Troubleshooting
Problem
When forwarding messages over TCP with rsyslog, this message is logged.
syslog: omfwd: remote server at XX.XX.XX.XX:XXXXX seems to have closed connection. This often happens when the remote peer (or an interim system like a load balancer or firewall) shuts down or aborts a connection. Rsyslog will re-open the connection if configured to do so (we saw a generic IO Error, which usually goes along with that behaviour).
Cause
The receiving syslog server is unable to process a long series of messages over a single TCP connection. After reaching its limit, it closes the connection.
Resolving The Problem
Use UDP instead of TCP with rsyslog to forward messages to the syslog server.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB08","label":"Cognitive Systems"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG10","label":"AIX"},"ARM Category":[{"code":"a8m0z000000cvxuAAA","label":"Communication Applications-\u003ESYSLOG\/RSYSLOG"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"5.3.0;6.1.0;7.1.0;7.2.0;7.3.0"}]
Was this topic helpful?
Document Information
Modified date:
02 July 2025
UID
ibm17238808