I have the beats output going to a the graylog server (10.x.x.x address). When I do a netstat command on the graylog server, I see the below…
tcp6 0 0 :::5044 :::* LISTEN
How can I get it to just listen on tcp?
On dual stack systems, that’s simply the way netstat shows processes bound via IPv4 and IPv6.
Do you have an actual problem with Graylog or Beats?
I can’t telnet over port 5044 to the graylog server even though firewalld is disabled on it…
sysconfig]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
Active: inactive (dead)
Docs: man:firewalld(1)
So before I tested with Beats I wanted to make sure the port was responding.
How exactly are you testing that?
What’s the result and what did you expect?
By using telnet to “hang” the port… On a command prompt, I enter the command
telnet graylog server IP 5044… result should be…
telnet 10.x.x.x 5044
Trying 10.x.x.x…
Connected to random.domain.local
Escape character is ‘^]’.
But instead I would see…
telnet 10.x.x.x 5040
Trying 10.x.x.x…
telnet: connect to address 10.x.x.x: Connection refused
telnet: Unable to connect to remote host
Now, since I last posted… I am able to see the desired output showing the server is listening on that port. It was a hung firewalld issue. I didn’t realize that at first so I added -Djava.net.preferIPv4Stack=true in JAVA_OPTS file.
It’s working for me now. 
Thanks for sharing your solution!
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.