Syslog UDP FAILED

qumj_mail_Graylog1 · August 22, 2023, 8:05am

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:

syslog UDP starting failed

2. Describe your environment:

OS Information:
centos stream 8, rsyslog, mongdb5.0, , opensearch2.3
Package Version:
graylog5.0
Service logs, configurations, and environment variables:

Caused by: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:38:50.226+08:00 WARN [UdpTransport] Failed to start channel for input SyslogUDPInput{title=WLC5520, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=47f49daf-2ce0-43f0-bcc4-2570c412bd52}
io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:38:50.227+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STARTING
2023-08-22T15:38:50.230+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now FAILED
2023-08-22T15:38:50.232+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now TERMINATED
2023-08-22T15:38:50.483+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPING
2023-08-22T15:38:50.484+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now TERMINATED
2023-08-22T15:38:50.485+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STARTING
2023-08-22T15:38:50.486+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPED
2023-08-22T15:38:50.487+08:00 WARN [UdpTransport] Failed to start channel for input SyslogUDPInput{title=WLC5520, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=47f49daf-2ce0-43f0-bcc4-2570c412bd52}
io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:38:50.488+08:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.udp.SyslogUDPInput] input with ID <64e4620f42d244578076d263> misfired. Reason: bind(…) failed: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:161) ~[graylog.jar:?]
at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:91) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?]
at java.util.concurrent.FutureTask.run(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
at java.lang.Thread.run(Unknown Source) [?:?]
Caused by: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.inputs.transports.UdpTransport.launch(UdpTransport.java:136) ~[graylog.jar:?]
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
… 7 more
Caused by: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:38:50.492+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now FAILED
2023-08-22T15:38:50.689+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPING
2023-08-22T15:38:50.690+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now TERMINATED
2023-08-22T15:38:50.693+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STARTING
2023-08-22T15:38:50.693+08:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.udp.SyslogUDPInput] input with ID <64e4620f42d244578076d263> misfired. Reason: bind(…) failed: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:161) ~[graylog.jar:?]
at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:91) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?]
at java.util.concurrent.FutureTask.run(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
at java.lang.Thread.run(Unknown Source) [?:?]
Caused by: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.inputs.transports.UdpTransport.launch(UdpTransport.java:136) ~[graylog.jar:?]
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
… 7 more
Caused by: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:38:50.692+08:00 WARN [UdpTransport] Failed to start channel for input SyslogUDPInput{title=WLC5520, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=47f49daf-2ce0-43f0-bcc4-2570c412bd52}
io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:38:50.695+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now FAILED
2023-08-22T15:38:50.696+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPED
2023-08-22T15:38:50.928+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPING
2023-08-22T15:38:50.932+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPED
2023-08-22T15:38:50.935+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STARTING
2023-08-22T15:38:50.935+08:00 WARN [UdpTransport] Failed to start channel for input SyslogUDPInput{title=WLC5520, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=47f49daf-2ce0-43f0-bcc4-2570c412bd52}
io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:38:50.935+08:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.udp.SyslogUDPInput] input with ID <64e4620f42d244578076d263> misfired. Reason: bind(…) failed: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:161) ~[graylog.jar:?]
at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:91) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?]
at java.util.concurrent.FutureTask.run(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
at java.lang.Thread.run(Unknown Source) [?:?]
Caused by: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.inputs.transports.UdpTransport.launch(UdpTransport.java:136) ~[graylog.jar:?]
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
… 7 more
Caused by: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:38:50.936+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now TERMINATED
2023-08-22T15:38:50.938+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now FAILED
2023-08-22T15:48:47.997+08:00 INFO [connection] Opened connection [connectionId{localValue:19, serverValue:15}] to localhost:27017
2023-08-22T15:48:47.999+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPING
2023-08-22T15:48:48.013+08:00 WARN [UdpTransport] Failed to start channel for input SyslogUDPInput{title=WLC5520, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=47f49daf-2ce0-43f0-bcc4-2570c412bd52}
io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:48:48.014+08:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.udp.SyslogUDPInput] input with ID <64e4620f42d244578076d263> misfired. Reason: bind(…) failed: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:161) ~[graylog.jar:?]
at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:91) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?]
at java.util.concurrent.FutureTask.run(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
at java.lang.Thread.run(Unknown Source) [?:?]
Caused by: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.inputs.transports.UdpTransport.launch(UdpTransport.java:136) ~[graylog.jar:?]
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
… 7 more
Caused by: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:48:48.015+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now TERMINATED
2023-08-22T15:48:48.026+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STARTING
2023-08-22T15:48:48.027+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now FAILED
2023-08-22T15:48:48.029+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPED
2023-08-22T15:49:45.268+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPING
2023-08-22T15:49:45.269+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now TERMINATED
2023-08-22T15:49:45.270+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STARTING
2023-08-22T15:49:45.271+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now STOPPED
2023-08-22T15:49:45.272+08:00 WARN [UdpTransport] Failed to start channel for input SyslogUDPInput{title=WLC5520, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=47f49daf-2ce0-43f0-bcc4-2570c412bd52}
io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:49:45.272+08:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.udp.SyslogUDPInput] input with ID <64e4620f42d244578076d263> misfired. Reason: bind(…) failed: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:161) ~[graylog.jar:?]
at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:91) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?]
at java.util.concurrent.FutureTask.run(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
at java.lang.Thread.run(Unknown Source) [?:?]
Caused by: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.inputs.transports.UdpTransport.launch(UdpTransport.java:136) ~[graylog.jar:?]
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
… 7 more
Caused by: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2023-08-22T15:49:45.273+08:00 INFO [InputStateListener] Input [Syslog UDP/64e4620f42d244578076d263] is now FAILED

3. What steps have you already taken to try and solve the problem?

4. How can the community help?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

qumj_mail_Graylog1 · August 22, 2023, 8:18am

bind address:0.0.0.0
port 1514
encoding utf-9

patrickmann · August 22, 2023, 8:25am

The port is already in use. You can either terminate whatever process is holding that port; or assign a different port to your UDP input.

qumj_mail_Graylog1 · August 22, 2023, 8:36am

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:27017 0.0.0.0:* LISTEN 1425/mongod
tcp 0 0 0.0.0.0:1514 0.0.0.0:* LISTEN 1422/rsyslogd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1076/sshd
tcp6 0 0 10.210.82.20:9000 :::* LISTEN 1433/java
tcp6 0 0 :::1514 :::* LISTEN 1422/rsyslogd
tcp6 0 0 :::9200 :::* LISTEN 929/java
tcp6 0 0 :::9300 :::* LISTEN 929/java
tcp6 0 0 :::22 :::* LISTEN 1076/sshd
udp 0 0 0.0.0.0:1514 0.0.0.0:* 1422/rsyslogd
udp 0 0 0.0.0.0:46905 0.0.0.0:* 1422/rsyslogd
udp 0 0 0.0.0.0:53079 0.0.0.0:* 1422/rsyslogd
udp6 0 0 :::1514 :::* 1422/rsyslogd
raw6 0 0 :::58 :::* 7 1035/NetworkManager

qumj_mail_Graylog1 · August 22, 2023, 8:36am

is the rsyslog using 1514?

Joel_Duffield · August 22, 2023, 11:09am

Ya, rsyslog is already using it, so you will need to use another port for the graylog input.

qumj_mail_Graylog1 · August 23, 2023, 3:40am

i change rsyslog port, the syslog udp is running…also i configed log server on WLC, but i didn’t see any log on graylog server, how to check the issue.

qumj_mail_Graylog1 · August 23, 2023, 3:42am

the rsyslog is using port 514

qumj_mail_Graylog1 · August 23, 2023, 5:21am

i use tcpdump tool to capture some wlc data, they are log data, but no shown on graylog.

qumj_mail_Graylog1 · August 23, 2023, 7:14am

2023-08-23T15:06:13.987+08:00 INFO [cluster] Cluster description not yet available. Waiting for 30000 ms before timing out
2023-08-23T15:06:13.996+08:00 INFO [connection] Opened connection [connectionId{localValue:2, serverValue:2}] to localhost:27017
2023-08-23T15:06:13.999+08:00 INFO [connection] Opened connection [connectionId{localValue:1, serverValue:1}] to localhost:27017
2023-08-23T15:06:13.999+08:00 INFO [cluster] Monitor thread successfully connected to server with description ServerDescription{address=localhost:27017, type=STANDALONE, state=CONNECTED, ok=true, minWireVersion=0, maxWireVersion=13, maxDocumentSize=16777216, logicalSessionTimeoutMinutes=30, roundTripTimeNanos=62281500}
2023-08-23T15:06:14.084+08:00 INFO [connection] Opened connection [connectionId{localValue:3, serverValue:3}] to localhost:27017
2023-08-23T15:06:14.245+08:00 INFO [MongoDBPreflightCheck] Connected to MongoDB version 5.0.19
2023-08-23T15:06:16.595+08:00 ERROR [VersionProbe] Unable to retrieve version from Elasticsearch node: Failed to connect to /127.0.0.1:9200. - Connection refused.
2023-08-23T15:06:16.597+08:00 INFO [VersionProbe] Elasticsearch is not available. Retry #1
2023-08-23T15:06:21.599+08:00 ERROR [VersionProbe] Unable to retrieve version from Elasticsearch node: Failed to connect to /127.0.0.1:9200. - Connection refused.
2023-08-23T15:06:21.600+08:00 INFO [VersionProbe] Elasticsearch is not available. Retry #2
2023-08-23T15:06:26.601+08:00 ERROR [VersionProbe] Unable to retrieve version from Elasticsearch node: Failed to connect to /127.0.0.1:9200. - Connection refused.
2023-08-23T15:06:26.602+08:00 INFO [VersionProbe] Elasticsearch is not available. Retry #3
2023-08-23T15:06:31.604+08:00 ERROR [VersionProbe] Unable to retrieve version from Elasticsearch node: Failed to connect to /127.0.0.1:9200. - Connection refused.
2023-08-23T15:06:31.604+08:00 INFO [VersionProbe] Elasticsearch is not available. Retry #4
2023-08-23T15:06:36.751+08:00 INFO [SearchDbPreflightCheck] Connected to (Elastic/Open)Search version OpenSearch:2.3.0
2023-08-23T15:06:37.015+08:00 INFO [Version] HV000001: Hibernate Validator null
2023-08-23T15:06:41.416+08:00 INFO [InputBufferImpl] Message journal is enabled.
2023-08-23T15:06:41.454+08:00 INFO [NodeId] Node ID: 47f49daf-2ce0-43f0-bcc4-2570c412bd52
2023-08-23T15:06:41.714+08:00 INFO [LogManager] Loading logs.
2023-08-23T15:06:41.744+08:00 WARN [Log] Found a corrupted index file, /var/lib/graylog-server/journal/messagejournal-0/00000000000000000000.index, deleting and rebuilding index…
2023-08-23T15:06:41.779+08:00 INFO [LogManager] Logs loading complete.
2023-08-23T15:06:41.782+08:00 INFO [LocalKafkaJournal] Initialized Kafka based journal at /var/lib/graylog-server/journal
2023-08-23T15:06:41.804+08:00 INFO [client] MongoClient with metadata {“driver”: {“name”: “mongo-java-driver|legacy”, “version”: “4.7.1”}, “os”: {“type”: “Linux”, “name”: “Linux”, “architecture”: “amd64”, “version”: “4.18.0-500.el8.x86_64”}, “platform”: “Java/Eclipse Adoptium/17.0.8+7”} created with settings MongoClientSettings{readPreference=primary, writeConcern=WriteConcern{w=null, wTimeout=null ms, journal=null}, retryWrites=true, retryReads=true, readConcern=ReadConcern{level=null}, credential=null, streamFactoryFactory=null, commandListeners=, codecRegistry=ProvidersCodecRegistry{codecProviders=[ValueCodecProvider{}, BsonValueCodecProvider{}, DBRefCodecProvider{}, DBObjectCodecProvider{}, DocumentCodecProvider{}, IterableCodecProvider{}, MapCodecProvider{}, GeoJsonCodecProvider{}, GridFSFileCodecProvider{}, Jsr310CodecProvider{}, JsonObjectCodecProvider{}, BsonCodecProvider{}, EnumCodecProvider{}, com.mongodb.Jep395RecordCodecProvider@6629ad09]}, clusterSettings={hosts=[localhost:27017], srvServiceName=mongodb, mode=SINGLE, requiredClusterType=UNKNOWN, requiredReplicaSetName=‘null’, serverSelector=‘null’, clusterListeners=‘’, serverSelectionTimeout=‘30000 ms’, localThreshold=‘30000 ms’}, socketSettings=SocketSettings{connectTimeoutMS=10000, readTimeoutMS=0, receiveBufferSize=0, sendBufferSize=0}, heartbeatSocketSettings=SocketSettings{connectTimeoutMS=10000, readTimeoutMS=10000, receiveBufferSize=0, sendBufferSize=0}, connectionPoolSettings=ConnectionPoolSettings{maxSize=1000, minSize=0, maxWaitTimeMS=120000, maxConnectionLifeTimeMS=0, maxConnectionIdleTimeMS=0, maintenanceInitialDelayMS=0, maintenanceFrequencyMS=60000, connectionPoolListeners=, maxConnecting=2}, serverSettings=ServerSettings{heartbeatFrequencyMS=10000, minHeartbeatFrequencyMS=500, serverListeners=‘’, serverMonitorListeners=‘’}, sslSettings=SslSettings{enabled=false, invalidHostNameAllowed=false, context=null}, applicationName=‘null’, compressorList=, uuidRepresentation=UNSPECIFIED, serverApi=null, autoEncryptionSettings=null, contextProvider=null}
2023-08-23T15:06:41.812+08:00 INFO [connection] Opened connection [connectionId{localValue:4, serverValue:4}] to localhost:27017
2023-08-23T15:06:41.812+08:00 INFO [cluster] Monitor thread successfully connected to server with description ServerDescription{address=localhost:27017, type=STANDALONE, state=CONNECTED, ok=true, minWireVersion=0, maxWireVersion=13, maxDocumentSize=16777216, logicalSessionTimeoutMinutes=30, roundTripTimeNanos=10284100}
2023-08-23T15:06:41.814+08:00 INFO [client] MongoClient with metadata {“driver”: {“name”: “mongo-java-driver|legacy”, “version”: “4.7.1”}, “os”: {“type”: “Linux”, “name”: “Linux”, “architecture”: “amd64”, “version”: “4.18.0-500.el8.x86_64”}, “platform”: “Java/Eclipse Adoptium/17.0.8+7”} created with settings MongoClientSettings{readPreference=primary, writeConcern=WriteConcern{w=null, wTimeout=null ms, journal=null}, retryWrites=true, retryReads=true, readConcern=ReadConcern{level=null}, credential=null, streamFactoryFactory=null, commandListeners=, codecRegistry=ProvidersCodecRegistry{codecProviders=[ValueCodecProvider{}, BsonValueCodecProvider{}, DBRefCodecProvider{}, DBObjectCodecProvider{}, DocumentCodecProvider{}, IterableCodecProvider{}, MapCodecProvider{}, GeoJsonCodecProvider{}, GridFSFileCodecProvider{}, Jsr310CodecProvider{}, JsonObjectCodecProvider{}, BsonCodecProvider{}, EnumCodecProvider{}, com.mongodb.Jep395RecordCodecProvider@6629ad09]}, clusterSettings={hosts=[localhost:27017], srvServiceName=mongodb, mode=SINGLE, requiredClusterType=UNKNOWN, requiredReplicaSetName=‘null’, serverSelector=‘null’, clusterListeners=‘’, serverSelectionTimeout=‘30000 ms’, localThreshold=‘30000 ms’}, socketSettings=SocketSettings{connectTimeoutMS=10000, readTimeoutMS=0, receiveBufferSize=0, sendBufferSize=0}, heartbeatSocketSettings=SocketSettings{connectTimeoutMS=10000, readTimeoutMS=10000, receiveBufferSize=0, sendBufferSize=0}, connectionPoolSettings=ConnectionPoolSettings{maxSize=1000, minSize=0, maxWaitTimeMS=120000, maxConnectionLifeTimeMS=0, maxConnectionIdleTimeMS=0, maintenanceInitialDelayMS=0, maintenanceFrequencyMS=60000, connectionPoolListeners=, maxConnecting=2}, serverSettings=ServerSettings{heartbeatFrequencyMS=10000, minHeartbeatFrequencyMS=500, serverListeners=‘’, serverMonitorListeners=‘’}, sslSettings=SslSettings{enabled=false, invalidHostNameAllowed=false, context=null}, applicationName=‘null’, compressorList=, uuidRepresentation=UNSPECIFIED, serverApi=null, autoEncryptionSettings=null, contextProvider=null}
2023-08-23T15:06:41.815+08:00 INFO [cluster] Cluster description not yet available. Waiting for 30000 ms before timing out
2023-08-23T15:06:41.819+08:00 INFO [connection] Opened connection [connectionId{localValue:5, serverValue:5}] to localhost:27017
2023-08-23T15:06:41.828+08:00 INFO [connection] Opened connection [connectionId{localValue:6, serverValue:6}] to localhost:27017
2023-08-23T15:06:42.136+08:00 INFO [InputBufferImpl] Initialized InputBufferImpl with ring size <65536> and wait strategy , running 2 parallel message handlers.
2023-08-23T15:06:42.687+08:00 INFO [ElasticsearchVersionProvider] Elasticsearch cluster is running OpenSearch:2.3.0
2023-08-23T15:06:43.726+08:00 INFO [ProcessBuffer] Initialized ProcessBuffer with ring size <65536> and wait strategy .
2023-08-23T15:06:43.934+08:00 INFO [connection] Opened connection [connectionId{localValue:7, serverValue:7}] to localhost:27017
2023-08-23T15:06:43.946+08:00 INFO [OutputBuffer] Initialized OutputBuffer with ring size <65536> and wait strategy .
2023-08-23T15:06:44.806+08:00 INFO [ServerBootstrap] Graylog server 5.0.10+40c8c33 starting up
2023-08-23T15:06:44.807+08:00 INFO [ServerBootstrap] JRE: Eclipse Adoptium 17.0.8 on Linux 4.18.0-500.el8.x86_64
2023-08-23T15:06:44.807+08:00 INFO [ServerBootstrap] Deployment: rpm
2023-08-23T15:06:44.807+08:00 INFO [ServerBootstrap] OS: CentOS Stream 8 (centos)
2023-08-23T15:06:44.808+08:00 INFO [ServerBootstrap] Arch: amd64
2023-08-23T15:06:44.993+08:00 INFO [ServerBootstrap] Running 49 migrations…
2023-08-23T15:06:45.919+08:00 INFO [PeriodicalsService] Starting 26 periodicals …
2023-08-23T15:06:45.920+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.ThroughputCalculator] periodical in [0s], polling every [1s].
2023-08-23T15:06:46.004+08:00 INFO [Periodicals] Starting [org.graylog.plugins.pipelineprocessor.periodical.LegacyDefaultStreamMigration] periodical, running forever.
2023-08-23T15:06:46.291+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.BatchedElasticSearchOutputFlushThread] periodical in [0s], polling every [1s].
2023-08-23T15:06:46.305+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.ClusterHealthCheckThread] periodical in [120s], polling every [20s].
2023-08-23T15:06:46.315+08:00 INFO [LegacyDefaultStreamMigration] Legacy default stream has no connections, no migration needed.
2023-08-23T15:06:46.333+08:00 INFO [PeriodicalsService] Not starting [org.graylog2.periodical.ContentPackLoaderPeriodical] periodical. Not configured to run on this node.
2023-08-23T15:06:46.333+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.GarbageCollectionWarningThread] periodical, running forever.
2023-08-23T15:06:46.366+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.IndexerClusterCheckerThread] periodical in [0s], polling every [30s].
2023-08-23T15:06:46.418+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.IndexBlockCheck] periodical in [0s], polling every [30s].
2023-08-23T15:06:46.434+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.IndexRetentionThread] periodical in [0s], polling every [300s].
2023-08-23T15:06:46.494+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.IndexRotationThread] periodical in [0s], polling every [10s].
2023-08-23T15:06:46.510+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.NodePingThread] periodical in [0s], polling every [1s].
2023-08-23T15:06:46.526+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.VersionCheckThread] periodical in [300s], polling every [1800s].
2023-08-23T15:06:46.541+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.ThrottleStateUpdaterThread] periodical in [1s], polling every [1s].
2023-08-23T15:06:46.551+08:00 INFO [Periodicals] Starting [org.graylog2.events.ClusterEventPeriodical] periodical in [0s], polling every [1s].
2023-08-23T15:06:46.582+08:00 INFO [Periodicals] Starting [org.graylog2.events.ClusterEventCleanupPeriodical] periodical in [0s], polling every [86400s].
2023-08-23T15:06:46.602+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.IndexRangesCleanupPeriodical] periodical in [15s], polling every [3600s].
2023-08-23T15:06:46.716+08:00 INFO [connection] Opened connection [connectionId{localValue:8, serverValue:8}] to localhost:27017
2023-08-23T15:06:46.721+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.TrafficCounterCalculator] periodical in [0s], polling every [1s].
2023-08-23T15:06:46.731+08:00 INFO [Periodicals] Starting [org.graylog2.indexer.fieldtypes.IndexFieldTypePollerPeriodical] periodical in [0s], polling every [1s].
2023-08-23T15:06:46.740+08:00 INFO [Periodicals] Starting [org.graylog.scheduler.periodicals.ScheduleTriggerCleanUp] periodical in [120s], polling every [86400s].
2023-08-23T15:06:46.741+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.ESVersionCheckPeriodical] periodical in [0s], polling every [30s].
2023-08-23T15:06:46.855+08:00 INFO [Periodicals] Starting [org.graylog2.periodical.UserSessionTerminationPeriodical] periodical, running forever.
2023-08-23T15:06:46.882+08:00 INFO [Periodicals] Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredSidecarsThread] periodical in [0s], polling every [600s].
2023-08-23T15:06:46.885+08:00 INFO [Periodicals] Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredConfigurationUploads] periodical in [0s], polling every [600s].
2023-08-23T15:06:46.887+08:00 INFO [Periodicals] Starting [org.graylog.plugins.views.search.db.SearchesCleanUpJob] periodical in [3600s], polling every [28800s].
2023-08-23T15:06:46.911+08:00 INFO [Periodicals] Starting [org.graylog.events.periodicals.EventNotificationStatusCleanUp] periodical in [120s], polling every [86400s].
2023-08-23T15:06:46.911+08:00 INFO [Periodicals] Starting [org.graylog.plugins.collector.periodical.PurgeExpiredCollectorsThread] periodical in [0s], polling every [3600s].
2023-08-23T15:06:49.439+08:00 INFO [NetworkListener] Started listener bound to [10.210.82.20:9000]
2023-08-23T15:06:49.441+08:00 INFO [HttpServer] [HttpServer] Started.
2023-08-23T15:06:49.441+08:00 INFO [JerseyService] Started REST API at <10.210.82.20:9000>
2023-08-23T15:06:49.442+08:00 INFO [ServiceManagerListener] Services are healthy
2023-08-23T15:06:49.443+08:00 INFO [ServerBootstrap] Services started, startup times in ms: {UserSessionTerminationService [RUNNING]=0, InputSetupService [RUNNING]=1, FailureHandlingService [RUNNING]=1, UrlWhitelistService [RUNNING]=4, GracefulShutdownService [RUNNING]=11, ConfigurationEtagService [RUNNING]=12, LocalKafkaMessageQueueWriter [RUNNING]=12, PrometheusExporter [RUNNING]=13, BufferSynchronizerService [RUNNING]=15, OutputSetupService [RUNNING]=20, EtagService [RUNNING]=34, GeoIpDbFileChangeMonitorService [RUNNING]=42, StreamCacheService [RUNNING]=57, LocalKafkaMessageQueueReader [RUNNING]=71, JobSchedulerService [RUNNING]=105, LookupTableService [RUNNING]=223, MongoDBProcessingStatusRecorderService [RUNNING]=237, LocalKafkaJournal [RUNNING]=246, PeriodicalsService [RUNNING]=996, JerseyService [RUNNING]=3522}
2023-08-23T15:06:49.451+08:00 INFO [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Running [LB:ALIVE]
2023-08-23T15:06:49.470+08:00 INFO [InputLauncher] Launching input [Syslog UDP/wlc/64e5a0ad0e59cc43db861efc] - desired state is RUNNING
2023-08-23T15:06:49.523+08:00 INFO [ServerBootstrap] Graylog server up and running.
2023-08-23T15:06:49.525+08:00 INFO [InputStateListener] Input [Syslog UDP/64e5a0ad0e59cc43db861efc] is now STARTING
2023-08-23T15:06:49.654+08:00 INFO [InputStateListener] Input [Syslog UDP/64e5a0ad0e59cc43db861efc] is now RUNNING
2023-08-23T15:07:37.339+08:00 INFO [connection] Opened connection [connectionId{localValue:9, serverValue:9}] to localhost:27017
2023-08-23T15:07:38.339+08:00 INFO [connection] Opened connection [connectionId{localValue:10, serverValue:10}] to localhost:27017
2023-08-23T15:07:38.349+08:00 INFO [connection] Opened connection [connectionId{localValue:11, serverValue:11}] to localhost:27017
2023-08-23T15:07:38.389+08:00 INFO [connection] Opened connection [connectionId{localValue:12, serverValue:12}] to localhost:27017
2023-08-23T15:10:12.896+08:00 INFO [InputStateListener] Input [Syslog UDP/64e5a0ad0e59cc43db861efc] is now STOPPING
2023-08-23T15:10:12.904+08:00 INFO [InputStateListener] Input [Syslog UDP/64e5a0ad0e59cc43db861efc] is now TERMINATED
2023-08-23T15:10:12.906+08:00 INFO [InputStateListener] Input [Syslog UDP/64e5a0ad0e59cc43db861efc] is now STOPPED
2023-08-23T15:10:14.673+08:00 INFO [connection] Opened connection [connectionId{localValue:13, serverValue:14}] to localhost:27017
2023-08-23T15:10:14.677+08:00 INFO [connection] Opened connection [connectionId{localValue:14, serverValue:13}] to localhost:27017
2023-08-23T15:10:14.682+08:00 INFO [InputStateListener] Input [Syslog UDP/64e5a0ad0e59cc43db861efc] is now STARTING
2023-08-23T15:10:14.697+08:00 INFO [InputStateListener] Input [Syslog UDP/64e5a0ad0e59cc43db861efc] is now RUNNING
[root@ISCN-LogServer graylog-server]#

qumj_mail_Graylog1 · August 23, 2023, 7:49am

Joel_Duffield · August 25, 2023, 2:18am

Is that red error message still valid, it says it was reiggered the day before. Delete that error with the x restart graylog and see if that error comes back or not.

You could also try and run this on some random port like 1964 and see if it binds to that address and starts and recieves data, maybe the 1514 port is somehow still stuck to something else.

system · September 8, 2023, 2:19am

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Fail to create second syslog udp input Graylog Central (peer support)	3	526	May 27, 2019
Graylog 3.0 Syslog UDP input fails to start even though address is not in use Graylog Central (peer support)	4	5296	April 7, 2019
Permissions error when creating Syslog UDP input Graylog Central (peer support)	4	2237	May 5, 2023
Graylog inputs not working Graylog Central (peer support)	14	12234	October 5, 2017
Graylog Cisco Switch Input Failed Graylog Central (peer support)	9	2700	February 17, 2020

Syslog UDP FAILED

Related Topics