SRX not forwarding all security logs to the external SysLog Server with TCP been used as the Transport Protocol.

Reported on Junos : 24.2R2

Issue is seen when the stream logging is configured over TCP.

Stream logging configured over UDP is unaffected.

messages logs reports below error for RTLOGD:

Oct 17 12:35:11 rtlogd: received 0x8c payload bytes in 867 bytes from log forwarder

Oct 17 12:35:11 rtlogd: receives log RTLOG_CONN_ERROR from RT_SYSTEM at severity 13 lsys_name (null)

Oct 17 12:35:11 rtlogd: miscellaneous string(len=36)=Connection error TEST Com 108 abort

Oct 17 12:35:11 rtlogd: attribute-list(len=50)=stream-name 4 TEST error-message 13 Com 108 abort

Oct 17 12:35:11 rtlogd: receives log RTLOG_CONN_ERROR from RT_SYSTEM at severity 13 lsys_name (null)

Oct 17 12:35:11 rtlogd: miscellaneous string(len=112)=Connection error TEST Error code: major 3 minor 5 code 500, description:TCP connection closed by unknown reason

This issue has already been identified and fixed, where in stale TCP Sessions Pile Up on Syslog Server due to idle session when Security Log Stream over TCP is enabled/configured.

It was identified that the SRX was not sending FIN or RST packet to the syslog server when there was any session timeout.

This issue has been fixed on the below Junos Versions:

24.2R2-S3 Or Higher

25.2R1-S2 Or Higher

25.2R2 Or Higher

25.4R1 Or Higher