Hi all, I am seeing the following in my logs running rsyslog 4.4.1:
Oct 1 23:29:24 host rsyslogd-2079: too many tcp sessions - dropping incoming request [try http://www.rsyslog.com/e/2079 ] Oct 1 23:29:29 host rsyslogd-2079: too many tcp sessions - dropping incoming request [try http://www.rsyslog.com/e/2079 ] Oct 1 23:29:38 host rsyslogd-2079: too many tcp sessions - dropping incoming request [try http://www.rsyslog.com/e/2079 ] I went to the URL in the message and the answer makes sense so I added the following to my configuration: $InputTCPMaxSessions 1000 # Maximum TCP sessions (default 200) I added it before the imtcp module is loaded so the config looks like: # TCP Syslog Server: # provides TCP syslog reception and GSS-API (if compiled to support it) $InputTCPMaxSessions 1000 # Maximum TCP sessions (default 200) $ModLoad imtcp.so # load module $InputTCPServerRun 514 # start up TCP listener at port 514 I am still seeing the "too many tcp sessions" in the logs. When I take a look at netstat (assuming this is the relevant data) I see less than 1000 *connections* - but I'm not sure if each of these is considered a "session" $ netstat -an | grep :514 | wc -l 269 If I look for only ESTABLISHED connections I see less: [anich...@inlwr01p1 inlwr01p1]$ netstat -an | grep :514 | grep ESTABLISHED | wc -l 231 Many of the connections show a SYN_RECV state on the server side - I assume these are cases where we aren't completing the tcp handshake due to too many connections. Are there other factors which may be impacting the max connections or is my configuration incorrect? Thanks, Aaron _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
