Nginx Input is not getting started

Graylog Central (peer support)
1

Hi Guys,

Since I am pretty novice I am trying to import Nginx content pack from marketplace but it fails to start stating this error. While my other content pack and Input is working properly.

Can someone pls help

An input has failed to start (triggered a minute ago)
Input 597ef9b3287a8d031d4cef5b has failed to start on node 6d133f7f-9b63-4a0b-ac6b-17ffa3626647 for this reason: »Address already in use.«. This means that you are unable to receive any messages from this input. This is mostly an indication for a misconfiguration or an error. You can click here to solve this.

2

There’s already another input running on the same network interface and port.
You need to stop or delete the other input first.

3

This is defintely not the case; I checked that 1000 times and nothing is listening on that port or IP

Here is the output before starting

# ss -uln
State      Recv-Q Send-Q                                       Local Address:Port                                                      Peer Address:Port
UNCONN     0      0                                                       :::5353

Here is later.

ss -uln
State      Recv-Q Send-Q                                       Local Address:Port                                                      Peer Address:Port
UNCONN     0      0                                                       :::12301                                                               :::*
UNCONN     0      0                                                       :::12302                                                               :::*
UNCONN     0      0                                                       :::5353

Where I could I see the details logs to troubleshoot the issue?

4

What inputs have you created in Graylog and what’s their configuration?

5

I need to forward my reverse proxy logs to graylog and have DNS Malware sinkhole…dang both are not getting up. I imported content pack from marketplace which automatically created Input which is not getting started.

6

If you don’t answer my questions, I’m unable to help you.

7

This is what I imported Content Pack from marketplace and that automatically have created the Inputs. I am sorry; am I missing anything? since I am complete novice would you please elaborate the information you need for? I really need to work hard on graylog and have started on this…

8

You didn’t tell us which content pack you’ve downloaded and imported.
Also, you didn’t tell us what inputs there are in your Graylog setup and what’s their configuration.

9

Oh I downloaded https://marketplace.graylog.org/addons/572ff823-62cc-468e-af17-300bcfd9932d and there is other custom made Content Pack which is here…https://sourceforge.net/projects/cleandns/files/stuff/CleanDNS%20-%20GrayLog%20Content%20Pack/

10

Why is it so hard to answer the questions about your inputs?

11

I am sorry I am not getting what exact information you need? How can I give you the data you have requested or if you can pls guide me exactly what information is needed I’ll be able to provide the same. I am sorry again if I am bothering you a lot.

12

All inputs are listed on the System / Inputs page in the Graylog web interface.

13

Ok so you need snapshots of those?

CleanDNS_INPUT Syslog UDP 1 RUNNING
allow_override_date: true
bind_address: 0.0.0.0
expand_structured_data: false
force_rdns: false
override_source:
port: 5353
recv_buffer_size: 262144
store_full_message: true

##############

nginx access_log Syslog UDP FAILED
allow_override_date: true
bind_address: 0.0.0.0
override_source:
port: 12301
recv_buffer_size: 1048576

######################

nginx error_log Syslog UDP FAILED
allow_override_date: true
bind_address: 0.0.0.0
override_source:
port: 12302
recv_buffer_size: 1048576

14

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.