MonitorWare Knowledge Base

I am running eventreport 8.3.277.

At this point I am forwarding data to a central syslog server running syslog-ng. When I configure eventreporter with TCP/(one message per connection) I end up with extra TIME_WAIT connections. I would expect a clean break. I have tried TCP/(persistent connection) but I never see any data flow to the syslog server. I verified this by running wireshark. I would like to use TCP if at all possible, but I can't run TCP if no data is being sent, or if I end up with a bunch of TIME_WAIT connections.

What am I missing in the TCP realm?

Any help is appreciated.

Hi,

currently only the EventReporter 8.4 RB (See here for more http://forum.adiscon.com/topic,1332.html) is capable of sending more messages in one syslog connection.

During a maintenance update, the wrong EventReporter Client version got into the existing 8.3 Setupfile, but has already been removed by the correct version. This is the reason why your Client application shows the new TCP Connection options, however they are only available in 8.4 RB.

Please let me add that the TIMED_WAIT is caused by the way syslog-ng closes the connections. As it expects a persistent connection, it takes a while to let them fully close (which is a good practice in these cases). So the right solution is to use the rolling beta (as Andre outlined) for the time being.

Rainer