Hello, I would like to know if the next behaviour it is intentional, or if it is configurable.
I have a nxlog server which forward logs to a logstash server. nxlog will use GELF protocol. If gelf slave service from logstash stop to work. nxlog will have to be restarted to get it working again. I can simulate this issue rejecting the packages in the firewall that there is between both. See the traces: firewall # /sbin/iptables -I FORWARD -p udp -s IP --dport PORT_GELF -j REJECT In NXLOGSERVER: # tcpdump ... 08:15:57.830566 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 264 08:15:57.830978 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 288 08:15:57.831381 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 292 08:15:57.831736 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 281 08:15:57.832335 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 272 08:15:58.761276 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 276 08:15:58.761581 IP 192.168.4.125 > NXLOGSERVER: ICMP LOGSTASHSERVER udp port 12200 unreachable, length 312 08:15:59.763985 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 306 08:15:59.764482 IP 192.168.4.125 > NXLOGSERVER: ICMP LOGSTASHSERVER udp port 12200 unreachable, length 342 08:15:59.764521 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 301 08:15:59.764913 IP 192.168.4.125 > NXLOGSERVER: ICMP LOGSTASHSERVER udp port 12200 unreachable, length 337 .... (Not more trys) In nxlog log appear: 2014-03-04 08:15:59 ERROR om_udp apr_socket_send failed;Connection refused 2014-03-04 08:16:14 ERROR last message repeated 2 times What do you recommend about this ? I'm thinking in monitoring last 2 line at nxlog log , and restarting if Connection refused appear. But I'm sure there is a better way to go Thank you PD: Please cc me, I cannot access to https://sourceforge.net/p/nxlog-ce/mailman/nxlog-ce-users/ (403 http error code is returned when I am logged with my account at sf) ------------------------------------------------------------------------------ Subversion Kills Productivity. Get off Subversion & Make the Move to Perforce. With Perforce, you get hassle-free workflows. Merge that actually works. Faster operations. Version large binaries. Built-in WAN optimization and the freedom to use Git, Perforce or both. Make the move to Perforce. http://pubads.g.doubleclick.net/gampad/clk?id=122218951&iu=/4140/ostg.clktrk _______________________________________________ nxlog-ce-users mailing list nxlog-ce-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
