Hello, I'm investigating this issue. I'm on linux (Centos 5.9). Some times nxlog won't stop to send logs.
But in my environment next bash snip always let nxlog instance without sending logs: At firewall: for f in 1 2 3 do echo "$(date) Rejecting .."; /sbin/iptables -I FORWARD -p udp -s IPORIG --dport DESTPORT -j REJECT ; sleep 2; /sbin/iptables -D FORWARD -p udp -s IPORIG --dport DESTPORT -j REJECT ; sleep 2; echo "$(date) Accepting ..."; done In my first email 192.168.4.125 is the ip of firewall (which is who send ICMP unrecheable network package) Thank you On Tue, Mar 4, 2014 at 12:05 PM, Botond Botyanszki <b...@nxlog.org> wrote: > Hi, > > I couldn't reproduce this, at least not on Linux. > If the listening process is restarted it will resume forwarding and the > errors are only logged during the time when nothing is accepting the udp > packets. > Are you on windows? Die anyone else encounter this issue? > > Regards, > Botond > > > On Tue, 4 Mar 2014 08:58:01 +0100 > Javier Barroso <javibarr...@gmail.com> wrote: > >> Hello, >> >> I would like to know if the next behaviour it is intentional, or if it >> is configurable. >> >> I have a nxlog server which forward logs to a logstash server. nxlog >> will use GELF protocol. >> >> If gelf slave service from logstash stop to work. nxlog will have to >> be restarted to get it working again. >> >> I can simulate this issue rejecting the packages in the firewall that >> there is between both. >> >> See the traces: >> >> firewall # /sbin/iptables -I FORWARD -p udp -s IP --dport PORT_GELF -j >> REJECT >> >> In NXLOGSERVER: >> # tcpdump ... >> 08:15:57.830566 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 264 >> 08:15:57.830978 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 288 >> 08:15:57.831381 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 292 >> 08:15:57.831736 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 281 >> 08:15:57.832335 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 272 >> 08:15:58.761276 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 276 >> 08:15:58.761581 IP 192.168.4.125 > NXLOGSERVER: ICMP LOGSTASHSERVER >> udp port 12200 unreachable, length 312 >> 08:15:59.763985 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 306 >> 08:15:59.764482 IP 192.168.4.125 > NXLOGSERVER: ICMP LOGSTASHSERVER >> udp port 12200 unreachable, length 342 >> 08:15:59.764521 IP NXLOGSERVER.44491 > LOGSTASHSERVER.12200: UDP, length 301 >> 08:15:59.764913 IP 192.168.4.125 > NXLOGSERVER: ICMP LOGSTASHSERVER >> udp port 12200 unreachable, length 337 >> .... >> (Not more trys) >> >> In nxlog log appear: >> 2014-03-04 08:15:59 ERROR om_udp apr_socket_send failed;Connection refused >> 2014-03-04 08:16:14 ERROR last message repeated 2 times >> >> What do you recommend about this ? >> >> I'm thinking in monitoring last 2 line at nxlog log , and restarting >> if Connection refused appear. But I'm sure there is a better way to go >> >> Thank you >> PD: Please cc me, I cannot access to >> https://sourceforge.net/p/nxlog-ce/mailman/nxlog-ce-users/ (403 http >> error code is returned when I am logged with my account at sf) >> >> ------------------------------------------------------------------------------ >> Subversion Kills Productivity. Get off Subversion & Make the Move to >> Perforce. >> With Perforce, you get hassle-free workflows. Merge that actually works. >> Faster operations. Version large binaries. Built-in WAN optimization and the >> freedom to use Git, Perforce or both. Make the move to Perforce. >> http://pubads.g.doubleclick.net/gampad/clk?id=122218951&iu=/4140/ostg.clktrk >> _______________________________________________ >> nxlog-ce-users mailing list >> nxlog-ce-users@lists.sourceforge.net >> https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users > > ------------------------------------------------------------------------------ > Subversion Kills Productivity. Get off Subversion & Make the Move to Perforce. > With Perforce, you get hassle-free workflows. Merge that actually works. > Faster operations. Version large binaries. Built-in WAN optimization and the > freedom to use Git, Perforce or both. Make the move to Perforce. > http://pubads.g.doubleclick.net/gampad/clk?id=122218951&iu=/4140/ostg.clktrk > _______________________________________________ > nxlog-ce-users mailing list > nxlog-ce-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users ------------------------------------------------------------------------------ Subversion Kills Productivity. Get off Subversion & Make the Move to Perforce. With Perforce, you get hassle-free workflows. Merge that actually works. Faster operations. Version large binaries. Built-in WAN optimization and the freedom to use Git, Perforce or both. Make the move to Perforce. http://pubads.g.doubleclick.net/gampad/clk?id=122218951&iu=/4140/ostg.clktrk _______________________________________________ nxlog-ce-users mailing list nxlog-ce-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
