owasp-amass/amass · error

failed to create the connection to the log server: %v

Error message

failed to create the connection to the log server: %v

What it means

NewSyslogLogger dials the syslog server with net.Dial(transport, host:port) using SYSLOG_TRANSPORT (default udp, port 514). This error wraps any dial failure — DNS resolution failure, connection refused/timeout, or an unsupported transport string.

Source

Thrown at internal/tools/log.go:72

func NewSyslogLogger() (*slog.Logger, error) {
	port := os.Getenv("SYSLOG_PORT")
	host := strings.ToLower(os.Getenv("SYSLOG_HOST"))
	transport := strings.ToLower(os.Getenv("SYSLOG_TRANSPORT"))

	if host == "" {
		return nil, fmt.Errorf("no syslog host specified")
	}
	if port == "" {
		port = "514"
	}
	if transport == "" {
		transport = "udp"
	}

	writer, err := net.Dial(transport, net.JoinHostPort(host, port))
	if err != nil {
		return nil, fmt.Errorf("failed to create the connection to the log server: %v", err)
	}

	return slog.New(slogsyslog.Option{
		Level:     slog.LevelInfo,
		Converter: syslogConverter,
		Writer:    writer,
	}.NewSyslogHandler()), nil
}

func syslogConverter(addSource bool, replaceAttr func(groups []string, a slog.Attr) slog.Attr, loggerAttr []slog.Attr, groups []string, record *slog.Record) map[string]any {
	attrs := slogcommon.AppendRecordAttrsToAttrs(loggerAttr, groups, record)
	attrs = slogcommon.ReplaceAttrs(replaceAttr, []string{}, attrs...)

	return map[string]any{
		"level":   record.Level.String(),
		"message": record.Message,
		"attrs":   slogcommon.AttrsToMap(attrs...),
	}

View on GitHub (pinned to 79299dce87)

Solutions

1. Confirm the server is reachable: `nc -zvu <host> 514` (udp) or `nc -zv <host> 514` (tcp), and DNS resolves correctly
2. Set SYSLOG_TRANSPORT to a net.Dial-supported network: "udp", "tcp", "udp4", "tcp4", etc. — use "tcp" if you meant TLS-secured syslog via a local relay
3. Check firewall/NetworkPolicy rules and start the syslog daemon (systemctl start rsyslog or the container)
4. Verify host/port env values (SYSLOG_HOST, SYSLOG_PORT) are correct and the port matches the daemon's config

Example fix

// before
export SYSLOG_TRANSPORT=tls   # net.Dial has no "tls" network
// after
export SYSLOG_TRANSPORT=udp   # or run a local TLS relay on tcp
export SYSLOG_HOST=10.0.0.5
export SYSLOG_PORT=514

host := os.Getenv("SYSLOG_HOST")
transport := os.Getenv("SYSLOG_TRANSPORT")
if transport == "" { transport = "udp" }
valid := map[string]bool{"udp": true, "udp4": true, "udp6": true, "tcp": true, "tcp4": true, "tcp6": true}
if !valid[transport] {
	return fmt.Errorf("SYSLOG_TRANSPORT %q is not a net.Dial network", transport)
}
if _, err := net.LookupHost(host); err != nil {
	return fmt.Errorf("SYSLOG_HOST %q does not resolve: %v", host, err)
}

logger, err := tools.NewSyslogLogger()
if err != nil {
	if strings.Contains(err.Error(), "failed to create the connection") {
		time.Sleep(2 * time.Second) // transient network? retry once
		logger, err = tools.NewSyslogLogger()
	}
	if err != nil {
		log.Warn("syslog unreachable; falling back to file logging")
		logger, err = tools.NewFileLogger(dir, logfile)
		if err != nil { return err }
	}
}

When it happens

Trigger: SYSLOG_HOST does not resolve or is unreachable; the syslog daemon is down or not listening on the chosen port; transport set to tcp but the server only accepts udp (or an invalid value like "tls" that net.Dial does not recognize); network policy/firewall dropping port 514.

Common situations: Typo in the hostname, rsyslog/syslog-ng container not started, Kubernetes NetworkPolicy blocking egress, specifying "tls" instead of "tcp" (net.Dial has no "tls" network), or an IPv6-only host with a v4-only resolver.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

• probes were not successful against the target
• GLEIFSearchFuzzyCompletions: %s
• failed to establish a connection with the WHOIS server: %v
• no syslog host specified
• failed to cast the DomainRecord

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/28df20e9ca23bb28. Report an issue: GitHub.