Panorama Syslog SSL error while writing stream

Fariq_Zaidi — Thu, 15 Feb 2024 02:54:32 GMT

we encounter issue show as below:

Syslog SSL error while writing stream; tls_error=\'SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure\'. location=\'/opt/pancfg/mgmt/syslogng/pan_sysng.cfg:68:3\

found in syslog-ng.log as below:

syslog-ng.log
2024-02-14 07:30:33
Feb 14 07:30:33 DC1-L4-R25-EXT-PA01 syslog-ng[12083]: Syslog connection established; fd='32', server='AF_INET(10.xx.xx.xx.xxx', local='AF_INET(0.0.0.0:0)'
syslog-ng.log
2024-02-14 07:30:33
Feb 14 07:30:33 DC1-L4-R25-EXT-PA01 syslog-ng[12083]: SSL error while writing stream; tls_error='SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure', location='/opt/pancfg/mgmt/syslogng/pan_sysng.cfg:68:3'
syslog-ng.log
2024-02-14 07:30:33
Feb 14 07:30:33 DC1-L4-R25-EXT-PA01 syslog-ng[12083]: I/O error occurred while writing; fd='32', error='Broken pipe (32)'
syslog-ng.log
2024-02-14 07:30:33
Feb 14 07:30:33 DC1-L4-R25-EXT-PA01 syslog-ng[12083]: Syslog connection broken; fd='32', server='AF_INET(10.xx.xx.xx.xxx)', time_reopen='10'
syslog-ng.log
2024-02-14 07:30:38
Feb 14 07:30:38 DC1-L4-R25-EXT-PA01 syslog-ng[12083]: Syslog connection failed; fd='32', server='AF_INET(10.xx.xx.xx.xxx)', error='Connection refused (111)', time_reopen='10'
syslog-ng.log
2024-02-14 07:30:43
Feb 14 07:30:43 DC1-L4-R25-EXT-PA01 syslog-ng[12083]: Syslog connection established; fd='32', server='AF_INET(10.xx.xx.xx.xxx)', local='AF_INET(0.0.0.0:0)'
syslog-ng.log
2024-02-14 07:30:43
Feb 14 07:30:43 DC1-L4-R25-EXT-PA01 syslog-ng[12083]: SSL error while writing stream; tls_error='SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure', location='/opt/pancfg/mgmt/syslogng/pan_sysng.cfg:68:3'
syslog-ng.log
2024-02-14 07:30:43
Feb 14 07:30:43 DC1-L4-R25-EXT-PA01 syslog-ng[12083]: I/O error occurred while writing; fd='32', error='Broken pipe (32)'
syslog-ng.log
2024-02-14 07:30:43
Feb 14 07:30:43 DC1-L4-R25-EXT-PA01 syslog-ng[12083]: Syslog connection broken; fd='32', server='AF_INET(10.xx.xx.xx.xxx)', time_reopen='10'
syslog-ng.log
2024-02-14 07:30:48
Feb 14 07:30:48 DC1-L4-R25-EXT-PA01 syslog-ng[12083]: Syslog connection failed; fd='32', server='AF_INET(10.xx.xx.xx.xxx)', error='Connection refused (111)', time_reopen='10'

please advise if there is issue with panorama.

Thank you

Re: Panorama Syslog SSL error while writing stream

tsears — Thu, 11 Apr 2024 14:21:58 GMT

Hi,

Did you ever find a resolution for this issue? Encountering the same setting up an SSL syslog.

Thanks

Re: Panorama Syslog SSL error while writing stream

Fariq_Zaidi — Mon, 15 Apr 2024 04:34:36 GMT

Here the TAC investigation and solution as below

we have confirmed the synchronization issue has been resolved by restarting the mgmt-server. After the daemon restart, the 'Syslog SSL error while writing stream' error still persists. We can confirm this is not the cause of the synchronization issue but regarding the syslog connection itself.
'Syslog connection failed; fd='32', server='AF_INET(10.48.3.201:1511)', error='Connection refused (111)', time_reopen='10''
From the log, this error is indicating the syslog server is refusing the connection

you may try to do a restart mgmt-server

thank you

topic Re: Panorama Syslog SSL error while writing stream in Panorama Discussions

Panorama Syslog SSL error while writing stream

Re: Panorama Syslog SSL error while writing stream

Re: Panorama Syslog SSL error while writing stream