Recurring sink socket errors when forwarding cisco and linux raw syslog #23264
Unanswered
tobykenobi1997
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
I keep getting these errors when forwarding cisco appliance and also some linux syslogs raw to a external.
I tried to get the external site to increased the timeout interval to 10m because maybe it has to do with stale sockets on their side, which they are sending a reset flag when no data has been transferred in 60 seconds. But no luck.
Here are the errors:
2025-06-25T12:08:20.748141Z WARN sink{component_kind="sink" component_id=forward_cisco component_type=socket}: vector::internal_events::tcp: Received EOF from the server, shutdown.
2025-06-25T12:08:20.748200Z ERROR sink{component_kind="sink" component_id=forward_cisco component_type=socket}: vector::internal_events::socket: Error sending data. error=ShutdownCheck::Close error_code="socket_send" error_type="writer_failed" stage="sending" mode=tcp internal_log_rate_limit=true
2025-06-25T12:08:20.748223Z ERROR sink{component_kind="sink" component_id=forward_cisco component_type=socket}: vector_common::internal_event::component_events_dropped: Events dropped intentional=false count=1 reason="Error sending data." internal_log_rate_limit=true
Do you guys have any idea about this? I am also sending other log sources such as a heavy firewall to this external provider and those are are not generating these errros. Only syslog from this cisco appliance and sometimes Linux syslogs.
Beta Was this translation helpful? Give feedback.
All reactions