<div dir="ltr">Turned out to be an application inspection rule on the firewall between the log source and syslog-ng. Turning it off did the trick.<br><br><br></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Wed, May 8, 2013 at 11:13 AM, Xuri Nagarin <span dir="ltr"><<a href="mailto:secsubs@gmail.com" target="_blank">secsubs@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 05/07/2013 09:41 PM, Balazs Scheidler wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Now as I think of it If you are really using 3.2 another issue may be<br>
the cause, is there another client that sends a lot of traffic parallel<br>
to logger? One source may starve the other. That's why the window<br>
allocation was changed.<br>
<br>
In any case try to increase that and see if it helps.<br>
<br>
</blockquote>
<br></div>
No, there isn't any other source sending to the syslog-ng receiver. I will try to tweak the window allocation nevertheless and see if it helps. Will update list with the resolution.<br>
<br>
Thanks!<br>
<br>
<br>
</blockquote></div><br></div>