This message was deleted.

Hi Devin! Usually when I see this error referencing the output, it is an issue reaching the endpoint it is trying to send to, rather than between fluentbit and fluentd, but since you mentioned you're getting an OK reply, if you want to confirm fluentbit is able to send logs, you can check if /buffers directory is being written to in the rancher-logging-root-fluentd-0 -n cattle-logging-system pod as a quick way to ensure that is, both, receiving and clearing (trying, at least) data. If it's doing both, the next step, might be to troubleshoot connectivity between the cluster and your syslog host. If it's not receiving anything in the buffer, and the cluster is wide open in terms of networkpolicy, it might be worth checking the fluentd log (https://www.suse.com/support/kb/doc/?id=000020946) and checking the overlay network for any issues that might be dropping connection between the nodes and disrupting that connectivity (https://ranchermanager.docs.rancher.com/v2.8/troubleshooting/other-troubleshooting-tips/networking#check-if-overlay-network-is-functioning-correctly)?

Okay, I'm back. This ended up being a couple things. First issue was that the pods for fluentd and fluentbit were under resourced. The second was our environment, the nodes hosting the k3s agents for some clusters had different

A

records for other hosts. After some cleanup and making more resources available to the pods we started receiving logs on Syslog-NG.