Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

Mon, 18 Sep 2023 06:10:30 -0700 

 


This email may contain proprietary information of BAE Systems and/or third 
parties.
 
Sorry, replied to the wrong message.

-----Original Message-----
From: rsyslog <rsyslog-boun...@lists.adiscon.com> On Behalf Of Lennon, Sean 
(UK) via rsyslog
Sent: 18 September 2023 14:09
To: rsyslog-users <rsyslog@lists.adiscon.com>
Cc: Lennon, Sean (UK) <sean.lenn...@baesystems.com>
Subject: Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

-----------------------------  PHISHING ALERT  ----------------------------- 
This email has been sent from an account outside of the BAE Systems network.

Please treat the email with caution, especially if you are requested to click 
on a link or open an attachment.
For further information on how to spot and report a phishing email please 
access the Global Intranet, then select <Functions> / <IT>.

------------------------------------------------------------------------------------


 


This email may contain proprietary information of BAE Systems and/or third 
parties.
 
Hi,

Has anyone got any thoughts/suggestions on this?

Cheers,

Sean.

-----Original Message-----
From: rsyslog <rsyslog-boun...@lists.adiscon.com> On Behalf Of David Lang via 
rsyslog
Sent: 18 September 2023 08:22
To: TG Servers via rsyslog <rsyslog@lists.adiscon.com>
Cc: David Lang <da...@lang.hm>
Subject: Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

-----------------------------  PHISHING ALERT  ----------------------------- 
This email has been sent from an account outside of the BAE Systems network.

Please treat the email with caution, especially if you are requested to click 
on a link or open an attachment.
For further information on how to spot and report a phishing email please 
access the Global Intranet, then select <Functions> / <IT>.

------------------------------------------------------------------------------------

my thought is that if rsyslog is getting blocked (queues full) then it will 
stop accepting new logs via unix sockets.

can you enable impstats and see if you have any reports of the main queue being 
full during the times that this happens?

full configs for rsyslog could identify if there is anything you have there 
that is likely to block for extended times.

David Lang


On Sun, 17 Sep 2023, TG Servers via rsyslog wrote:

> Hi,
>
> ever since I started logging to a UDS from my nginx I get the 
> occasional
> 111 in my nginx error logs.
> As I literally don't have any other information or log entries I 
> honestly do not know how to debug this.
> The thing is requests one second, or a few seconds later are processed 
> totally fine, so it cannot be a general problem, nor a access problem 
> or a permission problem.
> I would be glad if anyone could help on fixing this
>
> Examples:
> error.log:2023/09/17 02:41:59 [error] 346192#346192: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 02:41:59 [error] 346191#346191: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 02:52:19 [error] 346192#346192: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 04:09:44 [error] 346193#346193: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 04:09:45 [error] 346185#346185: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 04:20:20 [error] 346186#346186: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 06:20:01 [error] 346182#346182: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 08:32:35 [error] 346182#346182: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 08:32:35 [error] 346188#346188: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 09:34:34 [error] 346183#346183: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 09:34:35 [error] 346183#346183: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
> error.log:2023/09/17 16:00:25 [error] 346187#346187: send() failed (111: 
> Connection refused) while logging to syslog, server: 
> unix:/var/cache/nginx/rsyslog.socket
>
> configuration for this single use case, of course there is a lot more 
> in rsyslog.conf $AddUnixListenSocket /var/cache/nginx/rsyslog.socket
>
> $template app,"%msg:2:$%"
>
> if $programname == "app" then {
>    ^/usr/local/script/app_log.sh;app
>    stop
> }
>
> The script app_log.sh does simply
> echo "${@}" | /usr/bin/python <python_script>
>
> Many thanks
>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE 
> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you 
> DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is 
a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our 
control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
********************************************************************
This email and any attachments are confidential to the intended recipient and 
may also be privileged. If you are not the intended recipient please delete it 
from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or distribute its 
contents to any other person.
********************************************************************

BAE Systems may process information about you that may be subject to data 
protection laws. For more information about how we use your personal 
information, how we protect your information, our legal basis for using your 
information, your rights and who you can contact, please refer to our Privacy 
Notice at www.baesystems.com/en/privacy 
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is 
a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our 
control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Reply via email to