Return
-
Title
“Error connecting to socket; error_code='111', error_msg='Connection refused', endpoint='/opt/ssb/var/logspace/name/logspace1/indexer.ctl'” -
Description
The following error is reported when searching a syslog-ng Store Box (SSB) logstore.
“Error connecting to socket; error_code='111', error_msg='Connection refused', endpoint='/opt/ssb/var/logspace/name/logspace1/indexer.ctl'”
-
Cause
This error may be caused by
- An expired license
or
- A full disk
-
Resolution
Resolution 1. – License
Please see the following KB article for details on what happens when a license expires.
https://support.oneidentity.com/syslog-ng-store-box/kb/4267241/what-happens-when-license-expires
Resolution 2. Full Disk
Run the following command from the boot shell to see if the disk is full# df -hTo free up space on a full disk you will need to run archive or clean up on the logstores. Please see the section “Archiving or cleaning up the collected data” in the admin guide for details
Ref: https://support.oneidentity.com/technical-documents/syslog-ng-store-box/6.8.0/administration-guide/20#TOPIC-1665243
If some or all of the logstores do not have an archiving or cleanup policy associated with them then it is like that this issue will re-occur. Therefore, it is recommended that all logstores have a policy associated with them. Please see the section “Archiving and cleanup” in the admin guide for details on how to set this up.
Ref: https://support.oneidentity.com/technical-documents/syslog-ng-store-box/6.8.0/administration-guide/19#TOPIC-1665239