syslog server connection failed

[M.AbuBakar]

Hi,

I have a PA VM setup and a syslog server to forwards the logs to. I have done all the configurations needed and syslogs server are receiving the logs. But on the system log there's still an error showing "syslog connection failed to server[x.x.x.x] 

Is this expected?

[OtakarKlier]

Hello,

Check the logs on the device to ensure proper deliver of the logs. If using TCP for syslog, this could also be a possibility if there was an issue with the transmission of data.

Regards,

[PavelK]

Hello @M.AbuBakar

I came across similar issue in the past. To isolate the issue, I would recommend below steps:

- Check syslog system logs from CLI: tail follow yes mp-log syslog-ng.log.

- Take packet capture: How To Run a Packet Capture (tcpdump) On Management Interface and check reason for failure. For example retransmission time out or what side (server or firewall) is closing connection.

- Can you see in the log re-establishing of syslog connection?

- Are you using syslog over SSL?

Kind Regards

Pavel