Remote client gets connection to localhost refused

Check: advertised.listeners value. Fix: It advertises localhost by design — set your internal address (deploy step 2).

Broker down after reboot

Check: `systemctl status kafka kafka-firstboot` (AWS) / `systemctl status kafka kafka-format` (GCE). Fix: The format unit must succeed once; check /var/lib/kafka ownership (kafka:kafka).

Storage format error on first boot

Check: journalctl -u kafka-firstboot (AWS) / journalctl -u kafka-format (GCE). Fix: If /var/lib/kafka has stale files, clear the volume — format only runs when meta.properties is absent.

Troubleshoot Apache Kafka (KRaft, Hardened) — Derek Coleman & Associates Inc Docs

Symptom	Check	Fix
Remote client gets connection to localhost refused	advertised.listeners value	It advertises localhost by design — set your internal address (deploy step 2).
Broker down after reboot	`systemctl status kafka kafka-firstboot` (AWS) / `systemctl status kafka kafka-format` (GCE)	The format unit must succeed once; check /var/lib/kafka ownership (kafka:kafka).
Storage format error on first boot	journalctl -u kafka-firstboot (AWS) / journalctl -u kafka-format (GCE)	If /var/lib/kafka has stale files, clear the volume — format only runs when meta.properties is absent.

Logs & useful commands

/var/log/kafka; `journalctl -u kafka -f`
Health: /opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server localhost:9092
First boot state: A one-shot format unit — kafka-firstboot.service (AWS) / kafka-format.service (GCE) — generates a fresh KRaft cluster id and formats /var/lib/kafka once (guarded by meta.properties), then kafka.service starts. Broker answers within ~1 minute. No credential is generated (Kafka ships with no authentication).

Still stuck? Email support@dcassociatesgroup.com with the product name, cloud + region, instance size, and the output of the health command — first response within 1 business day, most tickets same-day.