Ghost2Logger - SensorContainer reset error

Hello,
Installed ghost2logger, rule is been created. Host and pattern is working, i can see in the syslog and entry matched, but in the st2sensorcontainer.log, I see connection reset error.

2020-06-15 20:54:55,369 140610254255064 WARNING mixins [-] Broker connection error, trying again in 8.0 seconds: ConnectionResetError(104, 'Connection reset by peer').
Traceback (most recent call last):
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/kombu/utils/functional.py", line 343, in retry_over_time
    return fun(*args, **kwargs)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/kombu/connection.py", line 283, in connect
    return self.connection
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/kombu/connection.py", line 837, in connection
    self._connection = self._establish_connection()
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/kombu/connection.py", line 792, in _establish_connection
    conn = self.transport.establish_connection()
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/kombu/transport/pyamqp.py", line 130, in establish_connection
    conn.connect()
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/amqp/connection.py", line 317, in connect
    self.drain_events(timeout=self.connect_timeout)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/amqp/connection.py", line 505, in drain_events
    while not self.blocking_read(timeout):
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/amqp/connection.py", line 511, in blocking_read
    return self.on_inbound_frame(frame)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/amqp/method_framing.py", line 55, in on_frame
    callback(channel, method_sig, buf, None)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/amqp/connection.py", line 518, in on_inbound_method
    method_sig, payload, content,
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/amqp/abstract_channel.py", line 145, in dispatch_method
    listener(*args)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/amqp/connection.py", line 406, in _on_start
    login_response, self.locale),
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/amqp/abstract_channel.py", line 59, in send_method
    conn.frame_writer(1, self.channel_id, sig, args, content)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/amqp/method_framing.py", line 172, in write_frame
    write(view[:offset])
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/amqp/transport.py", line 284, in write
    self._write(s)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/eventlet/greenio/base.py", line 403, in sendall
    tail = self.send(data, flags)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/eventlet/greenio/base.py", line 397, in send
    return self._send_loop(self.fd.send, data, flags)
  File "/opt/stackstorm/st2/lib/python3.6/site-packages/eventlet/greenio/base.py", line 384, in _send_loop
    return send_method(data, *args)
ConnectionResetError: [Errno 104] Connection reset by peer

2020-06-15 20:55:03,413 140610254257040 INFO (unknown file) [-] [Ghost2logger]: Received Matched Syslog Event
2020-06-15 20:55:03,414 140610254257040 INFO (unknown file) [-] {'host': '192.168.1.1', 'hostpattern': '192.168.1.1', 'message': '<165>Jun 15 20:50:49 swdevice01 ConfigAgent: 4929190: %SYS-5-CONFIG_STARTUP: Startup config saved from system:/running-config by st2user on vty4 (10.11.11.72).', 'pattern': 'SYS-5-CONFIG_STARTUP'}

Hi,
Did you manage to resolve this issue?

I am in a similar position at the moment.

In the st2sensorcontainer.log did you have any messages after the connection reset?

For example if the sensor is getting the event but matching then you will have a message
“2020-07-02 16:32:20,219 140468067622232 INFO (unknown file) [-] [Ghost2logger]: Received Matched Syslog Event”

In my situation I also see the connection reset, but I then have the matched syslog event. I’m just debugging to see what happens when the sensor was dispatched to see what went wrong.

Thanks,

You may also want to check out the rabbitmq logs as that might be the connection problems.