[syslog-ng]can't log to remote host -- error message in syslog

[Nate Campi]

On Tue, Jul 30, 2002 at 04:17:00PM -0400, Adam Tworkowski wrote:
> Hi,
>=20
> I've been having issues logging to a remote server on another segment.  I=
 have=20
> no issue with logging from machines that are on the same segment as the=
=20
> logging server.  I am getting the following error in the error log.  Can=
=20
> someone interpret this for me.  Thanks.
>=20
> src@hostname syslog-ng[12920]: Error connecting to remote host=20
> IF_INET(loghost:514), reattempting in 60 seconds

It says that the connection attempt to the host "loghost" on TCP port
514 failed (AF_INET, not IF_INET - you should paste error messages
whenever possible, typos make it harder to see what's going on).

You need to test several things:

 1) does the name "loghost" resolve to an IP?
 2) can you telnet to port 514 on the loghost from the server trying to
    connect?
 3) if not, can you connect to port 514 from the loghost itself? If not,
    make sure you have syslog-ng listening on that TCP port with a line
    something like this:
     source src { unix-stream("/dev/log"); internal(); udp();
     tcp(ip("123.123.123.123") port(514) keep-alive(yes)); };
 4) if syslog-ng is listening on that port but you cannot connect from
    the remote host, make sure there's no packet filtering/firewalling
    between the hosts. See if you can ping between the hosts or make
    other connections like ssh or HTTP.
--=20
"I rigged my cellular to send a message to my PDA, which is online with
my PC, to get it to activate the voicemail, which sends the message to
the inbox of my email, which routes it to the PDA, which beams it back
to the cellular. Then I realized my gadgets have a better social life
than I do." !"    - Tom Ostad.=20