Hello,
I recently upgraded graylog from 2.5.0 to 3.0.0. Everything went well and Graylog appears to be fully operational running as the new version. The only issue I’m seeing is the error below in my logs repeating every few seconds. The Input referenced in the error (Syslog TCP/5732402951a8d50ab1997cea) is a Syslog TCP connection without TLS enabled that receives logs from our Palo Alto firewalls. The logs from these devices are still being indexed and I do not see any issues with the input stopping/starting. I realize the error (connection reset by peer) indicates that the peer is resetting the connection but nothing changed with the environment outside of the graylog update and I never got this error in version 2.x. If you could provide any insight into what may be causing the error or if i can provide any more information please let me know.
2019-03-06 11:53:21,709 ERROR: org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Error in Input [Syslog TCP/5732402951a8d50ab1997cea] (channel [id: 0xd1fd7363, L:/192.168.9.25:5514 ! R:/192.168.12.5:39622]) (cause io.netty.channel.unix.Errors$NativeIoException: syscall:read(…) failed: Connection reset by peer)
2019-03-06 11:53:29,852 ERROR: org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Error in Input [Syslog TCP/5732402951a8d50ab1997cea] (channel [id: 0xea651101, L:/192.168.9.25:5514 ! R:/10.110.120.1:36834]) (cause io.netty.channel.unix.Errors$NativeIoException: syscall:read(…) failed: Connection reset by peer)
2019-03-06 11:53:30,528 ERROR: org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Error in Input [Syslog TCP/5732402951a8d50ab1997cea] (channel [id: 0x3d5f27f9, L:/192.168.9.25:5514 ! R:/192.168.12.5:60063]) (cause io.netty.channel.unix.Errors$NativeIoException: syscall:read(…) failed: Connection reset by peer)