in_syslog with haproxy and nginx

[git001]

I have tried the following command.

bin/fluent-bit -R ../conf/parsers.conf -i syslog -p path=/tmp/syslog -p parser=syslog -o stdout --verbose               Fluent-Bit v0.12.0
Copyright (C) Treasure Data

[2017/06/11 00:05:00] [ info] [engine] started
[2017/06/11 00:05:00] [debug] [router] default match rule syslog.0:stdout.0

Now I have started and stopped haproxy and afterwords started and stopped nginx.

Both servers have complained about syslog protocol.

[ALERT] 161/000719 (9457) : sendto logger #1 failed: Protocol wrong type for socket (errno=91)
[ALERT] 161/000719 (9457) : sendto logger #1 failed: Protocol wrong type for socket (errno=91)
[ALERT] 161/000719 (9457) : sendto logger #1 failed: Protocol wrong type for socket (errno=91)

Jun 11 00:05:36 centos-512mb-fra1-01 nginx[9442]: nginx: [alert] connect() failed (91: Protocol wrong type for socket)
Jun 11 00:05:36 centos-512mb-fra1-01 nginx[9442]: nginx: [alert] connect() failed (91: Protocol wrong type for socket)
Jun 11 00:05:36 centos-512mb-fra1-01 nginx[9442]: nginx: [alert] connect() failed (91: Protocol wrong type for socket)
Jun 11 00:05:36 centos-512mb-fra1-01 nginx[9442]: nginx: [alert] connect() failed (91: Protocol wrong type for socket)
Jun 11 00:05:36 centos-512mb-fra1-01 nginx[9442]: nginx: [alert] connect() failed (91: Protocol wrong type for socket)

I have looked into the source of rsyslog and they inizialize the socket differnt

rsyslog

https://github.com/rsyslog/rsyslog/blob/master/plugins/imuxsock/imuxsock.c#L486
https://github.com/rsyslog/rsyslog/blob/master/plugins/imuxsock/imuxsock.c#L502

fluent-bit

https://github.com/fluent/fluent-bit/blob/master/plugins/in_syslog/syslog_unix.c#L41
https://github.com/fluent/fluent-bit/blob/master/src/flb_network.c#L178

Due to this fact I assume that in fluent-bit the socket need to be opened in a different way as it is for today

[edsiper]

research: Fluent Bit is using SOCK_STREAM sockets while Nginx and HAProxy SOCK_DGRAM.

[edsiper]

In GIT master there are recent changes to address this problem on in_syslog

• now it defaults to UDP mode over unix socket mode
• new option mode to set desired protocol: unix_udp or unix_tcp

In the next days normal TCP mode will be implemented.

[edsiper]

After latest patches the following modes are available in in_syslog:

• tcp
• unix_udp
• unix_tcp

About parsers:

• tcp defaults to syslog-rfc5424
• unix_udp and unix_tcp defaults to syslog-3164-local

additional parser syslog-3164 exists which also does hostname capture

[edsiper]

Fixed.