To rule out any intermediate layer, please run an strace on both rsyslogs. So we get the result codes directly from the OS.
Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Andreas Grosse > Sent: Friday, September 09, 2011 10:46 AM > To: rsyslog-users > Subject: Re: [rsyslog] netstream errors when logging with a high > message rate > > Hi, > thanks for taking the time to look through the debug log! > I did a tcpdump while reproducing that issue and it confirms that the > TCP > connection is not closed. There are no RESET or FIN packets which would > indicate a teardown of the TCP connection, and no SYN packets which > would > be required for a new TCP connection to be established. Although that > error is reported, packets just keep on going over that connection. > > So if the rsyslog code just passes on the OS error, and the error > occurs although the connection is not actually reset, what makes the OS > think that the connection was reset? > > Best regards, > Andreas > > [email protected] <[email protected]> [08:09:11 20:04] wrote: > > is there a firewall or stateful router (including NAT) between the > two > > devices? it could be terminating the connection in the middle and > both > > instances of rsyslog think the other is closing it. > > > > David Lang > > > > On Thu, 8 Sep 2011, Rainer Gerhards wrote: > > > >> Date: Thu, 8 Sep 2011 15:43:50 +0200 > >> From: Rainer Gerhards <[email protected]> > >> Reply-To: rsyslog-users <[email protected]> > >> To: rsyslog-users <[email protected]> > >> Subject: Re: [rsyslog] netstream errors when logging with a high > message rate > >> > >> Thanks for the debug log. Unfortunately, it points to the remote > peer as > >> well. I have quickly checked the code. The message "Connection reset > by peer" > >> is directly generated by strerror() and thus represents the proper > cause of > >> the error as the OS sees it. All in all I conclude that the remote > machine > >> has closed the session for some reason. I suggest to run both > instances under > >> debug log and check both logs when the problem occurs (or forward > them to > >> me). > >> > >> Rainer > >> > >>> -----Original Message----- > >>> From: [email protected] [mailto:rsyslog- > >>> [email protected]] On Behalf Of Andreas Grosse > >>> Sent: Thursday, September 08, 2011 2:47 PM > >>> To: rsyslog-users > >>> Subject: Re: [rsyslog] netstream errors when logging with a high > message > >>> rate > >>> > >>> Rainer Gerhards <[email protected]> [08:09:11 14:35] wrote: > >>>> Maybe I do not need the complete log, because... > >>>> > >>>>>> Debug output of the thread managing this netstream when the > error > >>>>>> occured: > >>>>>> 4442.720793561:40976b70: netstream 0x4100cab0 with new data > >>>>>> 4442.720833000:40976b70: error during recv on NSD 0x413d1ae8: > >>>>>> Connection reset by peer > >>>> > >>>> It looks like the remote peer has closed the session. Any idea > why? > >>> > >>> It logs this message, but we have no indication on the receiving > end that > >>> there is an error or that the connection is closed. There is also > nothing > >> in the > >>> rsyslog debug log that shows that a tcp reconnect is necessary; the > thread > >>> just continues to receive data after that error. > >>> I'll just send you the complete debug log in a separate mail. > >>> Best regards, > >>> Andreas > >>> _______________________________________________ > >>> rsyslog mailing list > >>> http://lists.adiscon.net/mailman/listinfo/rsyslog > >>> http://www.rsyslog.com > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com > >> > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
