closing inactive or idle incoming connections

6 Apr 2021

      Using syslog-ng 3.26 at the moment but can use the latest if the options 
are available or easier.

Is there a way to configure the idle timeout for incoming connections.

I have a use case where we want to log from a mobile work force, which 
can be anywhere on the internet. This means that our syslog server needs 
to be open to the internet. The bad guys are connecting to our port and 
not sending anything, just tying up the port.

The port requires a certificate so is "safe", however, the connection is 
consumed for approx 2 hours before syslog-ng dropes the connection with

syslog-ng[22490]: Error reading RFC6587 style framed data; fd='3769', 
error='Connection timed out (110)'
syslog-ng[22490]: Syslog connection closed; fd='4509', 
client='AF_INET()', local='AF_INET()'

Is there a way to configure syslog-ng to drop the connection if it does 
not receive the certificate in 60 seconds?

Is there a way to configure syslog-ng to drop the connection if no 
syslog messages are received in 10 minutes?

Thanks,

-- 
Evan

Evan Rempel

Peter Kokai (pkokai)

tags

participants (2)