From owner-freebsd-bugs@FreeBSD.ORG Wed Feb 4 16:38:23 2015 Return-Path: Delivered-To: freebsd-bugs@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 461E7454 for ; Wed, 4 Feb 2015 16:38:23 +0000 (UTC) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2001:1900:2254:206a::16:76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 27A04FB0 for ; Wed, 4 Feb 2015 16:38:23 +0000 (UTC) Received: from bugs.freebsd.org ([127.0.1.118]) by kenobi.freebsd.org (8.14.9/8.14.9) with ESMTP id t14GcNAd061657 for ; Wed, 4 Feb 2015 16:38:23 GMT (envelope-from bugzilla-noreply@freebsd.org) From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 197321] syslogd randomly misses forwarding packets to remote host Date: Wed, 04 Feb 2015 16:38:23 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: bin X-Bugzilla-Version: 10.1-RELEASE X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: rblayzor@inoc.net X-Bugzilla-Status: New X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: freebsd-bugs@FreeBSD.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Feb 2015 16:38:23 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=197321 Bug ID: 197321 Summary: syslogd randomly misses forwarding packets to remote host Product: Base System Version: 10.1-RELEASE Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: bin Assignee: freebsd-bugs@FreeBSD.org Reporter: rblayzor@inoc.net Environment: FreeBSD 10.1 amd64 VM instanced on VWMware ESX. NIC driver: vmx VM instances boot as diskless FreeBSD clients. When attempting to forward all syslog data from the clients to a central syslog server on the same network/subnet we randomly see messages NOT make it to the central syslog server. Whats strange is the messages (best we can tell) appear to be almost the same type of message content. /etc/syslog.conf: *.* @10.0.0.110 *.* /var/spool/exim.log Running syslogd in debug: syslogd_flags="-d -ns -v -v" Client machine runs Exim which periodically runs mail queue every 10 minutes. This will generate two syslog messages as seen in the debug: logmsg: pri 26, flags 0, from mxs1, msg Feb 4 16:19:35 exim[98580]: Start queue run: pid=98580 Logging to FORW 10.0.0.110 lsent/l: 59/59 Logging to FILE /var/spool/exim.log logmsg: pri 26, flags 0, from mxs1, msg Feb 4 16:19:35 exim[98580]: End queue run: pid=98580 Logging to FORW 10.0.0.110 lsent/l: 57/57 Logging to FILE /var/spool/exim.log and they do appear in the local logfile on the client server (which was setup just for this test) Feb 4 16:19:35 mxs1 exim[98580]: Start queue run: pid=98580 Feb 4 16:19:35 mxs1 exim[98580]: End queue run: pid=98580 However, we randomly miss the "Start queue ..." message on the central server. This is completely random, sometimes we get it, sometimes we do not. We always seem to receive the "End queue ..." message. After doing a TCP dump with the session above, the TCP dump only shows ONE UDP packet going out, which contained the "End queue..." message, but not the "Start queue..." message. 16:19:24.665116 IP 10.0.0.31.514 > 10.0.0.110.514: SYSLOG mail.info, length: 97 16:19:24.705419 IP 10.0.0.31.514 > 10.0.0.110.514: SYSLOG mail.info, length: 61 16:19:35.342946 IP 10.0.0.31.514 > 10.0.0.110.514: SYSLOG mail.info, length: 57 <== 16:20:24.825348 IP 10.0.0.31.514 > 10.0.0.110.514: SYSLOG mail.info, length: 97 So the message is never generating a packet even though syslogd debug says it it is "logging to FORW 10.0.0.110" This happens about ~40-50% of the time after looking through logs over several hours. -- You are receiving this mail because: You are the assignee for the bug.