Firewall fails to send log to syslog server with the error "set to unreachable: Connection refused" in logrcvr.log

Firewall fails to send log to syslog server with the error "set to unreachable: Connection refused" in logrcvr.log

1739

Created On 05/20/25 09:48 AM - Last Modified 08/19/25 21:32 PM

Log Forwarding

Syslog

11.1

Next-Generation Firewall

Symptom

Firewall fails to send logs to syslog server.
Error messages are seen in logrcvr.log (less mp-log logrcvr.log) or under (/var/log/pan/logrcvr.log).

Error: _pan_init_sock(pan_syslog.c:917): server(10.12.31.10) is set to unreachable: Connection refused

Netstat and pcaps show no established TCP connection to the Syslog server.

Environment

Palo Alto Firewalls
PAN-OS 11.1.x and 12.1.x
Syslog Server

Cause

Software Issue.

Resolution

The issue is resolved under PAN-280532 in PAN-OS 11.1.10, 11.1.6-h10 and 12.1.2.
As a workaround, issue a local commit on Firewall or restart of the log-receiver process using the following command. This will temporarily restore the TCP connection.

debug software restart process log-receiver

Additional Information

N/A