Hi, I couldn't reproduce this, at least not on Linux. If the listening process is restarted it will resume forwarding and the errors are only logged during the time when nothing is accepting the udp packets. Are you on windows? Die anyone else encounter this issue?
Regards, Botond On Tue, 4 Mar 2014 08:58:01 +0100 Javier Barroso <javibarr...@gmail.com> wrote: > Hello, > > I would like to know if the next behaviour it is intentional, or if it > is configurable. > > I have a nxlog server which forward logs to a logstash server. nxlog > will use GELF protocol. > > If gelf slave service from logstash stop to work. nxlog will have to > be restarted to get it working again. > > I can simulate this issue rejecting the packages in the firewall that > there is between both. > > See the traces: > > firewall # /sbin/iptables -I FORWARD -p udp -s IP --dport PORT_GELF -j REJECT > > In NXLOGSERVER: > # tcpdump ... > 08:15:57.830566 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 264 > 08:15:57.830978 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 288 > 08:15:57.831381 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 292 > 08:15:57.831736 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 281 > 08:15:57.832335 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 272 > 08:15:58.761276 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 276 > 08:15:58.761581 IP 192.168.4.125 > NXLOGSERVER: ICMP LOGSTASHSERVER > udp port 12200 unreachable, length 312 > 08:15:59.763985 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 306 > 08:15:59.764482 IP 192.168.4.125 > NXLOGSERVER: ICMP LOGSTASHSERVER > udp port 12200 unreachable, length 342 > 08:15:59.764521 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 301 > 08:15:59.764913 IP 192.168.4.125 > NXLOGSERVER: ICMP LOGSTASHSERVER > udp port 12200 unreachable, length 337 > .... > (Not more trys) > > In nxlog log appear: > 2014-03-04 08:15:59 ERROR om_udp apr_socket_send failed;Connection refused > 2014-03-04 08:16:14 ERROR last message repeated 2 times > > What do you recommend about this ? > > I'm thinking in monitoring last 2 line at nxlog log , and restarting > if Connection refused appear. But I'm sure there is a better way to go > > Thank you > PD: Please cc me, I cannot access to > https://sourceforge.net/p/nxlog-ce/mailman/nxlog-ce-users/ (403 http > error code is returned when I am logged with my account at sf) > > ------------------------------------------------------------------------------ > Subversion Kills Productivity. Get off Subversion & Make the Move to Perforce. > With Perforce, you get hassle-free workflows. Merge that actually works. > Faster operations. Version large binaries. Built-in WAN optimization and the > freedom to use Git, Perforce or both. Make the move to Perforce. > http://pubads.g.doubleclick.net/gampad/clk?id=122218951&iu=/4140/ostg.clktrk > _______________________________________________ > nxlog-ce-users mailing list > nxlog-ce-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users ------------------------------------------------------------------------------ Subversion Kills Productivity. Get off Subversion & Make the Move to Perforce. With Perforce, you get hassle-free workflows. Merge that actually works. Faster operations. Version large binaries. Built-in WAN optimization and the freedom to use Git, Perforce or both. Make the move to Perforce. http://pubads.g.doubleclick.net/gampad/clk?id=122218951&iu=/4140/ostg.clktrk _______________________________________________ nxlog-ce-users mailing list nxlog-ce-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
