For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jhanington_1353's avatar
jhanington_1353
Icon for Nimbostratus rankNimbostratus
Mar 17, 2015

Connection failed syslog errors

I set up the F5 to send syslogs to logstash and I keep seeing these messages... { "message": "<43>Mar 17 12:15:04 local/lb3 err syslog-ng[23508]: Connection failed; error='Connection refused (...
application delivery
LTM
Hannes_Rapp's avatar
Hannes_Rapp
Icon for Nimbostratus rankNimbostratus
Mar 19, 2015

The interesting line is:

 

"err syslog-ng[23508]: Connection failed; error='Connection refused (111)', time_reopen='60'"

 

  • In my experience, the "connection refused" message indicates that the TCP SYN packet received it's intended destination, but the TCP socket was not established. This usually means one of two things - either the application supposed to listen on a given TCP port is not up and running, or the TCP destination port you have configured is incorrect.
  • Recommend to use the Telnet tool to try and verify TCP connectivity: e.g. "telnet 10.0.0.12 Your-TCP-Port-Number"