-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thanks Mike, | you might want to look at using tcp-keep-alive() | http://www.balabit.com/products/syslog_ng/reference-1.6/syslog-ng.html/refer... | | sometimes when one of your remote syslog hosts terminates their log | connection, they do not fully close the TCP session. turning on | tcp-keep-alive() on your central host will help fix this. I'll monitor it over the next few weeks. Cheers Phil | I'm currently running syslog-ng 1.6.5 on Red Hat 2.1AS (syslog-ng will be | upgraded to 1.6.9 shortly) as a central log server, and I'm having a problem | with a growing number of TCP connections. Most hosts log to the central log | server via UDP, but there are 7 remote syslog-ng servers using TCP. I | currently allow up to 250 connections: | | source src_tcp { tcp(ip(x.x.x.x) port(514) max-connections(250)); }; | | but this is reached within about a fortnight. I restart the daemon each week | to ensure that it doesn't max out, but figure that there must be a better way. | -----BEGIN PGP SIGNATURE----- iD8DBQFDijLBT2yvGjk/8+MRAkiVAJ9BBSrYPQaAYewIZel1h1Hun0+uBgCg4gvU rSEkQmxE4k+IogfAUuUvx58= =g3B6 -----END PGP SIGNATURE-----