# Graylog5 Input 'SYSLOG-2222/TCP' could not be started Request to start input 'SYSLOG-2222/TCP' failed **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [May 6, 2023, 12:45am UTC](https://community.graylog.org/t/graylog5-input-syslog-2222-tcp-could-not-be-started-request-to-start-input-syslog-2222-tcp-failed/28699 "2023-05-06T00:45:10Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![SoMoney](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/somoney/32/4445_2.png) [@SoMoney](https://community.graylog.org/u/SoMoney)\ **Post date:** [May 6, 2023, 12:45am UTC](https://community.graylog.org/t/graylog5-input-syslog-2222-tcp-could-not-be-started-request-to-start-input-syslog-2222-tcp-failed/28699/1 "2023-05-06T00:45:10Z")
**1. Describe your incident:** I migrated my Graylog4 data and Elasticsearch logs over to a new graylog. I can see my old data but all my inputs will not start. Here is an example. I create a TCP input for port 2222 and that looks good in logs: ```auto 2023-05-05T16:45:56.050-07:00 INFO [InputStateListener] Input [Syslog TCP/6455953456ec7834db63184d] is now STARTING 2023-05-05T16:45:56.053-07:00 WARN [AbstractTcpTransport] receiveBufferSize (SO_RCVBUF) for input SyslogTCPInput{title=SYSLOG-2222/TCP, type=org.graylog2.inputs.syslog.tcp.SyslogTCPInput, nodeId=bcd3b26f-bffb-4a51-be16-4d927637cf6d} (channel [id: 0x86b8399d, L:/10.1.1.14:2514]) should be >= 1048576 but is 425984. 2023-05-05T16:45:56.055-07:00 INFO [InputStateListener] Input [Syslog TCP/6455953456ec7834db63184d] is now RUNNING ``` But when I try and start the input I see a red banner at the bottom of the screen that says: ```auto Input 'SYSLOG-2222/TCP' could not be started Request to start input 'SYSLOG-2222/TCP' failed. Check your Graylog logs for more information. ``` Im usually pretty good about checking log files but this failed condition does not appear on my server logs. **2. Describe your environment:** - OS Information: RHEL9.1 - Package Version: Graylog 5.0.7+7758557 on localhost (Eclipse Adoptium 17.0.6 on Linux 5.14.0-162.23.1.el9\_1.x86\_64) OpenSearch 2.5.0 mongodb v6.0.5 nginx/1.20.1 - Service logs, configurations, and environment variables: GRAYLOG\_SERVER\_JAVA\_OPTS=“$GRAYLOG\_SERVER\_JAVA\_OPTS -Djavax.net.ssl.trustStore=/etc/graylog/server/cacerts.jks” **3. What steps have you already taken to try and solve the problem?** temporarily turned off selinux and fapolicyd while I troubleshoot (no change) opened port 2222/tcp up with firewalld (no change) tail -f /var/log/graylog-server/server.log (no logs other than the input creation!) Restarted and rebooted the server a couple times. **4. How can the community help?** Any input on debugging this further. ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 6, 2023, 4:35am UTC](https://community.graylog.org/t/graylog5-input-syslog-2222-tcp-could-not-be-started-request-to-start-input-syslog-2222-tcp-failed/28699/2 "2023-05-06T04:35:07Z")
hey @SoMoney What is the status of Opensearch,Graylog and Mongo? Have you check those other logs too? Are you using HTTPS by chance? Here some add info on that WARN. This working for my CentOS/Red Hat node. > **[How to increase maximum socket receive buffer size](https://sleeplessbeastie.eu/2020/04/24/how-to-increase-maximum-socket-receive-buffer-size/)** > > Graylog will generate a warning to inform you that socket receive buffer size (SO\_RCVBUF) should be increased. ---
**Author:** ![SoMoney](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/somoney/32/4445_2.png) [@SoMoney](https://community.graylog.org/u/SoMoney)\ **Post date:** [May 6, 2023, 7:55pm UTC](https://community.graylog.org/t/graylog5-input-syslog-2222-tcp-could-not-be-started-request-to-start-input-syslog-2222-tcp-failed/28699/3 "2023-05-06T19:55:06Z")
Okay figured it out. It was TLS certificate related. Looking for any error in /var/log/graylog-server/server.log I saw the following ```auto 2023-05-06T12:27:44.636-07:00 WARN [ProxiedResource] Unable to call https://10.1.1.14:9000/api/system/metrics/multiple on node : Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty ``` I was adding my certificates to /etc/graylog/server/cacerts.jks with keytool and then told /etc/sysconfig/graylog-server: ```auto GRAYLOG_SERVER_JAVA_OPTS="$GRAYLOG_SERVER_JAVA_OPTS -Djavax.net.ssl.trustStore=/etc/graylog/server/cacerts.jks -Djavax.net.ssl.trustStoreType=jks" ``` HOWEVER, THIS OMITS GRAYLOGS v5.0 cacerts file /usr/share/graylog-server/jvm/lib/security/cacerts. So My issue: 1. I cant use an IP\_ADDRESS http\_publish\_uri it has to be a name (because my TLS cert used a name). ```auto http_bind_address = 0.0.0.0:9000 http_publish_uri = https://FULLYQUALIFIED_DOMAIN.com/ ``` 1. -Djavax.net.ssl.trustStore option bypassed graylog v5 built in /usr/share/graylog-server/jvm/lib/security/cacerts file. My FIX: 1. comment out my GRAYLOG\_SERVER\_JAVA\_OPTS change and just use the cacerts file graylog comes with (/usr/share/graylog-server/jvm/lib/security/cacerts). ```auto keytool -importcert -keystore /usr/share/graylog-server/jvm/lib/security/cacerts -storepass changeit -alias REDACTED -file ./REDATCED.crt keytool -importcert -keystore /usr/share/graylog-server/jvm/lib/security/cacerts -storepass changeit REDACTED -file ./REDATCED.crt keytool -importcert -keystore /usr/share/graylog-server/jvm/lib/security/cacerts -storepass changeit -alias REDACTED -file ./REDATCED.bundle.crt ``` Now my inputs start up… ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [May 20, 2023, 7:55pm UTC](https://community.graylog.org/t/graylog5-input-syslog-2222-tcp-could-not-be-started-request-to-start-input-syslog-2222-tcp-failed/28699/4 "2023-05-20T19:55:36Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.