Mailing List Archive: too many tcp sessions - dropping incoming request -- help!!!

Hi,

Our syslog server is spammed by following messages, can someone help on how to check and increase the tcp sessions for rsyslog?

rsyslogd: too many tcp sessions - dropping incoming request [v8.24.0-57.el7_9 try http://www.rsyslog.com/e/2079 ]

we are running rsyslog-8.24.0-57 on Linux 7

here is what /etc/rsyslog.conf file:

$ActionFileDefaultTemplate RSYSLOG_FileFormat

$IncludeConfig /etc/rsyslog.d/*.conf

$DefaultNetstreamDriver gtls

$DefaultNetstreamDriverCAFile /etc/pki/tls/private/ca.pem
$DefaultNetstreamDriverCertFile /etc/pki/tls/private/rslserver-cert.pem
$DefaultNetstreamDriverKeyFile /etc/pki/tls/private/rslserver-key.pem

$ModLoad imtcp

$InputTCPServerStreamDriverAuthMode anon
$InputTCPServerStreamDriverMode 1

$ActionSendStreamDriverAuthMode x509/name
$ActionSendStreamDriverPermittedPeer *.stanford.edu
$ActionSendStreamDriverMode 1

$InputTCPServerRun 10514

$WorkDirectory /var/lib/rsyslog
#$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
#$OmitLocalLogging on
$IMJournalStateFile imjournal.state

$MaxOpenFiles 2048

Thanks!

-Ren
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

You can specify the max number of sessions via
$InputTCPMaxSessions

see: https://www.rsyslog.com/doc/v8-stable/configuration/modules/imtcp.html

Beware: this doc is for the current versions. Your's is several years
outdated, but this setting should work in any case.

HTH
Rainer

El jue, 18 mar 2021 a las 2:52, Ren You via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> Hi,
>
> Our syslog server is spammed by following messages, can someone help on how to check and increase the tcp sessions for rsyslog?
>
> rsyslogd: too many tcp sessions - dropping incoming request [v8.24.0-57.el7_9 try http://www.rsyslog.com/e/2079 ]
>
> we are running rsyslog-8.24.0-57 on Linux 7
>
> here is what /etc/rsyslog.conf file:
>
> $ActionFileDefaultTemplate RSYSLOG_FileFormat
>
> $IncludeConfig /etc/rsyslog.d/*.conf
>
> $DefaultNetstreamDriver gtls
>
> $DefaultNetstreamDriverCAFile /etc/pki/tls/private/ca.pem
> $DefaultNetstreamDriverCertFile /etc/pki/tls/private/rslserver-cert.pem
> $DefaultNetstreamDriverKeyFile /etc/pki/tls/private/rslserver-key.pem
>
> $ModLoad imtcp
>
> $InputTCPServerStreamDriverAuthMode anon
> $InputTCPServerStreamDriverMode 1
>
> $ActionSendStreamDriverAuthMode x509/name
> $ActionSendStreamDriverPermittedPeer *.stanford.edu
> $ActionSendStreamDriverMode 1
>
> $InputTCPServerRun 10514
>
> $WorkDirectory /var/lib/rsyslog
> #$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> #$OmitLocalLogging on
> $IMJournalStateFile imjournal.state
>
> $MaxOpenFiles 2048
>
> Thanks!
>
> -Ren
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.