Graylog 3.0 Syslog UDP input fails to start even though address is not in use

I have been trying to start a basic SYSLOG UDP input. But this FAILS to start because “address is already in use”.

First at port = 514, then I read in forum that only root can use this port or I must use firewall redirecting. For quick demo, I try change the port to a non-privileged range.

Secondly, I then try port = 8514. This also fails. Then I get frustrated and change to port 8515 and I get the same thing.

I also tried port 1514. Same thing. It is almost as if every port it anticipates I will try, becomes “address already in use”. IP address used = 0.0.0.0:8514.

Iptables off. Selinux is set to permissive. What else could I be doing wrong?

what does the Graylog server.log tell you?

2019-03-20T15:30:12.533+02:00 WARN [UdpTransport] receiveBufferSize (SO_RCVBUF) for input SyslogUDPInput{title=SyslogUDP Input, type=org.graylog2.inputs.syslog.udp.Sys
logUDPInput, nodeId=204dcce9-4c1d-4f1e-8ca6-6e32be4b2261} (channel [id: 0x7fd72390, L:/0:0:0:0:0:0:0:0%0:8514]) should be 262144 but is 262142.
2019-03-20T15:30:12.536+02:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.udp.SyslogUDPInput] input with ID <5c9228643c55fa0afda766c4> misfired. Reason: bind(
…) failed: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address alrea
dy in use
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:84) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:181) [graylog.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_111]
at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_111]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_111]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_111]
at java.lang.Thread.run(Thread.java:745) [?:1.8.0_111]
Caused by: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.inputs.transports.UdpTransport.launch(UdpTransport.java:135) ~[graylog.jar:?]
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
… 7 more
Caused by: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at io.netty.channel.unix.Errors.newIOException(Errors.java:122) ~[graylog.jar:?]
at io.netty.channel.unix.Socket.bind(Socket.java:287) ~[graylog.jar:?]
at io.netty.channel.epoll.AbstractEpollChannel.doBind(AbstractEpollChannel.java:684) ~[graylog.jar:?]
at io.netty.channel.epoll.EpollDatagramChannel.doBind(EpollDatagramChannel.java:256) ~[graylog.jar:?]
at io.netty.channel.AbstractChannel$AbstractUnsafe.bind(AbstractChannel.java:562) ~[graylog.jar:?]
at io.netty.channel.DefaultChannelPipeline$HeadContext.bind(DefaultChannelPipeline.java:1332) ~[graylog.jar:?]
at io.netty.channel.AbstractChannelHandlerContext.invokeBind(AbstractChannelHandlerContext.java:501) ~[graylog.jar:?]
at io.netty.channel.AbstractChannelHandlerContext.bind(AbstractChannelHandlerContext.java:486) ~[graylog.jar:?]
at io.netty.channel.ChannelOutboundHandlerAdapter.bind(ChannelOutboundHandlerAdapter.java:35) ~[graylog.jar:?]
at io.netty.channel.AbstractChannelHandlerContext.invokeBind(AbstractChannelHandlerContext.java:501) ~[graylog.jar:?]
at io.netty.channel.AbstractChannelHandlerContext.bind(AbstractChannelHandlerContext.java:486) ~[graylog.jar:?]
at io.netty.channel.ChannelDuplexHandler.bind(ChannelDuplexHandler.java:38) ~[graylog.jar:?]
at io.netty.channel.AbstractChannelHandlerContext.invokeBind(AbstractChannelHandlerContext.java:501) ~[graylog.jar:?]
at io.netty.channel.AbstractChannelHandlerContext.bind(AbstractChannelHandlerContext.java:486) ~[graylog.jar:?]
at io.netty.channel.DefaultChannelPipeline.bind(DefaultChannelPipeline.java:984) ~[graylog.jar:?]
at io.netty.channel.AbstractChannel.bind(AbstractChannel.java:258) ~[graylog.jar:?]
at io.netty.bootstrap.AbstractBootstrap$2.run(AbstractBootstrap.java:366) ~[graylog.jar:?]
at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:163) ~[graylog.jar:?]
at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:404) ~[graylog.jar:?]
at io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:333) ~[graylog.jar:?]
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:905) ~[graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:181) ~[graylog.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) ~[?:1.8.0_111]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) ~[?:1.8.0_111]

I created a syslog TCP input and it worked. For my PoC, I think this is fine. I will retry UDP input for syslog at another time.

New problem came up when testing reporting in Graylog 3.0.x

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.