Relp error: Relp::InappropriateCommand open expecting syslog

Elastic Stack Logstash
1

Hello everyone.
I have this warning in my logstash log:

Relp error: Relp::InappropriateCommand open expecting syslog

My logstash configuration filter has input relp as input but with this error the log from syslog aren't parsed.

The firewall is off, the logs arrives from the logcollector (verified with tcpdump)... any idea about this error?

Thank you

2

That exception is most likely being raised here. The relp input accepts a socket connection and then calls the method that throws the exception.

When a RELP client connects I believe it has to send an "open" command (to configure the session) before it can send a "syslog" command (to log a message). The state diagrams in librelp-1.1.0/doc/relp.html suggest that too.

The only code path I can see to get to that exception would be for the first command sent to the input to be "syslog", and that violates the protocol. You have tcpdump data, so what does the stream of commands after the socket is opened look like?

3

Thank you for your response Badger. I solved just restarting rsyslog on log collector.
Thanks for your support.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.