I think you are saying that when you restart syslog-ng client on the debian system, you have to restart syslog-ng on the RHEL server before you get logs again from the client (debian) system. Is that correct?
No, i try to explain better.
syslog-ng Client -> Debian
syslog-ng Server -> RHEL
I created a source, filter and destination in debian for log "ssh" and "su" authentications.
When i login in debian with ssh client, logs ok in the debian, but not log in the RHEL.
When i reload syslog-ng in debian, log into RHELL. Understand?
If i want to forward the copy in the syslog-ng server (RHEL) i need reload the syslog-ng in the client. Is this correct? The problem maybe is the time?
Only sincronice when i reload the client service. I want that sincronice in the moment when i log in by ssh.
Thanks...