Check the logs from syslog-ng on the central server. Could be that you need to increase the max connections to your tcp source or increase an OS limit like open file descriptors. -- Nate Campi