Hi all
I need a suggestion about the requirement to create the same inputs set in different enviroments.
Did you use content pack or exist something different that can be used?
Using content pack installation on Graylog startup I often have
Input address already in use
error. So I have to restart Graylog more then one time. Here and here my issues opened on graylog repository abount content pack problems.
So I’d like to know if somebody has my same problem and how did he fixed it (or if exist a workaround)
P.S
The problem is present even as if I use graylog gui to import contentpack, as if I try to use rest api.
I guess the content pack you used contained one input, which was created in your instance. This input is bound to a specific port and protocol (TCP/UDP). This port and protocol (TCP/UDP) can only be used by that input and not by others.
If you are trying to use the same port and protocol (TCP/UDP) with another input it will fail and there will be an error-message.
Please have a look in System → Inputs how many Inputs are there and running, and if stopped inputs use the same port as the started ones.
Hi @ihe
thanks for your answer.
My content pack contains more then one input. Each input is configured to use different port number.
I create it from an internal deployment where I configured all input manually (that works fine).
Then I create a content pack that I want to use in another enviroment.
The port number are all different.
In fact, sometimes if I restart graylog, the input starts without error-message.
So it seems to be a graylog internal problem
more than one input should not be a problem at all, just more than one input on one port. Did you search for Inputs with the same port in the menu under System/Inpts? I am quite sure there will be at least two with the same port:. On will be active, and the other ones will be switched off.
Hello,
From the logs it states " failed , Address already in use". I would double check those inputs that are being imported.
If these are multi inputs on a content pack, have you tried just importing one input, just a thought.
EDIT: Oh wow @gianluca-valentini I just read you post on GIT, that is odd for sure. I do have a question after looking over this,
Are you still using OVA? if so, are you transferring to another OVA instance?
These two Graylog instance the same version?
Do you have any Extractors (Parameters list) connected to these INPUT’s?
Hello,
sorry for the late reply I was at Graylog GO. From what you posted the only thing I can think off is the port.
Yeah, something doesn’t seam right. I did an export/import on VM but unfortunately I did not have any problems, perhaps it was the way I configured my inputs. I don’t use default ports. Maybe try GitHub port there.
Hi @gsmith
I don’t understand your suggestion. I don’t use always default port. In my scenario I have more then one input with different ports. The problem is that if I restart (one, two times) then Graylog accept the ports.
I think that graylog mange the input ports in a wrong way when the comes from content pack.
But I’d like to know, how do you address my scenario? If you need to install in different enviroments the same set of input, do you use always Graylog console or use a content pack file?
Short answer is No. When I used content pack there were no prior INPUT/s created, only time I did have an issue was trying to create a input with the same ports but those were defaults , hence why I use custom ports now.
Thanks
I tested the content pack using ports like 50000, 50001 etc. But randomically some inputs starts correclty but other does not start for the port already in use.
So I think that the problem is not the default input port
