Hey guys,
Are there any known bugs for syslog-ng v2.09  that won't allow a cisco router to send logs over tcp?
I can see a connection established in syslog-ng.
I also see the message come in via tcpdump, but nothing in syslog-ng's output.
If I change the router from tcp to udp, messages come in as expected.

Router config:

logging source-interface Loopback0 
logging 172.18.224.150 
logging host 172.18.224.190 transport tcp


syslog-ng config:

source s_all {
        udp();
        tcp(ip(11.31.130.99) port(8002) max-connections(300));
        tcp(ip(172.18.224.190) port(601) max-connections(300));
};


debug output:
I commented out the line above for the other interface (11.31.130.99), restarted and this is all I see:
Syslog connection accepted; from='AF_INET(14.3.23.50:63845)', to='AF_INET(172.18.224.190:601)'


tcpdump:

14:13:46.914566 IP (tos 0x0, ttl 251, id 4303, offset 0, flags [none], proto TCP (6), length 134)
    14.3.23.50.63845 > xxx.com.601: Flags [.], seq 230:324, ack 1, win 4128, length 94


Router debug:

*Aug 17 17:34:19.772: %SYS-5-CONFIG_I: Configured from console by pnoc on vty0 (172.18.224.151) 
*Aug 17 17:34:20.776: Released port 15205 in Transport Port Agent for TCP IP type 1 delay 240000 
*Aug 17 17:34:20.776: TCB 0x850F9754 destroyed 
*Aug 17 17:34:25.775: TCB83648E60 created 
*Aug 17 17:34:25.775: TCB83648E60 setting property TCP_PID (8) 845083E4
*Aug 17 17:34:25.775: TCB83648E60 setting property TCP_NO_DELAY (1) 845083E8
*Aug 17 17:34:25.775: TCB83648E60 setting property TCP keepalive timeout (17) 845084A0 
*Aug 17 17:34:25.775: TCP: Random local port generated 63845, network 1 
*Aug 17 17:34:25.775: TCB83648E60 bound to 14.3.23.50.63845 
*Aug 17 17:34:25.775: Reserved port 63845 in Transport Port Agent for TCP IP type 1 
*Aug 17 17:34:25.775: TCP: sending SYN, seq 3300233565, ack 0 
*Aug 17 17:34:25.775: TCP0: Connection to 172.18.224.190:601, advertising MSS 536 
*Aug 17 17:34:25.775: TCP0: state was CLOSED -> SYNSENT [63845 -> 172.18.224.190(601)] 
*Aug 17 17:34:25.779: TCP0: state was SYNSENT -> ESTAB [63845 -> 172.18.224.190(601)] 
*Aug 17 17:34:25.779: TCP: tcb 83648E60 connection to 172.18.224.190:601, peer MSS 1460, MSS is 536 
*Aug 17 17:34:25.779: TCB83648E60 connected to 172.18.224.190.601 
*Aug 17 17:34:25.779: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 172.18.224.190 port 601 started - reconnection

______________________________________________________________

Clayton Dukes
______________________________________________________________