[syslog-ng] syslog-ng 1.5.17 and tcp-keep-alive not working

[Olaf Hoyer]

Hallo!

I want to do a centralized sysloging, where some embedded devices, 
running a ppc version of linux 2.2.14, also running syslog-ng 1.5.17 
shall log their data received bei some Interfaces to a central loghost.

In a test scenario, with the loghost being syslog-ng 1.6.5, and running 
on a different port than the system syslog, everything is fine via 
udp and tcp with basic features.

Some tests show, that when the syslog-ng on the loghost receives a -HUP, 
the connection is dropped, unless the option "keep-alive(yes)" is 
configured, like in the following example:
source s_tcp { tcp(ip(0.0.0.0) port(8514) max-connections(100) 
keep-alive(yes)); };

with that config the loghost is working.

So now I wanted to activate tcp keepalive on the client, in the hope, 
that whenever the syslog server closed the connection, that the client 
can reopen it upon new data arriving, what it is not doing in the basic 
config:

working:
destination syslog_server { tcp("10.0.0.1" port(8514)); }

new line:

destination syslog_server { tcp("10.0.0.1" port(8514) 
tcp-keep-alive(yes)); }


But:
[root at test /root]# syslog-ng
parse error at 199
Parse error reading configuration file, exiting. (line 199)

[root at test /root]# head -199 /etc/syslog-ng/syslog-ng.conf |tail -1
destination syslog_server { tcp("10.0.0.1" port(8514) 
tcp-keep-alive(yes)); };


Could someone enlighten me if
a) syslog-ng 1.5 understands the "tcp-keep-alive" directive
b) my thoughts are correct regarding the re-establishment of the tcp 
connection

Thanks in advance
Olaf

-- 
Olaf Hoyer        ohoyer at ohoyer.de
Fuerchterliche Erlebniss geben zu raten,
ob der, welcher sie erlebt, nicht etwas Fuerchterliches ist.
(Nietzsche, Jenseits von Gut und Boese)