Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

Mon, 18 Sep 2023 06:09:10 -0700 

 


This email may contain proprietary information of BAE Systems and/or third 
parties.
 
Hi,

Has anyone got any thoughts/suggestions on this?

Cheers,

Sean.

-----Original Message-----
From: rsyslog <rsyslog-boun...@lists.adiscon.com> On Behalf Of David Lang via 
rsyslog
Sent: 18 September 2023 08:22
To: TG Servers via rsyslog <rsyslog@lists.adiscon.com>
Cc: David Lang <da...@lang.hm>
Subject: Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

-----------------------------  PHISHING ALERT  -----------------------------
This email has been sent from an account outside of the BAE Systems network.

Please treat the email with caution, especially if you are requested to click 
on a link or open an attachment.
For further information on how to spot and report a phishing email please 
access the Global Intranet, then select <Functions> / <IT>.

------------------------------------------------------------------------------------

my thought is that if rsyslog is getting blocked (queues full) then it will 
stop 
accepting new logs via unix sockets.

can you enable impstats and see if you have any reports of the main queue being 
full during the times that this happens?

full configs for rsyslog could identify if there is anything you have there 
that 
is likely to block for extended times.

David Lang


On Sun, 17 Sep 2023, TG Servers via rsyslog wrote:

> Hi,
>
> ever since I started logging to a UDS from my nginx I get the occasional 
> 111 in my nginx error logs.
> As I literally don't have any other information or log entries I 
> honestly do not know how to debug this.
> The thing is requests one second, or a few seconds later are processed 
> totally fine, so it cannot be a general problem, nor a access problem or 
> a permission problem.
> I would be glad if anyone could help on fixing this
>
> Examples:
> error.log:2023/09/17 02:41:59 [error] 346192#346192: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 02:41:59 [error] 346191#346191: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 02:52:19 [error] 346192#346192: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 04:09:44 [error] 346193#346193: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 04:09:45 [error] 346185#346185: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 04:20:20 [error] 346186#346186: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 06:20:01 [error] 346182#346182: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 08:32:35 [error] 346182#346182: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 08:32:35 [error] 346188#346188: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 09:34:34 [error] 346183#346183: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 09:34:35 [error] 346183#346183: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 16:00:25 [error] 346187#346187: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
>
> configuration for this single use case, of course there is a lot more in 
> rsyslog.conf
> $AddUnixListenSocket /var/cache/nginx/rsyslog.socket
>
> $template app,"%msg:2:$%"
>
> if $programname == "app" then {
>    ^/usr/local/script/app_log.sh;app
>    stop
> }
>
> The script app_log.sh does simply
> echo "${@}" | /usr/bin/python <python_script>
>
> Many thanks
>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T 
> LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.
********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

BAE Systems may process information about you that may be subject to data 
protection
laws. For more information about how we use your personal information, how we 
protect
your information, our legal basis for using your information, your rights and 
who you can
contact, please refer to our Privacy Notice at www.baesystems.com/en/privacy
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Reply via email to