Recurring sink socket errors when forwarding cisco and linux raw syslog

[tobykenobi1997]

I keep getting these errors when forwarding cisco appliance and also some linux syslogs raw to a external.
I tried to get the external site to increased the timeout interval to 10m because maybe it has to do with stale sockets on their side, which they are sending a reset flag when no data has been transferred in 60 seconds. But no luck.

Here are the errors:

2025-06-25T12:08:20.748141Z  WARN sink{component_kind="sink" component_id=forward_cisco component_type=socket}: vector::internal_events::tcp: Received EOF from the server, shutdown.

2025-06-25T12:08:20.748200Z ERROR sink{component_kind="sink" component_id=forward_cisco component_type=socket}: vector::internal_events::socket: Error sending data. error=ShutdownCheck::Close error_code="socket_send" error_type="writer_failed" stage="sending" mode=tcp internal_log_rate_limit=true

2025-06-25T12:08:20.748223Z ERROR sink{component_kind="sink" component_id=forward_cisco component_type=socket}: vector_common::internal_event::component_events_dropped: Events dropped intentional=false count=1 reason="Error sending data." internal_log_rate_limit=true

Do you guys have any idea about this? I am also sending other log sources such as a heavy firewall to this external provider and those are are not generating these errros. Only syslog from this cisco appliance and sometimes Linux syslogs.

[pront]

Hi @tobykenobi1997, nothing stands out from your description. Can you perhaps share your Vector config and any other data you collected while trying to diagnose this issue?

I would also inspect the internal metrics (see guide here) to see if there are internal errors and where they originate.