The
Event Parser process is unable to detect a hung connection, which occurs in either of the scenarios:
- The registered syslog receiver isn't appropriately configured for Transport Layer Security (TLS) encrypted connections.
- The TLS handshake between the ePO Server is broken.
To verify if this article applies:
Go to the
Registered Server settings page for the
syslog receiver and click
Test Connection. If you don't see a success or failure message, but instead see three dots, you have this problem.
The problem occurs because ePO requires that
syslog receivers accept TLS connections over TCP. For details about
syslog receiver requirements, see
KB91194 - Communication requirements for ePolicy Orchestrator syslog integration.
When the
Event Parser service tries to forward an event to a receiver that doesn't meet the requirements, it fails to make a successful connection. The connection attempt becomes unresponsive, and after a period, all available connections are consumed. At this point, the
event parser stops processing events.