On 09/28/2015 03:57 PM, Michael Starks wrote:
I am running syslog-ng 3.4.7 as distributed by ELSA. I have a problem whereby nxlog agents (v2.9.1347) making a new TCP connection to the syslog-ng server repeatedly show lines like this in nxlog.log: 2015-09-28 14:28:25 INFO reconnecting in 1 seconds
Many connections are working, but it especially has a problem with new agents coming online. Sometimes when I restart syslog-ng it helps, but not always.
<snip> By George I think it's fixed! So even though I was running syslog-ng in the foreground and in debug mode, the filter I had in place looking for dropped messages was filtering out the wrong thing. I *was* having dropped messages at first, but there was something else going on as well. I saw lots of these after I took out the grep and started to poke around: Number of allowed concurrent connections reached, rejecting connection; client='AF_INET(172.16.1.109:2308)', local='AF_INET(0.0.0.0:514)', max='10' So after Googling a bit, I learned that the default max TCP connections is 10. That strikes me as a very low value for a log server. So I added this to the appropriate line: max-connections(500). Now I see lots of established sessions and no more RSTs! I think the inconsistency before was due to whichever 10 hosts got there first after restarting got one of the 10 sessions. Looks like it was a combination of things.