No, it is not a concurrent TCP limit issue as this data stream is a single connection. I do not see the max-connections message in the messages log either.<br><br><br><div class="gmail_quote">On Wed, Jul 29, 2009 at 11:22 AM, Matt Pinkham <span dir="ltr"><<a href="mailto:westphalia@gmail.com">westphalia@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">For the last 24 hours on versions 2.0.4, 2.1.4, & 3.0.3 syslog-ng
will stop taking new connections via a listening port every 100-110
minutes (aka it will hang up immediately). It will never recover on
its own and has to be restarted. I haven't figured out the exact
interval but hopefully that will be close enough to work with (note that
the traffic is fairly low -- 10 mesgs/sec -- 500K-600K data/min). I
had a program logging data locally via /dev/log into a named directory
and then moved this program to a remote server. That remote server
does not seem to be having an issue. I have observed this issue on two
separate servers (RHEL4.<img src="http://www.syslog.org/forum/Smileys/default/cool.gif" alt="Cool" border="0">
that were taking this data feed. I have tried with flush_lines/sync
& time_reopen commented out with no difference as well as
log_fifo_size, log_mesg_size,so_recvbuf commented out. There are no
obvious messages about why syslog-ng stops working (even with debug and
verbose enabled). Note that these two servers (that stop working) are
behind an Alteon 2424 switch (although I have other feeds to other
servers working fine behind this switch). Ideas? Need more data?<br><br>==syslog will stop accepting connections==<br>[root@server]# telnet localhost 514<br>Trying 127.0.0.1...<br>Connected to localhost.localdomain (127.0.0.1).<br>
Escape character is '^]'.<br>Connection closed by foreign host.<br><br>==top section of 3.0 syslog-ng.conf==<br>options { flush_lines (0);<br> time_reopen (10);<br> log_fifo_size (10000);<br> long_hostnames (off);<br>
use_dns (no);<br> use_fqdn (no);<br> create_dirs (no);<br> dir_perm (0755);<br> perm (0644);<br> chain_hostnames(no);<br> keep_hostname (yes);<br> stats_freq (3600);<br>
log_msg_size(65536);<br> };<br><br>source remote {<br> udp(ip(0.0.0.0) port(514) so_rcvbuf(1048576));<br> tcp(ip(0.0.0.0) port(514) max-connections(50) so_rcvbuf(1048576));<br>};<br><br>==logging data like this===<br>
filter f_data { match("Data:"); };<br>destination d_data { file("/var/log/data/data-$R_MONTH$R_DAY$R_HOUR$R_MIN"); };<br>log { source(remote); filter(f_data); destination(d_data); };<br clear="all">
<br><br>
</blockquote></div><br><br clear="all"><br>-- <br>Some men see things as they are and ask why. I see things that never were and ask for initiative rolls.<br>