"EOF occurred while idle" when using network directive in syslog-ng
The problem was occuring at the other end: the receiver side. There are 2 different syslog protocols in the wild: the rfc3164 one (the old one) and the rfc5424 one (the new one). See this blog post for more info.
I was receiving logs on my server with the old protocol and the messages did not match the logs sent by the sending machine using the newer protocol (hence the "Header" problem).
My conf was the following:
source mysource {
syslog(
ip(0.0.0.0)
transport(udp)
port(514)
max-connections(80)
keep-hostname(yes)
);
syslog(
ip(0.0.0.0)
transport(tcp)
port(514)
max-connections(80)
log_iw_size(8000)
keep-hostname(yes)
);
};
...
When I tail -f /var/log/syslog
, I get the following error:
Oct 29 16:37:28 servername syslog-ng[718]: Syslog connection accepted; fd='83', client='AF_INET(127.0.0.1:40034)', local='AF_INET(0.0.0.0:514)'
Oct 29 16:37:28 servername syslog-ng[718]: Invalid frame header; header=''
Oct 29 16:37:28 servername syslog-ng[718]: Syslog connection closed; fd='83', client='AF_INET(127.0.0.1:40034)', local='AF_INET(0.0.0.0:514)'
Writing the following line in place of the two syslog
directives fixes the problem:
source mysource {
network(transport(tcp) port(514) max-connections(80));
}