Input with contentpack import

Graylog Central (peer support)
1

Hi, I’m using Graylog 4.1.6
I created a rule for text matching and I export it with it’s pipeline, stream and new input, using contentpack
Upload and install is ok but when I look the input i see it not-started.
So I click to start it but the failed message is visible.
Looking the Graylog log I see this error:

2022-05-28 22:04:23,906 WARN : org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Failed to start channel for input BeatsInput{title=S-O365, type=org.graylog.plugins.beats.BeatsInput, nodeId=null}

io.netty.channel.unix.Errors$NativeIoException: bind(..) failed: Address already in use

2022-05-28 22:04:23,907 ERROR: org.graylog2.shared.inputs.InputLauncher - The [org.graylog.plugins.beats.BeatsInput] input with ID <62929c4d5bdb5a370bc5660c> misfired. Reason: bind(..) failed: Address already in use.

org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(..) failed: Address already in use

But it not possible as the port 5044 is not present in other input
Where I’m doing wrong? Why Graylog say me that it is already used?

2

Graylog is just passing through the IO error from the operating system. If none of your inputs is using 5044, then some other application must be.

Use something like sudo netstat -tunlp to see what is listening on 5044.
Or just use a different port.

3

Thanks for your help
using sudo netstat -tunlp I see this port mapping

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:9000            0.0.0.0:*               LISTEN      475/java
tcp        0      0 0.0.0.0:12201           0.0.0.0:*               LISTEN      475/java
tcp        0      0 0.0.0.0:5100            0.0.0.0:*               LISTEN      475/java
tcp        0      0 0.0.0.0:5101            0.0.0.0:*               LISTEN      475/java
tcp        0      0 0.0.0.0:5102            0.0.0.0:*               LISTEN      475/java
tcp        0      0 0.0.0.0:5103            0.0.0.0:*               LISTEN      475/java
tcp        0      0 0.0.0.0:5108            0.0.0.0:*               LISTEN      475/java
tcp        0      0 0.0.0.0:5044            0.0.0.0:*               LISTEN      475/java
tcp        0      0 0.0.0.0:5045            0.0.0.0:*               LISTEN      475/java
tcp        0      0 0.0.0.0:5046            0.0.0.0:*               LISTEN      475/java
tcp        0      0 0.0.0.0:5047            0.0.0.0:*               LISTEN      475/java
tcp        0      0 0.0.0.0:1015            0.0.0.0:*               LISTEN      475/java
tcp        0      0 0.0.0.0:5054            0.0.0.0:*               LISTEN      475/java
udp        0      0 0.0.0.0:2055            0.0.0.0:*                           475/java
udp        0      0 0.0.0.0:5308            0.0.0.0:*                           475/java

I think that 5044 present on this list means that graylog start the input correctly. Fr this reason I test the telnent command and send message on it.
It works fine

So, it seems a UI problem because the nput was installed correclty and should work fine. The problem is the GUI error after content pack import.

If I delete the input, restart graylog and create the same input manually it works fine

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.