syslog-troubleshootlisted

# Syslog Troubleshooting Skill Diagnose syslog-mcp problems systematically. Use the binary's observability counters and existing diagnostic tooling rather than guessing — the codebase exposes most state needed to localize a failure. ## Decision tree — pick the right diagnostic Match the user's report against one of these branches and follow only that branch. Don't run every check; that's what `syslog-dr` is for and it overwhelms when the failure is narrow. ### Branch A — "MCP can't connect" / "Failed to reconnect" / "401 / 404 from /mcp" Most common cause: empty / wrong `$CLAUDE_PLUGIN_OPTION_SERVER_URL`, mismatched `$CLAUDE_PLUGIN_OPTION_API_TOKEN`, or service not running. 1. **Is anything listening on the MCP port?** `ss -tlnp | grep -E ":$CLAUDE_PLUGIN_OPTION_MCP_PORT"` — if empty, the service is down → branch C 2. **Is the URL Claude Code is using sane?** Read `~/.claude/settings.json`, find the `pluginConfigs` key that starts with `syslog@`, and inspect `options.server_url` — empty string is a known footgun (the `.mcp.json` substitution produces a literal `/mcp`). Check non-empty, has scheme, no trailing `/mcp`. 3. **Does observed auth match configured auth?** Run `curl -sS -o /dev/null -w '%{http_code}' "$CLAUDE_PLUGIN_OPTION_SERVER_URL/mcp"`. - If `$CLAUDE_PLUGIN_OPTION_NO_AUTH` is true or no bearer/OAuth auth is configured, `200` or MCP protocol-level `400/405` can be normal route evidence. - If bearer or OAuth auth is enabled, expect `401` for an