Syslog-ng will not close connections this way (connection reset comes when the target closes a connection with some data still in the buffer). I would think of a packet filter, or something similar. But you can check via tcpdump to doublecheck an rst is indeed sent, then strace the process to see if it is syslog-ng or not. Bazsi On Mar 30, 2018 14:45, "Czanik, Péter" <peter.czanik@balabit.com> wrote:
Hi,
When I try to use loggen with more than ~20 active connections I get the following error:
"Send error Connection reset by peer, results may be skewed."
The network source has max_connections(128) already configured, so it should be handle that many connections without any trouble.
Do you have any suggestions where to look either in syslog-ng or at OS level? It is Ubuntu 17.10 and syslog-ng 3.11
Bye,
Peter Czanik (CzP) <peter.czanik@balabit.com> Balabit / syslog-ng upstream https://syslog-ng.com/blog/author/peterczanik/ https://twitter.com/PCzanik
____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq