', server='AF_INET(172.27.0.34:514)', time_reopen=’60'
  • Is it that network is problematic or am I missing some configuration?
  • Could it be that syslog-ng server is being HUPed without our knowledge, dropping the connections.
  • Could using TCP with keep-alive help the problem?
|improve this question
  • 1
    UDP is connectionless, which should negate anything about "dropped connections". Using TCP might give you clearer problem reports. – a CVn Oct 20 '16 at 9:51
  • Whilst UDP is connectionless, additional checks can be done at layer 7 in certain apllications. TCP keepalives well, are for TCP connections. Could it be syslog restarts? How many servers are you pointing to the remote syslog? – Rui F Ribeiro Oct 21 '16 at 2:25
0

What is the message rate of the sender host? Are there any other destinations? Turn on verbose logging on the client to see if there are some additional messages that might help (syslog-ng-ctl verbose --set=on ), and try to increase the so-sndbuf() option of the destination.

(Sorry for posting this as an answer, I'm not allowed to comment)

|improve this answer
  • Rate shouldn't be a problem, it is no more than 10 message per second. I will try your recommendations. – Umut Oct 22 '16 at 6:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.