Hello,

Our syslog-ng clients are losing their connection to our central log
server every few minutes.

In the client I have the following log:

2014-08-12T15:44:02+00:00 wimdu-app07 syslog.notice syslog-ng[14032]:
Syslog connection broken; fd='10', server='AF_INET(<our ip>:514)',
time_reopen='1'
2014-08-12T15:44:03+00:00 wimdu-app07 syslog.notice syslog-ng[14032]:
Syslog connection established; fd='10', server='AF_INET(<our ip>:514)',
local='AF_INET(0.0.0.0:0)'


I am using the following configuration on the clients:


destination d_net_wimdu {
    syslog(<our ip>
    transport("tcp")
    port(514)
    log-fifo-size(2048));
};

log { source(s_src); source(s_net); destination(d_net_wimdu); };

And on the server:



source s_net {
    syslog(ip(0.0.0.0)
    transport("tcp")
    max-connections(300)
    log-iw-size(3300)
    so_rcvbuf(8000000000)
    port(514));
};

log {
    source(s_net);
    destination(d_file_w);
};

destination d_prog_logparser {
    program("< logparser_bin >"
    template(t_w_filetemplate)
    log_fifo_size(90000000)
    flags(no-multi-line));
};

log {
  source(s_net);
  destination(d_prog_logparser);
  flags(flow-control);
};


Any idea how I can even debug this?

Thank you


--

[image: Wimdu] <http://www.wimdu.com/>*Wimdu GmbH* - Voltastraße 5, 13355
Berlin, Germany
*Managing Directors* - Arne Bleckwenn, Hinrich Dreiling
*Commercial Register Number* - 129773 B Berlin[image: Contact]
<contact@wimdu.com>[image: Blog] <http://blog.wimdu.com/?wt_vi=signature>[image:
FB] <http://www.facebook.com/wimdu>[image: TW]
<http://www.twitter.com/wimdu>[image: G+] <http://www.google.com/+wimdu>[image:
YT] <http://www.youtube.com/wimtubechannel>[image: GH]
<https://github.com/wimdu>[image: LI]
<http://www.linkedin.com/company/wimdu-gmbh>[image: XI]
<http://www.xing.com/companies/wimdu>

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq