Firewall Logs creation Failed

When I am trying to add FortiGate Firewall in to GrayLog server it was failed and following error message was at /var/log/graylog-server/server.log

Blockquote 2019-11-26T12:56:03.439+05:30 INFO [InputStateListener] Input [Syslog UDP/5ddcc9523011876047a34743] is now STOPPING
2019-11-26T12:56:03.451+05:30 INFO [InputStateListener] Input [Syslog UDP/5ddcc9523011876047a34743] is now STOPPED
2019-11-26T12:56:03.452+05:30 INFO [InputStateListener] Input [Syslog UDP/5ddcc9523011876047a34743] is now STARTING
2019-11-26T12:56:03.453+05:30 INFO [InputStateListener] Input [Syslog UDP/5ddcc9523011876047a34743] is now TERMINATED
2019-11-26T12:56:03.459+05:30 WARN [UdpTransport] Failed to start channel for input SyslogUDPInput{title=FortiGATE 301E, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=4d3316d6-c868-4d2c-947f-376d2eaa350b}
io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Cannot assign requested address
2019-11-26T12:56:03.462+05:30 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.udp.SyslogUDPInput] input with ID <5ddcc9523011876047a34743> misfired. Reason: bind(…) failed: Cannot assign requested address.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Cannot assign requested address
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:84) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:181) [graylog.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_222]
at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_222]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_222]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_222]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_222]
Caused by: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Cannot assign requested address
at org.graylog2.inputs.transports.UdpTransport.launch(UdpTransport.java:135) ~[graylog.jar:?]
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
… 7 more
Caused by: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Cannot assign requested address
2019-11-26T12:56:03.463+05:30 ERROR [graylog-eventbus] Exception thrown by subscriber method inputStateChanged(org.graylog2.plugin.events.inputs.IOStateChangedEvent) on subscriber org.graylog2.inputs.InputStateListener@40863800 when dispatching event: IOStateChangedEvent{oldState=STARTING, newState=FAILED, changedState=InputState{stoppable=SyslogUDPInput{title=FortiGATE 301E, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=4d3316d6-c868-4d2c-947f-376d2eaa350b}, state=FAILED, startedAt=2019-11-26T07:26:03.450Z, detailedMessage=‘null’}}
java.lang.NullPointerException: null
at java.util.Objects.requireNonNull(Objects.java:203) ~[?:1.8.0_222]
at org.graylog2.shared.system.activities.Activity.(Activity.java:34) ~[graylog.jar:?]
at org.graylog2.inputs.InputStateListener.inputStateChanged(InputStateListener.java:57) ~[graylog.jar:?]
at sun.reflect.GeneratedMethodAccessor195.invoke(Unknown Source) ~[?:?]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_222]
at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_222]
at com.google.common.eventbus.Subscriber.invokeSubscriberMethod(Subscriber.java:87) ~[graylog.jar:?]
at com.google.common.eventbus.Subscriber$SynchronizedSubscriber.invokeSubscriberMethod(Subscriber.java:144) ~[graylog.jar:?]
at com.google.common.eventbus.Subscriber$1.run(Subscriber.java:72) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:181) [graylog.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_222]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_222]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_222]

Blockquote

You probably have bad address configured in input (192.168.6.2) so graylog could start it. If your graylog server has more than 1 ip addresses configured, set correct ip listening address, otherwise default 0.0.0.0 should be fine.

according to the error - the configured IP for the Input is not available on the Graylog host.

As @shoothub already pointed out.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.