Information: Forum is in read-only mode
For details and other support options see

Eventreport 8.3.277 TIME_WAIT connections

Support, Questions and Discussions on EventReporter

Moderator: alorbach

Google Ads

Eventreport 8.3.277 TIME_WAIT connections

Postby jim » Tue Apr 10, 2007 4:09 pm

I am running eventreport 8.3.277.

At this point I am forwarding data to a central syslog server running syslog-ng. When I configure eventreporter with TCP/(one message per connection) I end up with extra TIME_WAIT connections. I would expect a clean break. I have tried TCP/(persistent connection) but I never see any data flow to the syslog server. I verified this by running wireshark. I would like to use TCP if at all possible, but I can't run TCP if no data is being sent, or if I end up with a bunch of TIME_WAIT connections.

What am I missing in the TCP realm?

Any help is appreciated.
Posts: 6
Joined: Thu Feb 08, 2007 6:32 pm

Postby alorbach » Tue Apr 10, 2007 4:36 pm


currently only the EventReporter 8.4 RB (See here for more,1332.html) is capable of sending more messages in one syslog connection.

During a maintenance update, the wrong EventReporter Client version got into the existing 8.3 Setupfile, but has already been removed by the correct version. This is the reason why your Client application shows the new TCP Connection options, however they are only available in 8.4 RB.
Site Admin
Posts: 1627
Joined: Thu Feb 13, 2003 11:55 am

Postby rgerhards » Tue Apr 10, 2007 4:38 pm

Please let me add that the TIMED_WAIT is caused by the way syslog-ng closes the connections. As it expects a persistent connection, it takes a while to let them fully close (which is a good practice in these cases). So the right solution is to use the rolling beta (as Andre outlined) for the time being.

Site Admin
Posts: 3807
Joined: Thu Feb 13, 2003 11:57 am

Google Ads

Return to EventReporter

Who is online

Users browsing this forum: No registered users and 0 guests