Clean OVA Install, error

[sirkus]

I’m hitting a very basic, but persistent error that I’m hoping someone could shed some light on. I have a server running as a virtual box host. I want to run the graylog virtual appliance on it. Here’s what I’ve done:

1. Downloaded most current virtual appliance OVM file (graylog-2.4.5-1.ova)
2. Imported the OVM:
   $ vboxmanage import graylog-2.4.3-1.ova --vsys 0 --vmname "graylog-2.4"
3. Started the VM:
   $ vboxmanage startvm graylog-2.4 --type headless
4. SSH’d to the VM, logging in with user and password “ubuntu”
5. Changed the graylog admin password:
   $ sudo graylog_ctl set-admin-password ############
6. Reconfigured:
   $ sudo graylog-ctl reconfigure
7. Visited the web interface at http://<IP_addr_of_VM> and then I receive this error message:
   

Am I missing something? Is the VM appliance not intended to work out of the box like this? This happened last OVM release to me as well , so I waited to see if my situation would improve with the updated release. I posted back then as well about the problem, but it doesn’t seem that anyone else is having this issue.

Anyone have any ideas?

[jochen]

Is 10.4.2.23 the IP address of the virtual machine?

[sirkus]

Yes, that’s the IP the virtual machine received with DHCP on boot.

[jan (Jan Doberstein)]

is that IP reachable by your browser?

[sirkus]

Yep. As I noted above, I can access the front loading page, and it gives the error I posted above. I can ssh to the VM, ping it, etc.

[jochen]

What’s the exact address you’re using in your web browser to access the web interface?

[sirkus]

The exact address is
http://10.4.2.23

I’m trying with Chrome and Firefox. I originally had NoScript turned on, but have it disabled just to make sure its not interfering.

[jochen]

I’m unable to reproduce this with the latest stable version of the OVA (https://packages.graylog2.org/releases/graylog-omnibus/ova/graylog-2.4.5-1.ova).

Screenshot of the Node details page in the Graylog web interface:

See below for the installation protocol:

$ vboxmanage import graylog-2.4.5-1.ova --vsys 0 --vmname "graylog-2.4"
0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Interpreting /Users/joschi/Downloads/graylog-2.4.5-1.ova...
OK.
Disks:
  vmdisk1	20000	3080257536	http://www.vmware.com/interfaces/specifications/vmdk.html#streamOptimized	graylog-disk1.vmdk	1214381056	-1

Virtual system 0:
 0: Suggested OS type: "Ubuntu_64"
    (change with "--vsys 0 --ostype <type>"; use "list ostypes" to list all possible values)
 1: VM name specified with --vmname: "graylog-2.4"
 2: Number of CPUs: 2
    (change with "--vsys 0 --cpus <n>")
 3: Guest memory: 4096 MB
    (change with "--vsys 0 --memory <MB>")
 4: Network adapter: orig NAT Network, config 3, extra type=Bridged
 5: IDE controller, type PIIX4
    (disable with "--vsys 0 --unit 5 --ignore")
 6: IDE controller, type PIIX4
    (disable with "--vsys 0 --unit 6 --ignore")
 7: Hard disk image: source image=graylog-disk1.vmdk, target path=/Users/joschi/VirtualBox VMs/graylog/graylog-disk1.vmdk, controller=5;channel=0
    (change target path with "--vsys 0 --unit 7 --disk path";
    disable with "--vsys 0 --unit 7 --ignore")
0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Successfully imported the appliance.


$ vboxmanage startvm graylog-2.4 --type headless
Waiting for VM "graylog-2.4" to power on...
VM "graylog-2.4" has been successfully started.


$ vboxmanage list runningvms
"graylog-2.4" {0997e7e4-0637-4c54-97ba-32b5565dfc0d}


$ ssh -l ubuntu 192.168.1.239
The authenticity of host '192.168.1.239 (192.168.1.239)' can't be established.
ECDSA key fingerprint is SHA256:mj0SbZdGLv8k9fWud9ulh/7aROiPNCDfXYv3Yt/xYW8.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.1.239' (ECDSA) to the list of known hosts.
ubuntu@192.168.1.239's password:
Welcome to Graylog (GNU/Linux 4.4.0-127-generic x86_64)

 * Documentation:  http://docs.graylog.org/en/latest/pages/installation/virtual_machine_appliances.html
Last login: Tue Jun 19 14:23:40 2018
ubuntu@graylog:~$ sudo graylog-ctl set-admin-password 'password'
ubuntu@graylog:~$ sudo graylog-ctl reconfigure
Starting Chef Client, version 12.6.0
Compiling Cookbooks...
Recipe: graylog::default
  * directory[/etc/graylog] action create (up to date)
  Converging 123 resources
Recipe: apt::default
  * file[/var/lib/apt/periodic/update-success-stamp] action nothing (skipped due to action :nothing)
  * directory[/etc/apt/apt.conf.d] action create (up to date)
  * cookbook_file[/etc/apt/apt.conf.d/15update-stamp] action create (up to date)
  * execute[apt-get update] action nothing (skipped due to action :nothing)
  * execute[apt-get autoremove] action nothing (skipped due to action :nothing)
  * execute[apt-get autoclean] action nothing (skipped due to action :nothing)
  * execute[apt-get-update-periodic] action run (skipped due to not_if)
  * directory[/var/cache/local] action create (up to date)
  * directory[/var/cache/local/preseeding] action create (up to date)
  * template[/etc/apt/apt.conf.d/10recommends] action create (up to date)
  * apt_package[apt-transport-https] action install (up to date)
Recipe: graylog::default
  * directory[/etc/graylog] action nothing (skipped due to action :nothing)
Recipe: graylog::users
  * group[graylog] action create (up to date)
  * user[graylog] action create (up to date)
  * directory[/var/opt/graylog] action create (up to date)
  * template[/var/opt/graylog/.gitconfig] action create (up to date)
  * directory[/var/opt/graylog/data] action create (up to date)
Recipe: graylog::authbind
  * directory[/etc/authbind/byport] action create (up to date)
  * file[/etc/authbind/byport/!514] action create (up to date)
Recipe: runit::upstart
  * cookbook_file[/etc/init/graylog-runsvdir.conf] action create (up to date)
  * execute[initctl status graylog-runsvdir] action run
    - execute initctl status graylog-runsvdir
  * execute[initctl start graylog-runsvdir] action run (skipped due to only_if)
Recipe: runit::svloggelfd
  * cookbook_file[/opt/graylog/embedded/cookbooks/cache/svloggelfd-0.2.1.tar.gz] action create (up to date)
  * execute[extract svloggelfd] action run (skipped due to not_if)
Recipe: timezone-ii::default
  * apt_package[tzdata] action install (up to date)
Recipe: timezone-ii::debian
  * template[/etc/timezone] action create (up to date)
  * bash[dpkg-reconfigure tzdata] action nothing (skipped due to action :nothing)
Recipe: graylog::etcd
  * directory[/var/log/graylog/etcd] action create (up to date)
  * directory[/var/opt/graylog/data/etcd] action create (up to date)
  * directory[/opt/graylog/sv/etcd] action create (up to date)
  * directory[/opt/graylog/sv/etcd/log] action create (up to date)
  * directory[/opt/graylog/sv/etcd/log/main] action create (up to date)
  * template[/opt/graylog/sv/etcd/run] action create (up to date)
  * template[/opt/graylog/sv/etcd/log/run] action create (up to date)
  * template[/var/log/graylog/etcd/config] action create (up to date)
  * ruby_block[reload etcd svlogd configuration] action nothing (skipped due to action :nothing)
  * file[/opt/graylog/sv/etcd/down] action delete (up to date)
  * link[/opt/graylog/init/etcd] action create (up to date)
  * link[/opt/graylog/service/etcd] action create (up to date)
  * ruby_block[supervise_etcd_sleep] action run (skipped due to not_if)
  * service[etcd] action nothing (skipped due to action :nothing)
  * execute[remove unneeded snapshot files] action run (skipped due to only_if)
  * execute[/opt/graylog/embedded/bin/graylog-ctl start etcd] action run
    - execute /opt/graylog/embedded/bin/graylog-ctl start etcd
Recipe: graylog::elasticsearch
  * directory[/var/log/graylog/elasticsearch] action create (up to date)
  * directory[/var/opt/graylog/data/elasticsearch] action create (up to date)
  * directory[/opt/graylog/elasticsearch/config/scripts] action create (up to date)
  * template[/opt/graylog/elasticsearch/config/elasticsearch.yml] action create (up to date)
  * template[/opt/graylog/elasticsearch/config/log4j2.properties] action create (up to date)
  * link[/opt/graylog/conf/elasticsearch] action create (up to date)
  * directory[/opt/graylog/sv/elasticsearch] action create (up to date)
  * directory[/opt/graylog/sv/elasticsearch/log] action create (up to date)
  * directory[/opt/graylog/sv/elasticsearch/log/main] action create (up to date)
  * template[/opt/graylog/sv/elasticsearch/run] action create (up to date)
  * template[/opt/graylog/sv/elasticsearch/log/run] action create (up to date)
  * template[/var/log/graylog/elasticsearch/config] action create (up to date)
  * ruby_block[reload elasticsearch svlogd configuration] action nothing (skipped due to action :nothing)
  * file[/opt/graylog/sv/elasticsearch/down] action delete (up to date)
  * link[/opt/graylog/init/elasticsearch] action create (up to date)
  * link[/opt/graylog/service/elasticsearch] action create (up to date)
  * ruby_block[supervise_elasticsearch_sleep] action run (skipped due to not_if)
  * service[elasticsearch] action nothing (skipped due to action :nothing)
  * execute[/opt/graylog/embedded/bin/graylog-ctl start elasticsearch] action run
    - execute /opt/graylog/embedded/bin/graylog-ctl start elasticsearch
  * ruby_block[add node to cluster list] action run
    - execute the ruby block add node to cluster list
Recipe: graylog::mongodb
  * directory[/var/log/graylog/mongodb] action create (up to date)
  * directory[/var/opt/graylog/data/mongodb] action create (up to date)
  * directory[/opt/graylog/sv/mongodb] action create (up to date)
  * directory[/opt/graylog/sv/mongodb/log] action create (up to date)
  * directory[/opt/graylog/sv/mongodb/log/main] action create (up to date)
  * template[/opt/graylog/sv/mongodb/run] action create (up to date)
  * template[/opt/graylog/sv/mongodb/log/run] action create (up to date)
  * template[/var/log/graylog/mongodb/config] action create (up to date)
  * ruby_block[reload mongodb svlogd configuration] action nothing (skipped due to action :nothing)
  * file[/opt/graylog/sv/mongodb/down] action delete (up to date)
  * link[/opt/graylog/init/mongodb] action create (up to date)
  * link[/opt/graylog/service/mongodb] action create (up to date)
  * ruby_block[supervise_mongodb_sleep] action run (skipped due to not_if)
  * service[mongodb] action nothing (skipped due to action :nothing)
  * execute[/opt/graylog/embedded/bin/graylog-ctl start mongodb] action run
    - execute /opt/graylog/embedded/bin/graylog-ctl start mongodb
Recipe: graylog::graylog-server
  * directory[/var/log/graylog/server] action create (up to date)
  * directory[/var/opt/graylog/data/journal] action create (up to date)
  * file[/var/opt/graylog/graylog-server-node-id] action create (up to date)
  * template[/opt/graylog/conf/graylog.conf] action create
    - update content in file /opt/graylog/conf/graylog.conf from 4822d7 to 7c45c1
    --- /opt/graylog/conf/graylog.conf	2018-06-19 14:20:07.601081618 +0000
    +++ /opt/graylog/conf/.graylog.conf20180619-1910-1vd1zxv	2018-06-19 14:24:55.366179995 +0000
    @@ -19,7 +19,7 @@
     # modify it in this file.
     # Create one by using for example: echo -n yourpassword | shasum -a 256
     # and put the resulting hash value into the following line
    -root_password_sha2 = 8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
    +root_password_sha2 = 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8

     # The email address of the root user.
     # Default is empty
  * template[/opt/graylog/conf/log4j2.xml] action create (up to date)
  * directory[/opt/graylog/sv/graylog-server] action create (up to date)
  * directory[/opt/graylog/sv/graylog-server/log] action create (up to date)
  * directory[/opt/graylog/sv/graylog-server/log/main] action create (up to date)
  * template[/opt/graylog/sv/graylog-server/run] action create (up to date)
  * template[/opt/graylog/sv/graylog-server/log/run] action create (up to date)
  * template[/var/log/graylog/server/config] action create (up to date)
  * ruby_block[reload graylog-server svlogd configuration] action nothing (skipped due to action :nothing)
  * file[/opt/graylog/sv/graylog-server/down] action delete (up to date)
  * link[/opt/graylog/init/graylog-server] action create (up to date)
  * link[/opt/graylog/service/graylog-server] action create (up to date)
  * ruby_block[supervise_graylog-server_sleep] action run (skipped due to not_if)
  * service[graylog-server] action nothing (skipped due to action :nothing)
  * execute[/opt/graylog/embedded/bin/graylog-ctl start graylog-server] action run
    - execute /opt/graylog/embedded/bin/graylog-ctl start graylog-server
  * ruby_block[add node to server list] action run
    - execute the ruby block add node to server list
Recipe: graylog::nginx
  * directory[/opt/graylog/conf/nginx/ca] action create (up to date)
  * directory[/var/log/graylog/nginx] action create (up to date)
  * template[/opt/graylog/conf/nginx/nginx.conf] action create (up to date)
  * template[/opt/graylog/embedded/html/502.html] action create (up to date)
  * directory[/opt/graylog/sv/nginx] action create (up to date)
  * directory[/opt/graylog/sv/nginx/log] action create (up to date)
  * directory[/opt/graylog/sv/nginx/log/main] action create (up to date)
  * template[/opt/graylog/sv/nginx/run] action create (up to date)
  * template[/opt/graylog/sv/nginx/log/run] action create (up to date)
  * template[/var/log/graylog/nginx/config] action create (up to date)
  * ruby_block[reload nginx svlogd configuration] action nothing (skipped due to action :nothing)
  * file[/opt/graylog/sv/nginx/down] action delete (up to date)
  * link[/opt/graylog/init/nginx] action create (up to date)
  * link[/opt/graylog/service/nginx] action create (up to date)
  * ruby_block[supervise_nginx_sleep] action run (skipped due to not_if)
  * service[nginx] action nothing (skipped due to action :nothing)
  * execute[/opt/graylog/embedded/bin/graylog-ctl start nginx] action run
    - execute /opt/graylog/embedded/bin/graylog-ctl start nginx
Recipe: ntp::default
  * apt_package[ntp] action install (up to date)
  * apt_package[ntpdate] action install (up to date)
  * directory[/var/lib/ntp] action create (up to date)
  * directory[/var/log/ntpstats/] action create (up to date)
  * cookbook_file[/etc/ntp.leapseconds] action create (up to date)
Recipe: ntp::apparmor
  * service[apparmor] action nothing (skipped due to action :nothing)
  * cookbook_file[/etc/apparmor.d/usr.sbin.ntpd] action create (up to date)
Recipe: ntp::default
  * template[/etc/ntp.conf] action create (up to date)
  * service[ntp] action enable (up to date)
  * service[ntp] action start (up to date)
Recipe: graylog::graylog-server
  * service[graylog-server] action restart
    - restart service service[graylog-server]

Running handlers:
Running handlers complete
Chef Client finished, 10/126 resources updated in 06 seconds
graylog Reconfigured!
ubuntu@graylog:~$ logout
Shared connection to 192.168.1.239 closed.

# Graylog REST API
$ curl -H 'Accept: application/json' 'http://192.168.1.239:9000/api?pretty=true'
{
  "cluster_id" : "76d6815f-3f8d-4b78-9c33-613438eb9cf8",
  "node_id" : "9f0c6740-0577-4636-9db8-3bce0081f7e0",
  "version" : "2.4.5+8e18e6a",
  "tagline" : "Manage your logs in the dark and have lasers going and make it look like you're from space!"
}

# Graylog web interface
$ curl -H 'Accept: text/html' 'http://192.168.1.239/'
<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="robots" content="noindex, nofollow">
    <meta charset="UTF-8">
    <title>Graylog Web Interface</title>
    <link rel="shortcut icon" href="/assets/favicon.png">

  </head>
  <body>
    <script src="/config.js"></script>

    <script src="/assets/vendor.552834c48b86209e305c.js"></script>

    <script src="/assets/polyfill.d62de657b1bfcd25ec80.js"></script>

    <script src="/assets/plugin/org.graylog.plugins.threatintel.ThreatIntelPlugin/plugin.org.graylog.plugins.threatintel.ThreatIntelPlugin.81cab787bad4ca22b96f.js"></script>

    <script src="/assets/plugin/org.graylog.plugins.pipelineprocessor.ProcessorPlugin/plugin.org.graylog.plugins.pipelineprocessor.PipelineProcessorPlugin.8c9a4458c39fe3208ae2.js"></script>

    <script src="/assets/plugin/org.graylog.plugins.map.MapWidgetPlugin/plugin.org.graylog.plugins.map.MapWidgetPlugin.049919e74da17267e882.js"></script>

    <script src="/assets/plugin/org.graylog.plugins.enterprise_integration.EnterpriseIntegrationPlugin/plugin.org.graylog.plugins.enterprise_integration.EnterpriseIntegrationPlugin.cb7b290aaf58d8948b4c.js"></script>

    <script src="/assets/plugin/org.graylog.plugins.collector.CollectorPlugin/plugin.org.graylog.plugins.collector.CollectorPlugin.bf8b7a7e9309b0148f8d.js"></script>

    <script src="/assets/plugin/org.graylog.aws.plugin.AWSPlugin/plugin.org.graylog.aws.plugin.AWSPlugin.b2ad019c873d95bc5ea9.js"></script>

    <script src="/assets/app.d62de657b1bfcd25ec80.js"></script>

  </body>
</html>

[sirkus]

Thanks jochen for the verification that it works fine elsewhere. Given that, I’ve dug in further to troubleshoot why I couldn’t access the API on port 9000 and found a firewall rule that was blocking port 9000, causing the API’s to fail outside of the VM instance. I addressed that, I can now log in to the web interface. So thanks for your confirmation on the OVA.

However, I do have an error still on startup that I wonder if your test also encountered with your test. Here are the simple steps.

1. Import vm
2. start VM
3. Log in, su, and view /var/log/graylog/server/current… see startup error, “address already in use” bind error. And, with web interface, viewing inputs, I see “appliance-syslog-udp Syslog UDP FAILED”

Here is the text from the process and the result.

$ vboxmanage import graylog-2.4.5-1.ova --vsys 0 --vmname "graylog-2.4"
0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Interpreting /home/virtualbox/virtual-appliances/graylog-2.4.5-1.ova...
OK.
Disks:  vmdisk1	20000	3080257536	http://www.vmware.com/interfaces/specifications/vmdk.html#streamOptimized	graylog-disk1.vmdk	1214381056	-1	
Virtual system 0:
 0: Suggested OS type: "Ubuntu_64"
    (change with "--vsys 0 --ostype <type>"; use "list ostypes" to list all possible values)
 1: VM name specified with --vmname: "graylog-2.4"
 2: Number of CPUs: 2
    (change with "--vsys 0 --cpus <n>")
 3: Guest memory: 4096 MB
    (change with "--vsys 0 --memory <MB>")
 4: Network adapter: orig NAT Network, config 3, extra type=Bridged
 5: IDE controller, type PIIX4
    (disable with "--vsys 0 --unit 5 --ignore")
 6: IDE controller, type PIIX4
    (disable with "--vsys 0 --unit 6 --ignore")
 7: Hard disk image: source image=graylog-disk1.vmdk, target path=/home/virtualbox/VirtualBox VMs/graylog_1/graylog-disk1.vmdk, controller=5;channel=0
    (change target path with "--vsys 0 --unit 7 --disk path";
    disable with "--vsys 0 --unit 7 --ignore")
0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Successfully imported the appliance.

$ vboxmanage startvm graylog-2.4 --type headless
Waiting for VM "graylog-2.4" to power on...
VM "graylog-2.4" has been successfully started.

$ ssh ubuntu@10.4.2.23
ubuntu@10.4.2.23's password: 
Welcome to Graylog (GNU/Linux 4.4.0-127-generic x86_64)

 * Documentation:  http://docs.graylog.org/en/latest/pages/installation/virtual_machine_appliances.html
Last login: Wed Jun 20 12:12:01 2018 from 10.8.0.9
ubuntu@graylog:~$ sudo tail -40 /var/log/graylog/server/current
2018-06-20_12:11:09.07143 INFO  [MongoIndexSet] Cycling from <none> to <graylog_0>.
2018-06-20_12:11:09.07498 INFO  [MongoIndexSet] Creating target index <graylog_0>.
2018-06-20_12:11:20.86917 INFO  [NetworkListener] Started listener bound to [0.0.0.0:9000]
2018-06-20_12:11:20.87527 INFO  [HttpServer] [HttpServer] Started.
2018-06-20_12:11:20.87741 INFO  [JerseyService] Started REST API at <http://0.0.0.0:9000/api/>
2018-06-20_12:11:20.88765 INFO  [JerseyService] Started Web Interface at <http://0.0.0.0:9000/>
2018-06-20_12:11:20.89328 INFO  [ServiceManagerListener] Services are healthy
2018-06-20_12:11:20.89637 INFO  [ServerBootstrap] Services started, startup times in ms: {OutputSetupService [RUNNING]=91, BufferSynchronizerService [RUNNING]=181, JournalReader [RUNNING]=200, KafkaJournal [RUNNING]=206, StreamCacheService [RUNNING]=330, LookupTableService [RUNNING]=337, InputSetupService [RUNNING]=356, ConfigurationEtagService [RUNNING]=438, PeriodicalsService [RUNNING]=703, JerseyService [RUNNING]=22023}
2018-06-20_12:11:20.90381 INFO  [ServerBootstrap] Graylog server up and running.
2018-06-20_12:11:20.90781 INFO  [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized?[LB:DEAD] to Running?[LB:ALIVE]
2018-06-20_12:11:21.09922 ERROR [NettyTransport] Error in Input [Syslog UDP/5b2a445596948905b254feea] (channel [id: 0x8da5ea5d])
2018-06-20_12:11:21.10086 java.net.BindException: Address already in use
2018-06-20_12:11:21.11667 	at sun.nio.ch.Net.bind0(Native Method) ~[?:1.8.0_172]
2018-06-20_12:11:21.11897 	at sun.nio.ch.Net.bind(Net.java:433) ~[?:1.8.0_172]
2018-06-20_12:11:21.12768 	at sun.nio.ch.DatagramChannelImpl.bind(DatagramChannelImpl.java:691) ~[?:1.8.0_172]
2018-06-20_12:11:21.12806 	at sun.nio.ch.DatagramSocketAdaptor.bind(DatagramSocketAdaptor.java:91) ~[?:1.8.0_172]
2018-06-20_12:11:21.13263 	at org.jboss.netty.channel.socket.nio.NioDatagramPipelineSink.bind(NioDatagramPipelineSink.java:129) [graylog.jar:?]
2018-06-20_12:11:21.14520 	at org.jboss.netty.channel.socket.nio.NioDatagramPipelineSink.eventSunk(NioDatagramPipelineSink.java:77) [graylog.jar:?]
2018-06-20_12:11:21.15137 	at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendDownstream(DefaultChannelPipeline.java:779) [graylog.jar:?]
2018-06-20_12:11:21.15178 	at org.jboss.netty.channel.SimpleChannelHandler.bindRequested(SimpleChannelHandler.java:299) [graylog.jar:?]
2018-06-20_12:11:21.15250 	at org.jboss.netty.channel.SimpleChannelHandler.handleDownstream(SimpleChannelHandler.java:265) [graylog.jar:?]
2018-06-20_12:11:21.15289 	at org.jboss.netty.channel.DefaultChannelPipeline.sendDownstream(DefaultChannelPipeline.java:591) [graylog.jar:?]
2018-06-20_12:11:21.15438 	at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendDownstream(DefaultChannelPipeline.java:784) [graylog.jar:?]
2018-06-20_12:11:21.17887 	at org.jboss.netty.channel.SimpleChannelHandler.bindRequested(SimpleChannelHandler.java:299) [graylog.jar:?]
2018-06-20_12:11:21.17934 	at org.jboss.netty.channel.SimpleChannelHandler.handleDownstream(SimpleChannelHandler.java:265) [graylog.jar:?]
2018-06-20_12:11:21.17983 	at org.jboss.netty.channel.DefaultChannelPipeline.sendDownstream(DefaultChannelPipeline.java:591) [graylog.jar:?]
2018-06-20_12:11:21.18645 	at org.jboss.netty.channel.DefaultChannelPipeline.sendDownstream(DefaultChannelPipeline.java:582) [graylog.jar:?]
2018-06-20_12:11:21.18829 	at org.jboss.netty.channel.Channels.bind(Channels.java:561) [graylog.jar:?]
2018-06-20_12:11:21.18888 	at org.jboss.netty.channel.AbstractChannel.bind(AbstractChannel.java:197) [graylog.jar:?]
2018-06-20_12:11:21.19713 	at org.jboss.netty.bootstrap.ConnectionlessBootstrap.bind(ConnectionlessBootstrap.java:198) [graylog.jar:?]
2018-06-20_12:11:21.20369 	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:136) [graylog.jar:?]
2018-06-20_12:11:21.20422 	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) [graylog.jar:?]
2018-06-20_12:11:21.20606 	at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:84) [graylog.jar:?]
2018-06-20_12:11:21.20668 	at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
2018-06-20_12:11:21.20856 	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_172]
2018-06-20_12:11:21.21457 	at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_172]
2018-06-20_12:11:21.22002 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_172]
2018-06-20_12:11:21.22031 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_172]
2018-06-20_12:11:21.22056 	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_172]
2018-06-20_12:11:21.22080 INFO  [InputStateListener] Input [Syslog UDP/5b2a445596948905b254feea] is now FAILED

It seems that on booting a clean VM from the OVA, a “address already in use” error is thrown. In the web interface, I can see the “appliance-syslog-udp Syslog UDP FAILED” when viewing the inputs. This is UDP port 514, so evidently something else in the VM is using that? Do you see the same problem? If not, do you know of anything that would cause this for a brand new vm import?

Thanks for your patience and help!

[sirkus]

While the question still stands about the error on a clean boot, I wanted to mention that I was able to work around it by deleting the input, restarting the VM, then recreating the input (Syslog UDP, port 514.) It seems to work fine now with no errors.