maybe the problem is that the server side (central syslog) is hpux. Unfortunately I do not have a linux box for this purpose... With a tcpdump on the server-side you can see that even the syslog-ng daemon is down there are many tcp pakets going from the clients to the server. The clients do not recognise that the server process has died. On client side I have syslog-ng 1.6.0-rc4 where I have on the hpux server side 1.6.4. What can I do with the socket(7) option? I am not familiar with tcp/ip internals ;-((( Stephan

...

...

lool+syslog@via.ecp.fr 01.07.2004 14:52:21 >>> Stephan Hendl <Stephan.Hendl@lds.brandenburg.de> - Thu, Jul 01, 2004:

It seems to me that the state 'FIN_WAIT_2' doesn't allow the hpux syslog-ng to accept data from the linux clients and this state is quite very long.

I could not reproduce this on my Linux 2.6 system: - I killed syslog-ng with SIGTERM, SIGINT, SIGKILL, and SIGHUP while a telnet connection was open to the TCP port; - I restarted syslog-ng as soon as it was dead, and telneted successfully to the same port again, and syslog-ng saw my connection. Could it be a problem on the client side? My TCP connection gets closed when I kill -HUP syslog-ng. Or could it be a socket(7) option missing on the listening TCP socket? I do a setsockopt with SO_REUSEADDR on my sockets prior to binding them, which does not seem to be in syslog-ng. -- Loïc Minier <lool@dooz.org> _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html