ERROR [InputLauncher] UDP Permission Denied


(Sebastian M) #1

Hallo Folks ,

I am new to Graylog. I have just finished Graylog’s minimum setup. Graylog is installed on an Ubuntu 16.01 server. All components run on the same VM. So far, so good. Next, I just wanted to put an input on UDP to 514. Unfortunately that fails. The server log shows me the following error. On the web UI it only shows me failed. By default, only the time zone is set. Did I forgot something? Thanks for your help. greatings Sebastian M.

Error Message
2018-04-03T10:59:02.326+02:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.tcp.SyslogTCPInput] input with ID <5ac3424d13c57404bdebdc6e> misfired. Reason: Keine Berechtigung.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /0.0.0.0:514
        at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
        at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:84) [graylog.jar:?]
        at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_151]
        at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_151]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_151]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_151]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]
Caused by: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /0.0.0.0:514
        at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:155) ~[graylog.jar:?]
        at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
        ... 7 more
Caused by: org.jboss.netty.channel.ChannelException: Failed to bind to: /0.0.0.0:514
        at org.jboss.netty.bootstrap.ServerBootstrap.bind(ServerBootstrap.java:272) ~[graylog.jar:?]
        at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:141) ~[graylog.jar:?]
        at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
        ... 7 more
Caused by: java.net.SocketException: Keine Berechtigung
        at sun.nio.ch.Net.bind0(Native Method) ~[?:1.8.0_151]
        at sun.nio.ch.Net.bind(Net.java:433) ~[?:1.8.0_151]
        at sun.nio.ch.Net.bind(Net.java:425) ~[?:1.8.0_151]
        at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:223) ~[?:1.8.0_151]
        at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:74) ~[?:1.8.0_151]
        at org.jboss.netty.channel.socket.nio.NioServerBoss$RegisterTask.run(NioServerBoss.java:193) ~[graylog.jar:?]
        at org.jboss.netty.channel.socket.nio.AbstractNioSelector.processTaskQueue(AbstractNioSelector.java:391) ~[graylog.jar:?]
        at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:315) ~[graylog.jar:?]
        at org.jboss.netty.channel.socket.nio.NioServerBoss.run(NioServerBoss.java:42) ~[graylog.jar:?]
        at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) ~[graylog.jar:?]
        at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) ~[graylog.jar:?]
        ... 3 more
2018-04-03T10:59:02.328+02:00 INFO  [InputStateListener] Input [Syslog TCP/5ac3424d13c57404bdebdc6e] is now FAILED
2018-04-03T10:59:13.756+02:00 INFO  [InputStateListener] Input [Syslog TCP/5ac3424d13c57404bdebdc6e] is now STOPPING
2018-04-03T10:59:13.758+02:00 INFO  [InputStateListener] Input [Syslog TCP/5ac3424d13c57404bdebdc6e] is now STOPPED
2018-04-03T10:59:13.758+02:00 INFO  [InputStateListener] Input [Syslog TCP/5ac3424d13c57404bdebdc6e] is now TERMINATED
2018-04-03T11:02:58.758+02:00 INFO  [InputStateListener] Input [Syslog UDP/5ac3434213c57404bdebdd86] is now STARTING
2018-04-03T11:02:58.766+02:00 WARN  [NettyTransport] receiveBufferSize (SO_RCVBUF) for input SyslogUDPInput{title=Test UDP, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=d19a7abc-4668-4aa5-990f-123cbae48648} should be 262144 but is 212992.
2018-04-03T11:02:58.767+02:00 INFO  [InputStateListener] Input [Syslog UDP/5ac3434213c57404bdebdd86] is now RUNNING
2018-04-03T11:03:00.735+02:00 INFO  [InputStateListener] Input [Syslog UDP/5ac3434213c57404bdebdd86] is now STOPPING
2018-04-03T11:03:00.737+02:00 INFO  [InputStateListener] Input [Syslog UDP/5ac3434213c57404bdebdd86] is now STOPPED




curl -u admin:Hier koennte ihr Passwort stehen -H 'Accept: application/json' 'http://Hier koennte Ihre IP stehen:9000/api/system/inputstates?pretty=true'
{
  "states" : [ {
    "id" : "5ac3434213c57404bdebdd86",
    "state" : "FAILED",
    "started_at" : "2018-04-03T10:09:36.008Z",
    "detailed_message" : "Keine Berechtigung.",
    "message_input" : {
      "title" : "Test UDP",
      "global" : false,
      "name" : "Syslog UDP",
      "content_pack" : null,
      "created_at" : "2018-04-03T10:09:33.742Z",
      "type" : "org.graylog2.inputs.syslog.udp.SyslogUDPInput",
      "creator_user_id" : "admin",
      "attributes" : {
        "expand_structured_data" : false,
        "recv_buffer_size" : 1048576,
        "port" : 514,
        "override_source" : null,
        "force_rdns" : false,
        "allow_override_date" : true,
        "bind_address" : "0.0.0.0",
        "store_full_message" : false
      },
      "static_fields" : { },
      "node" : "d19a7abc-4668-4aa5-990f-123cbae48648",
      "id" : "5ac3434213c57404bdebdd86"
    }
  } ]

(Jochen) #2

:arrow_right: http://docs.graylog.org/en/2.4/pages/faq.html#how-can-i-start-an-input-on-a-port-below-1024


(Sebastian M) #3

Hi Jochen, thank you for the quick reply. I’m embarrassed. I totally overlooked it :). Greetings Sebastian


(system) #4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.