NwLogCollector - error message std::bad_alloc

[HariRumbay2]

collectd[4537]: NgNativeReader_NwLogCollector-FastUpdate: nwsdk failure: sendMessage returned error code 0; error message std::bad_alloc

collectd[4537]: NgNativeReader_NwLogCollector-FastUpdate: nwsdk failure: sendMessage returned error code 0; error message std::bad_alloc

I've looked into the previous KB articles which shows up the reasons as low memory , shovel connections getting failed & devices getting discovered with loop back ip address in host section , but unfortunately all these not seems to be closest match with our scenario .

Any other insights please , it's flashing every 10 sec .

On the same Appliance , GUI logs window shows up below errors every other second ..

error 2016-08-15T04.27.31Z Error on AMQP connection <0.7749.635>:

{ssl_upgrade_error,{tls_alert,"unknown ca"}}

[KhaledGamal]

Hi Hari,

There seems to be an issue in the event broker "Rabbitmq". You need to check if these issues are related to shovels and connections that the Rabbitmq is really using. Is this the local log collector "which resides on the log decoder" or is this a remote log collector "VLC". If this is a local log collector, check connections between it and all the VLCs you have and check if anyone of them has its connection down. If this is a VLC, check if the connection whether pull or push is working "green" or not working "red".

Best regards

Khaled

[HariRumbay2]

Yup , it's an local log collector residing on Log decoder .

I could see on all the VLC > Config > Destination Groups > Destination collector shows up as shovel as running ( green icon )

Cross checked through the  rabbitmqctl list_queues commands on both VLC's and Local Log collectors .

[KhaledGamal]

OK this means that the shovel between the VLC and the Local collector is OK and that is the important part.

From 10.4 rabbitmq is used in much more functions than just log collection. An example of that is collectd statistics which could be the issue here. If there are stats that are coming to the SA server from the Log collector and there are events coming from all VLCs, then you can ignore any errors that appear related to collectd.

Best regards

Khaled