Syslog-ng will not close connections this way (connection reset comes when the target closes a connection with some data still in the buffer).

I would think of a packet filter, or something similar. But you can check via tcpdump to doublecheck an rst is indeed sent, then strace the process to see if it is syslog-ng or not.

Bazsi

On Mar 30, 2018 14:45, "Czanik, Péter" <peter.czanik@balabit.com> wrote:
Hi,

When I try to use loggen with more than ~20 active connections I get the following error:

"Send error Connection reset by peer, results may be skewed."

The network source has max_connections(128) already configured, so it should be handle that many connections without any trouble.

Do you have any suggestions where to look either in syslog-ng or at OS level? It is Ubuntu 17.10 and syslog-ng 3.11

Bye,

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq