# Diag: dial tcp to trace agent, connection refused

**Symptom (exact):** tracer log: `dial tcp [ip]:8126: connect: connection refused` (or timeout). App healthy, APM empty.

**Likely causes:** (a) app in a container, tracer aiming at container-local loopback, (b) agent down or APM disabled, (c) firewall between app and agent.

**Confirm:**

1. From the *app* host/container (same network namespace as the tracer), open TCP to the configured agent host on 8126. Refused here reproduces the tracer exactly: it is not tracer config.
2. On the agent host: `datadog-agent status`, check the APM / trace-agent section is present and listening. Missing section means APM is disabled in agent config.
3. Read back the tracer env: what is `DD_AGENT_HOST` / `DD_TRACE_AGENT_URL` actually set to in the app process env? Compare with the IP you just tested.

**Fix:**

- Containers: set `DD_AGENT_HOST` to the real agent address (EC2 private IP via IMDS on ECS, node IP or service DNS on K8s). Restart the app so the tracer picks it up at init.
- Host: start the agent / enable APM in its config.
- Network: open 8126 between the app and agent security groups, keeping it off the public internet.

**Verify:** the port check from step 1 now succeeds, the tracer log shows a successful flush, and the service appears in APM within two minutes. If the port is open but no traces, move to the sampling runbook.