<p dir="ltr">Anything that might affect tcp connection state: firewalls, load balancers, "smart” network gear.</p>
<p dir="ltr">Try tcpdumping the connection and look for TCP RST and or normal closures with FIN and the like.</p>
<p dir="ltr">You can also get a clue by using strace on syslog-ng, but tcpdump had more details.</p>
<div class="gmail_quote">On Aug 12, 2014 5:53 PM, "Simão Mata" <<a href="mailto:simao.mata@wimdu.com">simao.mata@wimdu.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hello,<br>
<br>
Our syslog-ng clients are losing their connection to our central log<br>
server every few minutes.<br>
<br>
In the client I have the following log:<br>
<br>
2014-08-12T15:44:02+00:00 wimdu-app07 syslog.notice syslog-ng[14032]:<br>
Syslog connection broken; fd='10', server='AF_INET(<our ip>:514)',<br>
time_reopen='1'<br>
2014-08-12T15:44:03+00:00 wimdu-app07 syslog.notice syslog-ng[14032]:<br>
Syslog connection established; fd='10', server='AF_INET(<our ip>:514)',<br>
local='AF_INET(<a href="http://0.0.0.0:0" target="_blank">0.0.0.0:0</a>)'<br>
<br>
<br>
I am using the following configuration on the clients:<br>
<br>
<br>
destination d_net_wimdu {<br>
syslog(<our ip><br>
transport("tcp")<br>
port(514)<br>
log-fifo-size(2048));<br>
};<br>
<br>
log { source(s_src); source(s_net); destination(d_net_wimdu); };<br>
<br>
And on the server:<br>
<br>
<br>
<br>
source s_net {<br>
syslog(ip(0.0.0.0)<br>
transport("tcp")<br>
max-connections(300)<br>
log-iw-size(3300)<br>
so_rcvbuf(8000000000)<br>
port(514));<br>
};<br>
<br>
log {<br>
source(s_net);<br>
destination(d_file_w);<br>
};<br>
<br>
destination d_prog_logparser {<br>
program("< logparser_bin >"<br>
template(t_w_filetemplate)<br>
log_fifo_size(90000000)<br>
flags(no-multi-line));<br>
};<br>
<br>
log {<br>
source(s_net);<br>
destination(d_prog_logparser);<br>
flags(flow-control);<br>
};<br>
<br>
<br>
Any idea how I can even debug this?<br>
<br>
Thank you<br>
<br>
<br>
--<br>
<br>
[image: Wimdu] <<a href="http://www.wimdu.com/" target="_blank">http://www.wimdu.com/</a>>*Wimdu GmbH* - Voltastraße 5, 13355<br>
Berlin, Germany<br>
*Managing Directors* - Arne Bleckwenn, Hinrich Dreiling<br>
*Commercial Register Number* - 129773 B Berlin[image: Contact]<br>
<<a href="mailto:contact@wimdu.com">contact@wimdu.com</a>>[image: Blog] <<a href="http://blog.wimdu.com/?wt_vi=signature" target="_blank">http://blog.wimdu.com/?wt_vi=signature</a>>[image:<br>
FB] <<a href="http://www.facebook.com/wimdu" target="_blank">http://www.facebook.com/wimdu</a>>[image: TW]<br>
<<a href="http://www.twitter.com/wimdu" target="_blank">http://www.twitter.com/wimdu</a>>[image: G+] <<a href="http://www.google.com/+wimdu" target="_blank">http://www.google.com/+wimdu</a>>[image:<br>
YT] <<a href="http://www.youtube.com/wimtubechannel" target="_blank">http://www.youtube.com/wimtubechannel</a>>[image: GH]<br>
<<a href="https://github.com/wimdu" target="_blank">https://github.com/wimdu</a>>[image: LI]<br>
<<a href="http://www.linkedin.com/company/wimdu-gmbh" target="_blank">http://www.linkedin.com/company/wimdu-gmbh</a>>[image: XI]<br>
<<a href="http://www.xing.com/companies/wimdu" target="_blank">http://www.xing.com/companies/wimdu</a>><br>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div>