Hi, thanks for taking the time to look through the debug log! I did a tcpdump while reproducing that issue and it confirms that the TCP connection is not closed. There are no RESET or FIN packets which would indicate a teardown of the TCP connection, and no SYN packets which would be required for a new TCP connection to be established. Although that error is reported, packets just keep on going over that connection.
So if the rsyslog code just passes on the OS error, and the error occurs although the connection is not actually reset, what makes the OS think that the connection was reset? Best regards, Andreas [email protected] <[email protected]> [08:09:11 20:04] wrote: > is there a firewall or stateful router (including NAT) between the two > devices? it could be terminating the connection in the middle and both > instances of rsyslog think the other is closing it. > > David Lang > > On Thu, 8 Sep 2011, Rainer Gerhards wrote: > >> Date: Thu, 8 Sep 2011 15:43:50 +0200 >> From: Rainer Gerhards <[email protected]> >> Reply-To: rsyslog-users <[email protected]> >> To: rsyslog-users <[email protected]> >> Subject: Re: [rsyslog] netstream errors when logging with a high message >> rate >> >> Thanks for the debug log. Unfortunately, it points to the remote peer as >> well. I have quickly checked the code. The message "Connection reset by peer" >> is directly generated by strerror() and thus represents the proper cause of >> the error as the OS sees it. All in all I conclude that the remote machine >> has closed the session for some reason. I suggest to run both instances under >> debug log and check both logs when the problem occurs (or forward them to >> me). >> >> Rainer >> >>> -----Original Message----- >>> From: [email protected] [mailto:rsyslog- >>> [email protected]] On Behalf Of Andreas Grosse >>> Sent: Thursday, September 08, 2011 2:47 PM >>> To: rsyslog-users >>> Subject: Re: [rsyslog] netstream errors when logging with a high message >>> rate >>> >>> Rainer Gerhards <[email protected]> [08:09:11 14:35] wrote: >>>> Maybe I do not need the complete log, because... >>>> >>>>>> Debug output of the thread managing this netstream when the error >>>>>> occured: >>>>>> 4442.720793561:40976b70: netstream 0x4100cab0 with new data >>>>>> 4442.720833000:40976b70: error during recv on NSD 0x413d1ae8: >>>>>> Connection reset by peer >>>> >>>> It looks like the remote peer has closed the session. Any idea why? >>> >>> It logs this message, but we have no indication on the receiving end that >>> there is an error or that the connection is closed. There is also nothing >> in the >>> rsyslog debug log that shows that a tcp reconnect is necessary; the thread >>> just continues to receive data after that error. >>> I'll just send you the complete debug log in a separate mail. >>> Best regards, >>> Andreas >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
