Thanks its worked. I believe making default value of so-keepalive as "yes" would be useful. Regards Pramod On Fri, Nov 18, 2011 at 2:19 AM, Balazs Scheidler <bazsi@balabit.hu> wrote:

On Wed, 2011-11-16 at 14:59 +0530, Pramod Pillai wrote:

...

Hi

I am using syslog-ng server on Solaris box and the syslog-ng clients are running on Linux box. When client ( linux )  box crashes the streaming stops. But the syslog-ng server assumes that the client is connected and keeps the connection. Is there any way to detect this condition and close the socket connection to the client which no longer exists.

If the connection is lost without any closing packets, then the only way to work around this issue is to enable TCP keepalive with this option:

source s_tcp { tcp(so-keepalive(yes)); };

you may have to tune the TCP keep-alive options on the server.

it would probably make sense to create an inactivity timer, but that doesn't exist right now.

-- Bazsi

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq