[syslog-ng] perf testing problem

[Scheidler, Balázs]

Syslog-ng will not close connections this way (connection reset comes when
the target closes a connection with some data still in the buffer).

I would think of a packet filter, or something similar. But you can check
via tcpdump to doublecheck an rst is indeed sent, then strace the process
to see if it is syslog-ng or not.

Bazsi

On Mar 30, 2018 14:45, "Czanik, Péter" <peter.czanik at balabit.com> wrote:

> Hi,
>
> When I try to use loggen with more than ~20 active connections I get the
> following error:
>
> "Send error Connection reset by peer, results may be skewed."
>
> The network source has max_connections(128) already configured, so it
> should be handle that many connections without any trouble.
>
> Do you have any suggestions where to look either in syslog-ng or at OS
> level? It is Ubuntu 17.10 and syslog-ng 3.11
>
> Bye,
>
> Peter Czanik (CzP) <peter.czanik at balabit.com>
> Balabit / syslog-ng upstream
> https://syslog-ng.com/blog/author/peterczanik/
> https://twitter.com/PCzanik
>
> ____________________________________________________________
> __________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20180331/371a2466/attachment.html>