Filebeats Listening Only on TCP6, Need IPV4


#1

I have the beats output going to a the graylog server (10.x.x.x address). When I do a netstat command on the graylog server, I see the below…

tcp6       0      0 :::5044                 :::*                    LISTEN  

How can I get it to just listen on tcp?


(Jochen) #2

On dual stack systems, that’s simply the way netstat shows processes bound via IPv4 and IPv6.

Do you have an actual problem with Graylog or Beats?


#3

I can’t telnet over port 5044 to the graylog server even though firewalld is disabled on it…

sysconfig]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
Active: inactive (dead)
Docs: man:firewalld(1)

So before I tested with Beats I wanted to make sure the port was responding.


(Jochen) #4

How exactly are you testing that?
What’s the result and what did you expect?


#5

By using telnet to “hang” the port… On a command prompt, I enter the command

telnet graylog server IP 5044… result should be…

telnet 10.x.x.x 5044
Trying 10.x.x.x…
Connected to random.domain.local
Escape character is ‘^]’.

But instead I would see…

telnet 10.x.x.x 5040
Trying 10.x.x.x…
telnet: connect to address 10.x.x.x: Connection refused
telnet: Unable to connect to remote host

Now, since I last posted… I am able to see the desired output showing the server is listening on that port. It was a hung firewalld issue. I didn’t realize that at first so I added -Djava.net.preferIPv4Stack=true in JAVA_OPTS file.

It’s working for me now. :slight_smile:


(Jochen) #6

Thanks for sharing your solution!


(system) #7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.