What does the "GZ error -5" mean in the Bluecoat Reporter, version 9.1.x Journal?
I'm using the Bluecoat Reporter client to connect to Reporter, but I am seeing a GZ error - 5 in the journals. What do they mean?
Using the techniques to discover journal errors in Reporter, outlined in KB3460, I can see that my streaming log source connection is showing a GZ error -5. What does this mean?
With the streaming configuration ( Bluecoat reporter client ) t
NOTE: Reporter 9.2, which is in open beta right now, will only forgive an initial gzip error if it occurs in the first packet after the connection is established.)
Here's an example of the error we see in the journal:
BCRJ:2009-09-24 16:02:50 (4abb27aa) ALW.ERRO.LOGSO
The coresponding event log message on the SG is:
2009-11-06 03:00:00-08:00PST "Access Log Bluecoat Reporter (main): Closing TCP/IP connection." 0 E0000:96 ../alog_stream_custom.cpp:173
There are two probable causes of this error:
1: If this GZIP occurs at daily intervals when the "rotate" trigger is scheduled at the SG, then it's a known issue, and can be solved by upgrading your SG operating system. Please call support, and mention this KB article, for the exact version of SG you need. See KB3489 for details on how to check what your trigger time value is.
2: The second cause of this connection oscillation is caused by a corrupt gzip byte stream. The ProxySG saves its access log data locally while the connection to Reporter is down. I have seen occasions where once a stable connection is made to Reporter, the accrued gzip data being sent by the ProxySG is no longer correct. In this case, reporter forgives any decapitated segment with a -5 journal message (strike 1), but the continuing corrupted byte stream coming from the ProxySG then causes the Z_DATA_ERROR (-3) error (strike 2). At this point, it is Reporter forcing the connection to close due to corrupt data. The journal messages are clear about which side caused the connection to close. As long as the ProxySG keeps sending corrupt gzip data, the journal will be full of the connect/error -5/error -3/fatal-close messages. More details on the GZ error -3 is documented in KB3485
NOTE: For a detailed discussion on general troubleshooting tips for a streaming connection see KB3489
NOTE: For reasons why you might see a GZip error on a FTP log source, see KB3753
Rate this Page
Please take a moment to complete this form to help us better serve you.