# Nginx Input is not getting started

**URL:** <https://community.graylog.org/t/nginx-input-is-not-getting-started/1881>\
**Category:** Graylog Central (peer support)\
**Created:** [July 31, 2017, 9:36am UTC](https://community.graylog.org/t/nginx-input-is-not-getting-started/1881 "2017-07-31T09:36:17Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![blason](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blason/32/2930_2.png) [@blason](https://community.graylog.org/u/blason)\
**Post date:** [July 31, 2017, 9:36am UTC](https://community.graylog.org/t/nginx-input-is-not-getting-started/1881/1 "2017-07-31T09:36:17Z")

</div>

Hi Guys,

Since I am pretty novice I am trying to import Nginx content pack from marketplace but it fails to start stating this error. While my other content pack and Input is working properly.

Can someone pls help

An input has failed to start (triggered a minute ago)  
Input 597ef9b3287a8d031d4cef5b has failed to start on node 6d133f7f-9b63-4a0b-ac6b-17ffa3626647 for this reason: »Address already in use.«. This means that you are unable to receive any messages from this input. This is mostly an indication for a misconfiguration or an error. You can click here to solve this.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [July 31, 2017, 9:51am UTC](https://community.graylog.org/t/nginx-input-is-not-getting-started/1881/2 "2017-07-31T09:51:43Z")

</div>

There’s already another input running on the same network interface and port.  
You need to stop or delete the other input first.

---

<div class="post-metadata">

**Author:** ![blason](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blason/32/2930_2.png) [@blason](https://community.graylog.org/u/blason)\
**Post date:** [July 31, 2017, 9:58am UTC](https://community.graylog.org/t/nginx-input-is-not-getting-started/1881/3 "2017-07-31T09:58:01Z")

</div>

This is defintely not the case; I checked that 1000 times and nothing is listening on that port or IP

Here is the output before starting

```auto
# ss -uln
State Recv-Q Send-Q Local Address:Port Peer Address:Port
UNCONN 0 0 :::5353    

```

Here is later.

```auto
ss -uln
State Recv-Q Send-Q Local Address:Port Peer Address:Port
UNCONN 0 0 :::12301 :::*
UNCONN 0 0 :::12302 :::*
UNCONN 0 0 :::5353    

```

Where I could I see the details logs to troubleshoot the issue?

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [July 31, 2017, 12:03pm UTC](https://community.graylog.org/t/nginx-input-is-not-getting-started/1881/4 "2017-07-31T12:03:18Z")

</div>

> [@blason](#):
>
> This is defintely not the case; I checked that 1000 times and nothing is listening on that port or IP

What inputs have you created in Graylog and what’s their configuration?

---

<div class="post-metadata">

**Author:** ![blason](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blason/32/2930_2.png) [@blason](https://community.graylog.org/u/blason)\
**Post date:** [July 31, 2017, 12:13pm UTC](https://community.graylog.org/t/nginx-input-is-not-getting-started/1881/5 "2017-07-31T12:13:31Z")

</div>

I need to forward my reverse proxy logs to graylog and have DNS Malware sinkhole…dang both are not getting up. I imported content pack from marketplace which automatically created Input which is not getting started.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [July 31, 2017, 12:43pm UTC](https://community.graylog.org/t/nginx-input-is-not-getting-started/1881/6 "2017-07-31T12:43:05Z")

</div>

If you don’t answer my questions, I’m unable to help you.

---

<div class="post-metadata">

**Author:** ![blason](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blason/32/2930_2.png) [@blason](https://community.graylog.org/u/blason)\
**Post date:** [July 31, 2017, 12:53pm UTC](https://community.graylog.org/t/nginx-input-is-not-getting-started/1881/7 "2017-07-31T12:53:56Z")

</div>

This is what I imported Content Pack from marketplace and that automatically have created the Inputs. I am sorry; am I missing anything? since I am complete novice would you please elaborate the information you need for? I really need to work hard on graylog and have started on this…

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [July 31, 2017, 1:18pm UTC](https://community.graylog.org/t/nginx-input-is-not-getting-started/1881/8 "2017-07-31T13:18:07Z")

</div>

You didn’t tell us _which content pack_ you’ve downloaded and imported.  
Also, you didn’t tell us what inputs there are in your Graylog setup and what’s their configuration.

---

<div class="post-metadata">

**Author:** ![blason](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blason/32/2930_2.png) [@blason](https://community.graylog.org/u/blason)\
**Post date:** [July 31, 2017, 1:20pm UTC](https://community.graylog.org/t/nginx-input-is-not-getting-started/1881/9 "2017-07-31T13:20:18Z")

</div>

Oh I downloaded [https://marketplace.graylog.org/addons/572ff823-62cc-468e-af17-300bcfd9932d](https://marketplace.graylog.org/addons/572ff823-62cc-468e-af17-300bcfd9932d) and there is other custom made Content Pack which is here…[https://sourceforge.net/projects/cleandns/files/stuff/CleanDNS%20-%20GrayLog%20Content%20Pack/](https://sourceforge.net/projects/cleandns/files/stuff/CleanDNS%20-%20GrayLog%20Content%20Pack/)

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [July 31, 2017, 1:29pm UTC](https://community.graylog.org/t/nginx-input-is-not-getting-started/1881/10 "2017-07-31T13:29:41Z")

</div>

Why is it so hard to answer the questions about your inputs?

---

<div class="post-metadata">

**Author:** ![blason](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blason/32/2930_2.png) [@blason](https://community.graylog.org/u/blason)\
**Post date:** [July 31, 2017, 1:32pm UTC](https://community.graylog.org/t/nginx-input-is-not-getting-started/1881/11 "2017-07-31T13:32:26Z")

</div>

I am sorry I am not getting what exact information you need? How can I give you the data you have requested or if you can pls guide me exactly what information is needed I’ll be able to provide the same. I am sorry again if I am bothering you a lot.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [July 31, 2017, 1:45pm UTC](https://community.graylog.org/t/nginx-input-is-not-getting-started/1881/12 "2017-07-31T13:45:03Z")

</div>

All inputs are listed on the _System_ / _Inputs_ page in the Graylog web interface.

---

<div class="post-metadata">

**Author:** ![blason](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blason/32/2930_2.png) [@blason](https://community.graylog.org/u/blason)\
**Post date:** [July 31, 2017, 1:51pm UTC](https://community.graylog.org/t/nginx-input-is-not-getting-started/1881/13 "2017-07-31T13:51:46Z")

</div>

Ok so you need snapshots of those?

CleanDNS\_INPUT Syslog UDP 1 RUNNING  
allow\_override\_date: true  
bind\_address: 0.0.0.0  
expand\_structured\_data: false  
force\_rdns: false  
override\_source:   
port: 5353  
recv\_buffer\_size: 262144  
store\_full\_message: true

##############

nginx access\_log Syslog UDP FAILED  
allow\_override\_date: true  
bind\_address: 0.0.0.0  
override\_source:   
port: 12301  
recv\_buffer\_size: 1048576

######################

nginx error\_log Syslog UDP FAILED  
allow\_override\_date: true  
bind\_address: 0.0.0.0  
override\_source:   
port: 12302  
recv\_buffer\_size: 1048576

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 14, 2017, 1:52pm UTC](https://community.graylog.org/t/nginx-input-is-not-getting-started/1881/14 "2017-08-14T13:52:01Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
