Syslog Events sent over TCP from Syslog-NG appear to be getting dropped.
ucf.log shows lot of errors
Error during connection closing. Broken pipe" on per minute basis
ucf.log also often reports
Error while process message. Connection reset by peer java.io.IOException:
Connection reset by peer"
BEEP control protocol is being used instead of Raw TCP.
Create a new "/syslog-server-options.xml" file in the Agent Home folder of Event Agent to force the syslog sensor to use Raw TCP Mode and not the BEEP control protocol.
The following properties should be declared in file "
/syslog-server-options.xml". In this file the user specifies the necessary custom options for particular syslog servers (identified by port/protocol pair). The file format is as follows: