Hi John,
The errors indicate that there is either a firewall or Intrusion Prevention System (IPS) that blocks access to the syslog server at the IP Address.
If all devices in-between have been examined and confirmed in order to allow the traffic, then this could also mean that the syslog server is too busy and refused the connections.
When the ESA is configured to send a log file to a syslog server, then by default it will use the UDP syslog port 514 unless configured to use TCP. Once the appliance is configured, the only thing that causes the connection to be listed as refused is if it receives packets that close the connection when it is opened.
Thanks!
Libin Varghese
