Syslog UDP FAILED

Graylog Central (peer support)
1

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:

syslog UDP starting failed

2. Describe your environment:

  • OS Information:
    centos stream 8, rsyslog, mongdb5.0, , opensearch2.3
  • Package Version:
    graylog5.0
  • Service logs, configurations, and environment variables:

Caused by: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:38:50.226+08:00 WARN [UdpTransport] Failed to start channel for input SyslogUDPInput{title=WLC5520, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=47f49daf-2ce0-43f0-bcc4-2570c412bd52}
io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:38:50.227+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STARTING
2023-08-22T15:38:50.230+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now FAILED
2023-08-22T15:38:50.232+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now TERMINATED
2023-08-22T15:38:50.483+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPING
2023-08-22T15:38:50.484+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now TERMINATED
2023-08-22T15:38:50.485+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STARTING
2023-08-22T15:38:50.486+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPED
2023-08-22T15:38:50.487+08:00 WARN [UdpTransport] Failed to start channel for input SyslogUDPInput{title=WLC5520, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=47f49daf-2ce0-43f0-bcc4-2570c412bd52}
io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:38:50.488+08:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.udp.SyslogUDPInput] input with ID <64e4620f42d244578076d263> misfired. Reason: bind(…) failed: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:161) ~[graylog.jar:?]
at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:91) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?]
at java.util.concurrent.FutureTask.run(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
at java.lang.Thread.run(Unknown Source) [?:?]
Caused by: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.inputs.transports.UdpTransport.launch(UdpTransport.java:136) ~[graylog.jar:?]
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
… 7 more
Caused by: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:38:50.492+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now FAILED
2023-08-22T15:38:50.689+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPING
2023-08-22T15:38:50.690+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now TERMINATED
2023-08-22T15:38:50.693+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STARTING
2023-08-22T15:38:50.693+08:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.udp.SyslogUDPInput] input with ID <64e4620f42d244578076d263> misfired. Reason: bind(…) failed: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:161) ~[graylog.jar:?]
at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:91) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?]
at java.util.concurrent.FutureTask.run(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
at java.lang.Thread.run(Unknown Source) [?:?]
Caused by: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.inputs.transports.UdpTransport.launch(UdpTransport.java:136) ~[graylog.jar:?]
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
… 7 more
Caused by: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:38:50.692+08:00 WARN [UdpTransport] Failed to start channel for input SyslogUDPInput{title=WLC5520, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=47f49daf-2ce0-43f0-bcc4-2570c412bd52}
io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:38:50.695+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now FAILED
2023-08-22T15:38:50.696+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPED
2023-08-22T15:38:50.928+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPING
2023-08-22T15:38:50.932+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPED
2023-08-22T15:38:50.935+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STARTING
2023-08-22T15:38:50.935+08:00 WARN [UdpTransport] Failed to start channel for input SyslogUDPInput{title=WLC5520, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=47f49daf-2ce0-43f0-bcc4-2570c412bd52}
io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:38:50.935+08:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.udp.SyslogUDPInput] input with ID <64e4620f42d244578076d263> misfired. Reason: bind(…) failed: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:161) ~[graylog.jar:?]
at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:91) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?]
at java.util.concurrent.FutureTask.run(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
at java.lang.Thread.run(Unknown Source) [?:?]
Caused by: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.inputs.transports.UdpTransport.launch(UdpTransport.java:136) ~[graylog.jar:?]
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
… 7 more
Caused by: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:38:50.936+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now TERMINATED
2023-08-22T15:38:50.938+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now FAILED
2023-08-22T15:48:47.997+08:00 INFO [connection] Opened connection [connectionId{localValue:19, serverValue:15}] to localhost:27017
2023-08-22T15:48:47.999+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPING
2023-08-22T15:48:48.013+08:00 WARN [UdpTransport] Failed to start channel for input SyslogUDPInput{title=WLC5520, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=47f49daf-2ce0-43f0-bcc4-2570c412bd52}
io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:48:48.014+08:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.udp.SyslogUDPInput] input with ID <64e4620f42d244578076d263> misfired. Reason: bind(…) failed: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:161) ~[graylog.jar:?]
at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:91) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?]
at java.util.concurrent.FutureTask.run(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
at java.lang.Thread.run(Unknown Source) [?:?]
Caused by: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.inputs.transports.UdpTransport.launch(UdpTransport.java:136) ~[graylog.jar:?]
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
… 7 more
Caused by: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:48:48.015+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now TERMINATED
2023-08-22T15:48:48.026+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STARTING
2023-08-22T15:48:48.027+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now FAILED
2023-08-22T15:48:48.029+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPED
2023-08-22T15:49:45.268+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPING
2023-08-22T15:49:45.269+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now TERMINATED
2023-08-22T15:49:45.270+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STARTING
2023-08-22T15:49:45.271+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPED
2023-08-22T15:49:45.272+08:00 WARN [UdpTransport] Failed to start channel for input SyslogUDPInput{title=WLC5520, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=47f49daf-2ce0-43f0-bcc4-2570c412bd52}
io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:49:45.272+08:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.udp.SyslogUDPInput] input with ID <64e4620f42d244578076d263> misfired. Reason: bind(…) failed: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:161) ~[graylog.jar:?]
at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:91) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?]
at java.util.concurrent.FutureTask.run(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
at java.lang.Thread.run(Unknown Source) [?:?]
Caused by: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.inputs.transports.UdpTransport.launch(UdpTransport.java:136) ~[graylog.jar:?]
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
… 7 more
Caused by: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:49:45.273+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now FAILED

3. What steps have you already taken to try and solve the problem?

4. How can the community help?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

2

bind address:0.0.0.0
port 1514
encoding utf-9

3

The port is already in use. You can either terminate whatever process is holding that port; or assign a different port to your UDP input.

4

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:27017 0.0.0.0:* LISTEN 1425/mongod
tcp 0 0 0.0.0.0:1514 0.0.0.0:* LISTEN 1422/rsyslogd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1076/sshd
tcp6 0 0 10.210.82.20:9000 :::* LISTEN 1433/java
tcp6 0 0 :::1514 :::* LISTEN 1422/rsyslogd
tcp6 0 0 :::9200 :::* LISTEN 929/java
tcp6 0 0 :::9300 :::* LISTEN 929/java
tcp6 0 0 :::22 :::* LISTEN 1076/sshd
udp 0 0 0.0.0.0:1514 0.0.0.0:* 1422/rsyslogd
udp 0 0 0.0.0.0:46905 0.0.0.0:* 1422/rsyslogd
udp 0 0 0.0.0.0:53079 0.0.0.0:* 1422/rsyslogd
udp6 0 0 :::1514 :::* 1422/rsyslogd
raw6 0 0 :::58 :::* 7 1035/NetworkManager

5

is the rsyslog using 1514?

6

Ya, rsyslog is already using it, so you will need to use another port for the graylog input.

7

2023-08-23 113257
2023-08-23 1132571284×630 84 KB

i change rsyslog port, the syslog udp is running…also i configed log server on WLC, but i didn’t see any log on graylog server, how to check the issue.

8

the rsyslog is using port 514

9

i use tcpdump tool to capture some wlc data, they are log data, but no shown on graylog.

10

2023-08-23T15:06:13.987+08:00 INFO [cluster] Cluster description not yet available. Waiting for 30000 ms before timing out
2023-08-23T15:06:13.996+08:00 INFO [connection] Opened connection [connectionId{localValue:2, serverValue:2}] to localhost:27017
2023-08-23T15:06:13.999+08:00 INFO [connection] Opened connection [connectionId{localValue:1, serverValue:1}] to localhost:27017
2023-08-23T15:06:13.999+08:00 INFO [cluster] Monitor thread successfully connected to server with description ServerDescription{address=localhost:27017, type=STANDALONE, state=CONNECTED, ok=true, minWireVersion=0, maxWireVersion=13, maxDocumentSize=16777216, logicalSessionTimeoutMinutes=30, roundTripTimeNanos=62281500}
2023-08-23T15:06:14.084+08:00 INFO [connection] Opened connection [connectionId{localValue:3, serverValue:3}] to localhost:27017
2023-08-23T15:06:14.245+08:00 INFO [MongoDBPreflightCheck] Connected to MongoDB version 5.0.19
2023-08-23T15:06:16.595+08:00 ERROR [VersionProbe] Unable to retrieve version from Elasticsearch node: Failed to connect to /127.0.0.1:9200. - Connection refused.
2023-08-23T15:06:16.597+08:00 INFO [VersionProbe] Elasticsearch is not available. Retry #1
2023-08-23T15:06:21.599+08:00 ERROR [VersionProbe] Unable to retrieve version from Elasticsearch node: Failed to connect to /127.0.0.1:9200. - Connection refused.
2023-08-23T15:06:21.600+08:00 INFO [VersionProbe] Elasticsearch is not available. Retry #2
2023-08-23T15:06:26.601+08:00 ERROR [VersionProbe] Unable to retrieve version from Elasticsearch node: Failed to connect to /127.0.0.1:9200. - Connection refused.
2023-08-23T15:06:26.602+08:00 INFO [VersionProbe] Elasticsearch is not available. Retry #3
2023-08-23T15:06:31.604+08:00 ERROR [VersionProbe] Unable to retrieve version from Elasticsearch node: Failed to connect to /127.0.0.1:9200. - Connection refused.
2023-08-23T15:06:31.604+08:00 INFO [VersionProbe] Elasticsearch is not available. Retry #4
2023-08-23T15:06:36.751+08:00 INFO [SearchDbPreflightCheck] Connected to (Elastic/Open)Search version OpenSearch:2.3.0
2023-08-23T15:06:37.015+08:00 INFO [Version] HV000001: Hibernate Validator null
2023-08-23T15:06:41.416+08:00 INFO [InputBufferImpl] Message journal is enabled.
2023-08-23T15:06:41.454+08:00 INFO [NodeId] Node ID: 47f49daf-2ce0-43f0-bcc4-2570c412bd52
2023-08-23T15:06:41.714+08:00 INFO [LogManager] Loading logs.
2023-08-23T15:06:41.744+08:00 WARN [Log] Found a corrupted index file, /var/lib/graylog-server/journal/messagejournal-0/00000000000000000000.index, deleting and rebuilding index…
2023-08-23T15:06:41.779+08:00 INFO [LogManager] Logs loading complete.
2023-08-23T15:06:41.782+08:00 INFO [LocalKafkaJournal] Initialized Kafka based journal at /var/lib/graylog-server/journal
2023-08-23T15:06:41.804+08:00 INFO [client] MongoClient with metadata {“driver”: {“name”: “mongo-java-driver|legacy”, “version”: “4.7.1”}, “os”: {“type”: “Linux”, “name”: “Linux”, “architecture”: “amd64”, “version”: “4.18.0-500.el8.x86_64”}, “platform”: “Java/Eclipse Adoptium/17.0.8+7”} created with settings MongoClientSettings{readPreference=primary, writeConcern=WriteConcern{w=null, wTimeout=null ms, journal=null}, retryWrites=true, retryReads=true, readConcern=ReadConcern{level=null}, credential=null, streamFactoryFactory=null, commandListeners=, codecRegistry=ProvidersCodecRegistry{codecProviders=[ValueCodecProvider{}, BsonValueCodecProvider{}, DBRefCodecProvider{}, DBObjectCodecProvider{}, DocumentCodecProvider{}, IterableCodecProvider{}, MapCodecProvider{}, GeoJsonCodecProvider{}, GridFSFileCodecProvider{}, Jsr310CodecProvider{}, JsonObjectCodecProvider{}, BsonCodecProvider{}, EnumCodecProvider{}, com.mongodb.Jep395RecordCodecProvider@6629ad09]}, clusterSettings={hosts=[localhost:27017], srvServiceName=mongodb, mode=SINGLE, requiredClusterType=UNKNOWN, requiredReplicaSetName=‘null’, serverSelector=‘null’, clusterListeners=‘’, serverSelectionTimeout=‘30000 ms’, localThreshold=‘30000 ms’}, socketSettings=SocketSettings{connectTimeoutMS=10000, readTimeoutMS=0, receiveBufferSize=0, sendBufferSize=0}, heartbeatSocketSettings=SocketSettings{connectTimeoutMS=10000, readTimeoutMS=10000, receiveBufferSize=0, sendBufferSize=0}, connectionPoolSettings=ConnectionPoolSettings{maxSize=1000, minSize=0, maxWaitTimeMS=120000, maxConnectionLifeTimeMS=0, maxConnectionIdleTimeMS=0, maintenanceInitialDelayMS=0, maintenanceFrequencyMS=60000, connectionPoolListeners=, maxConnecting=2}, serverSettings=ServerSettings{heartbeatFrequencyMS=10000, minHeartbeatFrequencyMS=500, serverListeners=‘’, serverMonitorListeners=‘’}, sslSettings=SslSettings{enabled=false, invalidHostNameAllowed=false, context=null}, applicationName=‘null’, compressorList=, uuidRepresentation=UNSPECIFIED, serverApi=null, autoEncryptionSettings=null, contextProvider=null}
2023-08-23T15:06:41.812+08:00 INFO [connection] Opened connection [connectionId{localValue:4, serverValue:4}] to localhost:27017
2023-08-23T15:06:41.812+08:00 INFO [cluster] Monitor thread successfully connected to server with description ServerDescription{address=localhost:27017, type=STANDALONE, state=CONNECTED, ok=true, minWireVersion=0, maxWireVersion=13, maxDocumentSize=16777216, logicalSessionTimeoutMinutes=30, roundTripTimeNanos=10284100}
2023-08-23T15:06:41.814+08:00 INFO [client] MongoClient with metadata {“driver”: {“name”: “mongo-java-driver|legacy”, “version”: “4.7.1”}, “os”: {“type”: “Linux”, “name”: “Linux”, “architecture”: “amd64”, “version”: “4.18.0-500.el8.x86_64”}, “platform”: “Java/Eclipse Adoptium/17.0.8+7”} created with settings MongoClientSettings{readPreference=primary, writeConcern=WriteConcern{w=null, wTimeout=null ms, journal=null}, retryWrites=true, retryReads=true, readConcern=ReadConcern{level=null}, credential=null, streamFactoryFactory=null, commandListeners=, codecRegistry=ProvidersCodecRegistry{codecProviders=[ValueCodecProvider{}, BsonValueCodecProvider{}, DBRefCodecProvider{}, DBObjectCodecProvider{}, DocumentCodecProvider{}, IterableCodecProvider{}, MapCodecProvider{}, GeoJsonCodecProvider{}, GridFSFileCodecProvider{}, Jsr310CodecProvider{}, JsonObjectCodecProvider{}, BsonCodecProvider{}, EnumCodecProvider{}, com.mongodb.Jep395RecordCodecProvider@6629ad09]}, clusterSettings={hosts=[localhost:27017], srvServiceName=mongodb, mode=SINGLE, requiredClusterType=UNKNOWN, requiredReplicaSetName=‘null’, serverSelector=‘null’, clusterListeners=‘’, serverSelectionTimeout=‘30000 ms’, localThreshold=‘30000 ms’}, socketSettings=SocketSettings{connectTimeoutMS=10000, readTimeoutMS=0, receiveBufferSize=0, sendBufferSize=0}, heartbeatSocketSettings=SocketSettings{connectTimeoutMS=10000, readTimeoutMS=10000, receiveBufferSize=0, sendBufferSize=0}, connectionPoolSettings=ConnectionPoolSettings{maxSize=1000, minSize=0, maxWaitTimeMS=120000, maxConnectionLifeTimeMS=0, maxConnectionIdleTimeMS=0, maintenanceInitialDelayMS=0, maintenanceFrequencyMS=60000, connectionPoolListeners=, maxConnecting=2}, serverSettings=ServerSettings{heartbeatFrequencyMS=10000, minHeartbeatFrequencyMS=500, serverListeners=‘’, serverMonitorListeners=‘’}, sslSettings=SslSettings{enabled=false, invalidHostNameAllowed=false, context=null}, applicationName=‘null’, compressorList=, uuidRepresentation=UNSPECIFIED, serverApi=null, autoEncryptionSettings=null, contextProvider=null}
2023-08-23T15:06:41.815+08:00 INFO [cluster] Cluster description not yet available. Waiting for 30000 ms before timing out
2023-08-23T15:06:41.819+08:00 INFO [connection] Opened connection [connectionId{localValue:5, serverValue:5}] to localhost:27017
2023-08-23T15:06:41.828+08:00 INFO [connection] Opened connection [connectionId{localValue:6, serverValue:6}] to localhost:27017
2023-08-23T15:06:42.136+08:00 INFO [InputBufferImpl] Initialized InputBufferImpl with ring size <65536> and wait strategy , running 2 parallel message handlers.
2023-08-23T15:06:42.687+08:00 INFO [ElasticsearchVersionProvider] Elasticsearch cluster is running OpenSearch:2.3.0
2023-08-23T15:06:43.726+08:00 INFO [ProcessBuffer] Initialized ProcessBuffer with ring size <65536> and wait strategy .
2023-08-23T15:06:43.934+08:00 INFO [connection] Opened connection [connectionId{localValue:7, serverValue:7}] to localhost:27017
2023-08-23T15:06:43.946+08:00 INFO [OutputBuffer] Initialized OutputBuffer with ring size <65536> and wait strategy .
2023-08-23T15:06:44.806+08:00 INFO [ServerBootstrap] Graylog server 5.0.10+40c8c33 starting up
2023-08-23T15:06:44.807+08:00 INFO [ServerBootstrap] JRE: Eclipse Adoptium 17.0.8 on Linux 4.18.0-500.el8.x86_64
2023-08-23T15:06:44.807+08:00 INFO [ServerBootstrap] Deployment: rpm
2023-08-23T15:06:44.807+08:00 INFO [ServerBootstrap] OS: CentOS Stream 8 (centos)
2023-08-23T15:06:44.808+08:00 INFO [ServerBootstrap] Arch: amd64
2023-08-23T15:06:44.993+08:00 INFO [ServerBootstrap] Running 49 migrations…
2023-08-23T15:06:45.919+08:00 INFO [PeriodicalsService] Starting 26 periodicals …
2023-08-23T15:06:45.920+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.ThroughputCalculator] periodical in [0s], polling every [1s].
2023-08-23T15:06:46.004+08:00 INFO [Periodicals] Starting [org.graylog.plugins.pipelineprocessor.periodical.LegacyDefaultStreamMigration] periodical, running forever.
2023-08-23T15:06:46.291+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.BatchedElasticSearchOutputFlushThread] periodical in [0s], polling every [1s].
2023-08-23T15:06:46.305+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.ClusterHealthCheckThread] periodical in [120s], polling every [20s].
2023-08-23T15:06:46.315+08:00 INFO [LegacyDefaultStreamMigration] Legacy default stream has no connections, no migration needed.
2023-08-23T15:06:46.333+08:00 INFO [PeriodicalsService] Not starting [org.graylog2.periodical.ContentPackLoaderPeriodical] periodical. Not configured to run on this node.
2023-08-23T15:06:46.333+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.GarbageCollectionWarningThread] periodical, running forever.
2023-08-23T15:06:46.366+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.IndexerClusterCheckerThread] periodical in [0s], polling every [30s].
2023-08-23T15:06:46.418+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.IndexBlockCheck] periodical in [0s], polling every [30s].
2023-08-23T15:06:46.434+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.IndexRetentionThread] periodical in [0s], polling every [300s].
2023-08-23T15:06:46.494+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.IndexRotationThread] periodical in [0s], polling every [10s].
2023-08-23T15:06:46.510+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.NodePingThread] periodical in [0s], polling every [1s].
2023-08-23T15:06:46.526+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.VersionCheckThread] periodical in [300s], polling every [1800s].
2023-08-23T15:06:46.541+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.ThrottleStateUpdaterThread] periodical in [1s], polling every [1s].
2023-08-23T15:06:46.551+08:00 INFO [Periodicals] Starting [org.graylog2.events.ClusterEventPeriodical] periodical in [0s], polling every [1s].
2023-08-23T15:06:46.582+08:00 INFO [Periodicals] Starting [org.graylog2.events.ClusterEventCleanupPeriodical] periodical in [0s], polling every [86400s].
2023-08-23T15:06:46.602+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.IndexRangesCleanupPeriodical] periodical in [15s], polling every [3600s].
2023-08-23T15:06:46.716+08:00 INFO [connection] Opened connection [connectionId{localValue:8, serverValue:8}] to localhost:27017
2023-08-23T15:06:46.721+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.TrafficCounterCalculator] periodical in [0s], polling every [1s].
2023-08-23T15:06:46.731+08:00 INFO [Periodicals] Starting [org.graylog2.indexer.fieldtypes.IndexFieldTypePollerPeriodical] periodical in [0s], polling every [1s].
2023-08-23T15:06:46.740+08:00 INFO [Periodicals] Starting [org.graylog.scheduler.periodicals.ScheduleTriggerCleanUp] periodical in [120s], polling every [86400s].
2023-08-23T15:06:46.741+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.ESVersionCheckPeriodical] periodical in [0s], polling every [30s].
2023-08-23T15:06:46.855+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.UserSessionTerminationPeriodical] periodical, running forever.
2023-08-23T15:06:46.882+08:00 INFO [Periodicals] Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredSidecarsThread] periodical in [0s], polling every [600s].
2023-08-23T15:06:46.885+08:00 INFO [Periodicals] Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredConfigurationUploads] periodical in [0s], polling every [600s].
2023-08-23T15:06:46.887+08:00 INFO [Periodicals] Starting [org.graylog.plugins.views.search.db.SearchesCleanUpJob] periodical in [3600s], polling every [28800s].
2023-08-23T15:06:46.911+08:00 INFO [Periodicals] Starting [org.graylog.events.periodicals.EventNotificationStatusCleanUp] periodical in [120s], polling every [86400s].
2023-08-23T15:06:46.911+08:00 INFO [Periodicals] Starting [org.graylog.plugins.collector.periodical.PurgeExpiredCollectorsThread] periodical in [0s], polling every [3600s].
2023-08-23T15:06:49.439+08:00 INFO [NetworkListener] Started listener bound to [10.210.82.20:9000]
2023-08-23T15:06:49.441+08:00 INFO [HttpServer] [HttpServer] Started.
2023-08-23T15:06:49.441+08:00 INFO [JerseyService] Started REST API at <10.210.82.20:9000>
2023-08-23T15:06:49.442+08:00 INFO [ServiceManagerListener] Services are healthy
2023-08-23T15:06:49.443+08:00 INFO [ServerBootstrap] Services started, startup times in ms: {UserSessionTerminationService [RUNNING]=0, InputSetupService [RUNNING]=1, FailureHandlingService [RUNNING]=1, UrlWhitelistService [RUNNING]=4, GracefulShutdownService [RUNNING]=11, ConfigurationEtagService [RUNNING]=12, LocalKafkaMessageQueueWriter [RUNNING]=12, PrometheusExporter [RUNNING]=13, BufferSynchronizerService [RUNNING]=15, OutputSetupService [RUNNING]=20, EtagService [RUNNING]=34, GeoIpDbFileChangeMonitorService [RUNNING]=42, StreamCacheService [RUNNING]=57, LocalKafkaMessageQueueReader [RUNNING]=71, JobSchedulerService [RUNNING]=105, LookupTableService [RUNNING]=223, MongoDBProcessingStatusRecorderService [RUNNING]=237, LocalKafkaJournal [RUNNING]=246, PeriodicalsService [RUNNING]=996, JerseyService [RUNNING]=3522}
2023-08-23T15:06:49.451+08:00 INFO [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Running [LB:ALIVE]
2023-08-23T15:06:49.470+08:00 INFO [InputLauncher] Launching input [Syslog UDP/wlc/64e5a0ad0e59cc43db861efc] - desired state is RUNNING
2023-08-23T15:06:49.523+08:00 INFO [ServerBootstrap] Graylog server up and running.
2023-08-23T15:06:49.525+08:00 INFO [InputStateListener] Input [Syslog UDP/64e5a0ad0e59cc43db861efc] is now STARTING
2023-08-23T15:06:49.654+08:00 INFO [InputStateListener] Input [Syslog UDP/64e5a0ad0e59cc43db861efc] is now RUNNING
2023-08-23T15:07:37.339+08:00 INFO [connection] Opened connection [connectionId{localValue:9, serverValue:9}] to localhost:27017
2023-08-23T15:07:38.339+08:00 INFO [connection] Opened connection [connectionId{localValue:10, serverValue:10}] to localhost:27017
2023-08-23T15:07:38.349+08:00 INFO [connection] Opened connection [connectionId{localValue:11, serverValue:11}] to localhost:27017
2023-08-23T15:07:38.389+08:00 INFO [connection] Opened connection [connectionId{localValue:12, serverValue:12}] to localhost:27017
2023-08-23T15:10:12.896+08:00 INFO [InputStateListener] Input [Syslog UDP/64e5a0ad0e59cc43db861efc] is now STOPPING
2023-08-23T15:10:12.904+08:00 INFO [InputStateListener] Input [Syslog UDP/64e5a0ad0e59cc43db861efc] is now TERMINATED
2023-08-23T15:10:12.906+08:00 INFO [InputStateListener] Input [Syslog UDP/64e5a0ad0e59cc43db861efc] is now STOPPED
2023-08-23T15:10:14.673+08:00 INFO [connection] Opened connection [connectionId{localValue:13, serverValue:14}] to localhost:27017
2023-08-23T15:10:14.677+08:00 INFO [connection] Opened connection [connectionId{localValue:14, serverValue:13}] to localhost:27017
2023-08-23T15:10:14.682+08:00 INFO [InputStateListener] Input [Syslog UDP/64e5a0ad0e59cc43db861efc] is now STARTING
2023-08-23T15:10:14.697+08:00 INFO [InputStateListener] Input [Syslog UDP/64e5a0ad0e59cc43db861efc] is now RUNNING
[root@ISCN-LogServer graylog-server]#

11

屏幕截图 2023-08-23 154907
屏幕截图 2023-08-23 1549071293×242 69.2 KB

12

Is that red error message still valid, it says it was reiggered the day before. Delete that error with the x restart graylog and see if that error comes back or not.

You could also try and run this on some random port like 1964 and see if it binds to that address and starts and recieves data, maybe the 1514 port is somehow still stuck to something else.

13

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.