[syslog-ng] Max TCP Connections

[Philip Webster]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thanks Mike,

| you might want to look at using tcp-keep-alive()
|
http://www.balabit.com/products/syslog_ng/reference-1.6/syslog-ng.html/reference.html#AEN238
|
| sometimes when one of your remote syslog hosts terminates their log
| connection, they do not fully close the TCP session. turning on
| tcp-keep-alive() on your central host will help fix this.

I'll monitor it over the next few weeks.

Cheers
Phil

| I'm currently running syslog-ng 1.6.5 on Red Hat 2.1AS (syslog-ng will be
| upgraded to 1.6.9 shortly) as a central log server, and I'm having a problem
| with a growing number of TCP connections.  Most hosts log to the central log
| server via UDP, but there are 7 remote syslog-ng servers using TCP.  I
| currently allow up to 250 connections:
|
| source src_tcp { tcp(ip(x.x.x.x) port(514) max-connections(250)); };
|
| but this is reached within about a fortnight.  I restart the daemon each week
| to ensure that it doesn't max out, but figure that there must be a better way.
|
-----BEGIN PGP SIGNATURE-----

iD8DBQFDijLBT2yvGjk/8+MRAkiVAJ9BBSrYPQaAYewIZel1h1Hun0+uBgCg4gvU
rSEkQmxE4k+IogfAUuUvx58=
=g3B6
-----END PGP SIGNATURE-----