title: Graylog Collector Connection Refused
body: <p>I am trying to create a Graylog Server - Graylog Collector setup, where the graylog collector collects the syslog files on one machine and ships them to the server.</p>
  
  <p>I have used the AWS AMI to create the Graylog Server and it is working as expected.</p>
  
  <p>I installed a Graylog Collector on the same machine and I am able to see it in the list of sources for that instance.</p>
  
  <p>My problem is when I try and connect to a remote Graylog Collector.</p>
  
  <p>The Graylog Collector configuration file looks like this:</p>
  
  <pre><code>server-url = "http://xxx.xxx.xxx.xxx:12900/"
  
  inputs {  
    syslog {
      type = "file"
      path = "/var/log/syslog"
    }     
  }
  
  outputs {
    graylog-server {
      type = "gelf"
      host = "xxx.xxx.xxx.xxx"
      port = 12201
    } 
  }    
  </code></pre>
  
  <p>where xxx.xxx.xxx.xxx is the private IP address of the graylog server I am attempting to connect to.</p>
  
  <p>An extract from the configuration of the graylog server is:</p>
  
  <pre><code>rest_listen_uri = http://0.0.0.0:12900/
  </code></pre>
  
  <p>And the security groups for both instances are as follows:</p>
  
  <pre><code>-----------------------------------------------------------------
  | Type            | Protocol        | Port Range   |  Source    |
  -----------------------------------------------------------------
  | Custom TCP Rule | TCP             | 12201        |  0.0.0.0/0 |
  -----------------------------------------------------------------
  | Custom TCP Rule | TCP             | 12900        |  0.0.0.0/0 |
  -----------------------------------------------------------------
  </code></pre>
  
  <p>When I look at the logs for the graylog collector, I get the following messages:</p>
  
  <pre><code>2015-11-14T23:41:33.948+0000 ERROR [gelfTcpTransport-1-1] gelfclient.transport.GelfTcpTransport - Connection failed: Connection refused: /xxx.xxx.xxx.xxx:12201
  2015-11-14T23:41:34.949+0000 ERROR [gelfTcpTransport-1-1] gelfclient.transport.GelfTcpTransport - Connection failed: Connection refused: /xxx.xxx.xxx.xxx:12201
  2015-11-14T23:41:35.951+0000 ERROR [gelfTcpTransport-1-1] gelfclient.transport.GelfTcpTransport - Connection failed: Connection refused: /xxx.xxx.xxx.xxx:12201
  2015-11-14T23:41:36.953+0000 ERROR [gelfTcpTransport-1-1] gelfclient.transport.GelfTcpTransport - Connection failed: Connection refused: /xxx.xxx.xxx.xxx:12201
  2015-11-14T23:41:37.956+0000 ERROR [gelfTcpTransport-1-1] gelfclient.transport.GelfTcpTransport - Connection failed: Connection refused: /xxx.xxx.xxx.xxx:12201
  2015-11-14T23:41:38.698+0000 WARN  [HeartbeatService RUNNING] collector.heartbeat.HeartbeatService - Unable to send heartbeat to Graylog server: ConnectException: Connection refused
  </code></pre>
  
  <p>(again xxx.xxx.xxx.xxx is the private IP address of the graylog server I am attempting to connect to)</p>
  
  <p>I have run a traceroute between the 2 machines on port 12201 and port 12900 without any problems.</p>
  
  <p>Can anyone tell me what I might be missing in my configuration to allow these 2 to connect?</p>
  
  <p>Both are running Ubuntu 14.04.</p>
  
  <p>Thanks,</p>
  
  <p>Seán</p>