Nate thanks for your reply ! I am already using keepalive on the server : tcp (ip("**********") port(5000) max-connections(1000) keep-alive(yes)); }; It doesn't look like I can specify this option on the client though. If I try something like : destination loghost { tcp("*********" port(5000) keep-alive(yes)); }; It complains about a syntax error. I have never seen an option called 'tcp-keep-alive()' but I tried it without luck. It always complains about a syntax error. I guess you meant 'keep-alive(yes)' right ? As far as upgrading is concerned I want to but I wanted to wait till 2.0 is out and stable. Any ETA ? --stucky On 3/2/06, Nate Campi <nate@campin.net> wrote:
On Tue, Feb 28, 2006 at 11:09:43AM -0800, stucky wrote:
guys
I've been pulling my hair out here. I gonna go insane....
Here's the story.
I first setup syslog-ng-1.6.6 for remote syslogging a year ago.
I seemed to work out great - all my stuff appeared to be logged remotely and everything was dandy. Then I decided to come up with some sort of check that would tell me if a machine was not logging remotely anymore cause of network problems or whatever.
I'm thinking that since you use TCP that perhaps the messages only come through once in a while, and since the first message sent when a TCP connection comes up used to be lost (might still be, but I remember Bazsi coming up with a workaround/fix at some point) then you might actually lose messages the way you report.
Either try using UDP for a short while or try tcp-keep-alive() to keep the connection up. Also review the changelogs to see if a newer version fixes this behavior (probably a good idea to upgrade anyways).
HTH, -- Nate
He may look like an idiot and talk like an idiot but don't let that fool you. He really is an idiot. - Groucho Marx
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html