ERROR om_tcp send failed; An existing connection was forcibly closed by the remote host


(Taylor Duncan) #1

Good afternoon fellow loggers. I have a strange issue I am dealing with. I just recently started sending logs from some of my IIS machines to graylog using gelfUDP. It worked great… I went today to add some additional servers and I am having some problems with the new servers- nothing is logging. I am using nxlog to send data to graylog. I have absolutely verified there are no firewalls blocking any connections. So the next thing I tried was gelfTCP obviously to see what error is happening. So I now have nxlog setup to connect to my server via TCP and I received this error:

ERROR om_tcp send failed; An existing connection was forcibly closed by the remote host

I am unable to find anything useful online to help me with this one. I thought maybe the receive buffer size needed to be adjusted, but that did not appear to be the problems after I tested. Does anyone have any recommendations on how to solve this problem, or has anyone else experienced this issue?


(Taylor Duncan) #2

So as an update to this I added a test input for RAW TCP and changed the output on NXlog to Binary. I am now able to see data coming into graylog. I suspect this is an issue with GELF, but I have no idea why.