Same inputs set in more enviroments

Hi all
I need a suggestion about the requirement to create the same inputs set in different enviroments.
Did you use content pack or exist something different that can be used?

Using content pack installation on Graylog startup I often have

Input address already in use

error. So I have to restart Graylog more then one time.
Here and here my issues opened on graylog repository abount content pack problems.

So I’d like to know if somebody has my same problem and how did he fixed it (or if exist a workaround)

P.S
The problem is present even as if I use graylog gui to import contentpack, as if I try to use rest api.

Thanks
Gianluca

I guess the content pack you used contained one input, which was created in your instance. This input is bound to a specific port and protocol (TCP/UDP). This port and protocol (TCP/UDP) can only be used by that input and not by others.
If you are trying to use the same port and protocol (TCP/UDP) with another input it will fail and there will be an error-message.
Please have a look in System → Inputs how many Inputs are there and running, and if stopped inputs use the same port as the started ones.

1 Like

Hi @ihe
thanks for your answer.
My content pack contains more then one input. Each input is configured to use different port number.

I create it from an internal deployment where I configured all input manually (that works fine).
Then I create a content pack that I want to use in another enviroment.
The port number are all different.

In fact, sometimes if I restart graylog, the input starts without error-message.
So it seems to be a graylog internal problem

more than one input should not be a problem at all, just more than one input on one port. Did you search for Inputs with the same port in the menu under System/Inpts? I am quite sure there will be at least two with the same port:. On will be active, and the other ones will be switched off.

This is the situation before contant pack install, using the command ss-tulpn

Than I install the content pack but an input failed to start

no other input with the same port

using the command ss-tulpn we see the port used

And I a restart Graylog wothout change any port number sometimes (2 or 3 times) it start correctly.

Hello,
From the logs it states " failed , Address already in use". I would double check those inputs that are being imported.
If these are multi inputs on a content pack, have you tried just importing one input, just a thought.

EDIT: Oh wow @gianluca-valentini I just read you post on GIT, that is odd for sure. I do have a question after looking over this,

  1. Are you still using OVA? if so, are you transferring to another OVA instance?
  2. These two Graylog instance the same version?
  3. Do you have any Extractors (Parameters list) connected to these INPUT’s?

Hi @gsmith

  1. I’m using Graylog 4.1.6+8a875ab, codename Noir, coming from the Doker image
  2. Yes, I’m usign enviroments with the same version
  3. Yes, I have as static fields as Extractor

But all inputs have static fields, and not all input with extractors give me the port error

Hello,
sorry for the late reply I was at Graylog GO. From what you posted the only thing I can think off is the port.
Yeah, something doesn’t seam right. I did an export/import on VM but unfortunately I did not have any problems, perhaps it was the way I configured my inputs. I don’t use default ports. Maybe try GitHub port there.

Hi @gsmith
I don’t understand your suggestion. I don’t use always default port. In my scenario I have more then one input with different ports. The problem is that if I restart (one, two times) then Graylog accept the ports.

I think that graylog mange the input ports in a wrong way when the comes from content pack.
But I’d like to know, how do you address my scenario? If you need to install in different enviroments the same set of input, do you use always Graylog console or use a content pack file?

Thanks

Hello,

It depends, if I have 5 + inputs I need to duplicate and let’s say 20 different DMZ’s then yeah, I would use a content pack.

Ok and did you ever have the problem that i described before?
Problems with ports, I mean

Short answer is No. When I used content pack there were no prior INPUT/s created, only time I did have an issue was trying to create a input with the same ports but those were defaults , hence why I use custom ports now.

Thanks
I tested the content pack using ports like 50000, 50001 etc. But randomically some inputs starts correclty but other does not start for the port already in use.
So I think that the problem is not the default input port

1 Like

Hi @gsmith
maybe the global configuration setting could be a problem for input creation?

Hello,

TBH , I’m not sure. This situation is kinda odd, plus I haven’t had issues like that. Not sure its the way I setup my VM’s or configuration.