Has anyone had issues with sending syslog over tcp to a collector like SPLUNK? Currently, we changed one of our ISR 4451 (17.3.6) routers to send syslog to host over TCP. The issue is after a while it stops sending and i keep getting bugged that the ISR is no longer sending syslog messages. Also, if you do a "Show logg" it shows the link to splunk is up over tcp but it's not sending logs.
I usually have to restart splunk services, take off "logging host" and it's going through a firewall so we clear the connection, basically jiggle the handle a few times before it connects again. Of course UDP doesn't have issues.
It's always a pain and really don't want to use TCP but was curious if anyone else had this similar issue. We are sending it out of the mgmt interface Gi0 through and with a vrf. But it seems after a few week or so, then we have to tear all the logging down and re do everything and usually takes a while and becoming annoying.
Is there a better way to reset the connection or something i'm dumb and missing.
