New install, failing (invisible) input

Grakkal · September 6, 2017, 4:19pm

Greetings,

I have a new Graylog install, and all is going fine now for the most part. I have it up and running, and collecting logs from a remote server.

However, the web interface is complaining that an Input can’t start due to not having permissions (likely to open port 514). My problem isn’t that it can’t open the port, I don’t need that port to be opened, I have it accepting logs on port 9099, but it isn’t displaying that Input so that I can delete it.

Anything I can do about this?

jochen · September 6, 2017, 4:22pm

How did you install Graylog?
Which inputs are on the System/Inputs page and what’s their status and configuration?
What’s in the logs of your Graylog node(s)?

Grakkal · September 6, 2017, 4:31pm

Thanks for replying so quickly!

I installed Graylog from the GL Yum repo on Centos 7. Please see the below screenshot of my Inputs page in the Web interface, and log entries below that.

2017-09-06T15:23:45.617Z INFO  [InputStateListener] Input [Syslog UDP/59b0123928b44c0fa85b920f] is now STARTING
2017-09-06T15:23:45.624Z ERROR [NettyTransport] Error in Input [Syslog UDP/59b0123928b44c0fa85b920f] (channel [id: 0x18e5b308])
java.net.SocketException: Permission denied
        at sun.nio.ch.Net.bind0(Native Method) ~[?:1.8.0_141]
        at sun.nio.ch.Net.bind(Net.java:433) ~[?:1.8.0_141]
        at sun.nio.ch.DatagramChannelImpl.bind(DatagramChannelImpl.java:691) ~[?:1.8.0_141]
        at sun.nio.ch.DatagramSocketAdaptor.bind(DatagramSocketAdaptor.java:91) ~[?:1.8.0_141]
        at org.jboss.netty.channel.socket.nio.NioDatagramPipelineSink.bind(NioDatagramPipelineSink.java:129) [graylog.jar:?]
        at org.jboss.netty.channel.socket.nio.NioDatagramPipelineSink.eventSunk(NioDatagramPipelineSink.java:77) [graylog.jar:?]
        at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendDownstream(DefaultChannelPipeline.java:779) [graylog.jar:?]
        at org.jboss.netty.channel.SimpleChannelHandler.bindRequested(SimpleChannelHandler.java:299) [graylog.jar:?]
        at org.jboss.netty.channel.SimpleChannelHandler.handleDownstream(SimpleChannelHandler.java:265) [graylog.jar:?]
        at org.jboss.netty.channel.DefaultChannelPipeline.sendDownstream(DefaultChannelPipeline.java:591) [graylog.jar:?]
        at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendDownstream(DefaultChannelPipeline.java:784) [graylog.jar:?]
        at org.jboss.netty.channel.SimpleChannelHandler.bindRequested(SimpleChannelHandler.java:299) [graylog.jar:?]
        at org.jboss.netty.channel.SimpleChannelHandler.handleDownstream(SimpleChannelHandler.java:265) [graylog.jar:?]
        at org.jboss.netty.channel.DefaultChannelPipeline.sendDownstream(DefaultChannelPipeline.java:591) [graylog.jar:?]
        at org.jboss.netty.channel.DefaultChannelPipeline.sendDownstream(DefaultChannelPipeline.java:582) [graylog.jar:?]
        at org.jboss.netty.channel.Channels.bind(Channels.java:561) [graylog.jar:?]
        at org.jboss.netty.channel.AbstractChannel.bind(AbstractChannel.java:197) [graylog.jar:?]
        at org.jboss.netty.bootstrap.ConnectionlessBootstrap.bind(ConnectionlessBootstrap.java:198) [graylog.jar:?]
        at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:136) [graylog.jar:?]
        at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:153) [graylog.jar:?]
        at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:84) [graylog.jar:?]
        at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_141]
        at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_141]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_141]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_141]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_141]
2017-09-06T15:23:45.624Z ERROR [InputLauncher] The [org.graylog2.inputs.syslog.udp.SyslogUDPInput] input with ID <59b0123928b44c0fa85b920f> misfired. Reason: Permission denied.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /127.0.0.1:515
        at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:156) ~[graylog.jar:?]
        at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:84) [graylog.jar:?]
        at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_141]
        at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_141]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_141]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_141]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_141]
Caused by: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /127.0.0.1:515
        at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:155) ~[graylog.jar:?]
        at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:153) ~[graylog.jar:?]
        ... 7 more
Caused by: org.jboss.netty.channel.ChannelException: Failed to bind to: /127.0.0.1:515
        at org.jboss.netty.bootstrap.ConnectionlessBootstrap.bind(ConnectionlessBootstrap.java:204) ~[graylog.jar:?]
        at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:136) ~[graylog.jar:?]
        at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:153) ~[graylog.jar:?]
        ... 7 more
Caused by: java.net.SocketException: Permission denied
        at sun.nio.ch.Net.bind0(Native Method) ~[?:1.8.0_141]
        at sun.nio.ch.Net.bind(Net.java:433) ~[?:1.8.0_141]
        at sun.nio.ch.DatagramChannelImpl.bind(DatagramChannelImpl.java:691) ~[?:1.8.0_141]
        at sun.nio.ch.DatagramSocketAdaptor.bind(DatagramSocketAdaptor.java:91) ~[?:1.8.0_141]
        at org.jboss.netty.channel.socket.nio.NioDatagramPipelineSink.bind(NioDatagramPipelineSink.java:129) ~[graylog.jar:?]
        at org.jboss.netty.channel.socket.nio.NioDatagramPipelineSink.eventSunk(NioDatagramPipelineSink.java:77) ~[graylog.jar:?]
        at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendDownstream(DefaultChannelPipeline.java:779) ~[graylog.jar:?]
        at org.jboss.netty.channel.SimpleChannelHandler.bindRequested(SimpleChannelHandler.java:299) ~[graylog.jar:?]
        at org.jboss.netty.channel.SimpleChannelHandler.handleDownstream(SimpleChannelHandler.java:265) ~[graylog.jar:?]
        at org.jboss.netty.channel.DefaultChannelPipeline.sendDownstream(DefaultChannelPipeline.java:591) ~[graylog.jar:?]
        at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendDownstream(DefaultChannelPipeline.java:784) ~[graylog.jar:?]
        at org.jboss.netty.channel.SimpleChannelHandler.bindRequested(SimpleChannelHandler.java:299) ~[graylog.jar:?]
        at org.jboss.netty.channel.SimpleChannelHandler.handleDownstream(SimpleChannelHandler.java:265) ~[graylog.jar:?]
        at org.jboss.netty.channel.DefaultChannelPipeline.sendDownstream(DefaultChannelPipeline.java:591) ~[graylog.jar:?]
        at org.jboss.netty.channel.DefaultChannelPipeline.sendDownstream(DefaultChannelPipeline.java:582) ~[graylog.jar:?]
        at org.jboss.netty.channel.Channels.bind(Channels.java:561) ~[graylog.jar:?]
        at org.jboss.netty.channel.AbstractChannel.bind(AbstractChannel.java:197) ~[graylog.jar:?]
        at org.jboss.netty.bootstrap.ConnectionlessBootstrap.bind(ConnectionlessBootstrap.java:198) ~[graylog.jar:?]
        at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:136) ~[graylog.jar:?]
        at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:153) ~[graylog.jar:?]
        ... 7 more
2017-09-06T15:23:45.626Z INFO  [InputStateListener] Input [Syslog UDP/59b0123928b44c0fa85b920f] is now FAILED

Grakkal · September 6, 2017, 4:33pm

Tried to post a reply with screenshot and log entries. Akismet has hidden it.

jochen · September 6, 2017, 5:00pm

This is indeed strange. Are you running more than 1 Graylog node?

Please post the output of the following cURL commands (with http://graylog.example.com:9000/api/ replaced by the actual URI of the Graylog REST API and your admin user credentials):

# curl -u admin:password -H 'Accept: application/json' 'http://graylog.example.com:9000/api/system/inputs?pretty=true'
# curl -u admin:password -H 'Accept: application/json' 'http://graylog.example.com:9000/api/system/inputs/59b0123928b44c0fa85b920f?pretty=true'

# curl -u admin:password -H 'Accept: application/json' 'http://graylog.example.com:9000/api/system/inputstates?pretty=true'
# curl -u admin:password -H 'Accept: application/json' 'http://graylog.example.com:9000/api/system/inputstates/59b0123928b44c0fa85b920f?pretty=true'

Grakkal · September 6, 2017, 5:07pm

See output of those commands below.

{
  "inputs" : [ {
    "title" : "Test",
    "global" : false,
    "name" : "Raw/Plaintext UDP",
    "content_pack" : null,
    "created_at" : "2017-09-06T15:41:50.113Z",
    "type" : "org.graylog2.inputs.raw.udp.RawUDPInput",
    "creator_user_id" : "admin",
    "attributes" : {
      "override_source" : null,
      "recv_buffer_size" : 262144,
      "bind_address" : "104.239.241.187",
      "port" : 9099
    },
    "static_fields" : { },
    "node" : "eff73833-092d-4362-b700-5d124b14d4d1",
    "id" : "59b0110628b44c0fa85b90bf"
  } ],
  "total" : 1
}

{
  "type" : "ApiError",
  "message" : "Input <59b0123928b44c0fa85b920f> not found!"
}

Seems it doesn’t exist, but Graylog still thinks it does for some reason.

Grakkal · September 6, 2017, 6:03pm

Sorry, I didn’t see the second set of lines.

curl -u admin:\<redacted\> -H 'Accept: application/json' 'http://\<redacted\>:9000/api/system/inputsstates/59b0123928b44c0fa85b920f?pretty=true'
{"type":"ApiError","message":"HTTP 404 Not Found"}

curl -u admin:\<redacted\> -H 'Accept: application/json' 'http://\<redacted\>:9000/api/system/inputsstates?pretty=true'

{"type":"ApiError","message":"HTTP 404 Not Found"}

jochen · September 6, 2017, 9:06pm

Are you sure you’ve been looking at the correct log file?
Is there more than one Graylog instance running on that system?

Grakkal · September 7, 2017, 12:34pm

Just the one Graylog instance running. It’s the only thing on this box created just for Graylog. (Other than, of course Mongo and ES required for running Graylog.) . I’m looking at /var/log/graylog-server/server.log

If there’s another log file I should know about, please let me know.

Grakkal · September 13, 2017, 7:05pm

Just wanted to let everyone know that the issue was just that after an error is fixed, the red error icon at the head of the page doesn’t go away by itself. So, sorry the issue was all me.

This issue can be closed.

system · September 27, 2017, 7:05pm

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Input log problem Graylog Central (peer support)	5	20546	January 29, 2020
WARN [ProxiedResource] Unable to call and unable to start inputs Graylog Central (peer support)	24	5369	March 18, 2021
ERROR [InputLauncher] UDP Permission Denied Graylog Central (peer support)	3	18152	April 18, 2018
Cleanest solution to 'input failed' and binding to privileged ports (systemd users) Graylog Central (peer support)	1	6237	November 22, 2020
The local input isn't running Graylog Central (peer support)	2	307	September 15, 2023

New install, failing (invisible) input

Related Topics