1

We have following remote logging configuration:

destination d_jenkins { network("x.x.x.x" transport("udp") port(514) template(t_jenkins)); };
log { source(s_system); destination(d_jenkins); };

This is a syslog-ng server to syslog-ng client communication. Occasionally we are getting following errors. Seems like EINVAL (22) is coming from write() call.

2016-10-19T15:12:39.393+00:00 axis-accc8e59xxxx [ ERR     ] syslog-ng[1707]: I/O error occurred while writing; fd='28', error='Invalid argument (22)'
2016-10-19T15:12:39.394+00:00 axis-accc8e59xxxx [ NOTICE  ] syslog-ng[1707]: Syslog connection broken; fd='28', server='AF_INET(172.27.0.34:514)', time_reopen=’60'
  • Is it that network is problematic or am I missing some configuration?
  • Could it be that syslog-ng server is being HUPed without our knowledge, dropping the connections.
  • Could using TCP with keep-alive help the problem?
Improve this question
4
  • 2
    UDP is connectionless, which should negate anything about "dropped connections". Using TCP might give you clearer problem reports.
    – user
    Oct 20, 2016 at 9:51
  • Whilst UDP is connectionless, additional checks can be done at layer 7 in certain apllications. TCP keepalives well, are for TCP connections. Could it be syslog restarts? How many servers are you pointing to the remote syslog?
    – Rui F Ribeiro
    Oct 21, 2016 at 2:25
  • What is the message rate of the sender host? Are there any other destinations? Turn on verbose logging on the client to see if there are some additional messages that might help (syslog-ng-ctl verbose --set=on ), and try to increase the so-sndbuf() option of the destination. (Sorry for posting this as an answer, I'm not allowed to comment)
    – Robert Fekete
    Oct 21, 2016 at 7:50
  • Rate shouldn't be a problem, it is no more than 10 message per second. I will try your recommendations.
    – Umut
    Oct 22, 2016 at 6:28

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.