The local input isn't running

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
the local input isn’t running

2. Describe your environment:

  • OS Information:
    centos stream release 9

  • Package Version:
    graylog5.1+opensearch2.9+mongodb 6.0.9

  • Service logs, configurations, and environment variables:
    Graylog log*********
    2023-09-01T05:23:54.255-04:00 INFO [InputStateListener] Input [Syslog UDP/Logo/64f1a5f679672616c2bdbdca] is now STOPPED
    2023-09-01T05:23:54.259-04:00 INFO [InputStateListener] Input [Syslog UDP/Logo/64f1a5f679672616c2bdbdca] is now TERMINATED
    2023-09-01T05:23:54.262-04:00 INFO [InputStateListener] Input [Syslog UDP/Logo/64f1a5f679672616c2bdbdca] is now STARTING
    2023-09-01T05:23:54.268-04:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.udp.SyslogUDPInput] input [Syslog UDP/Logo/64f1a5f679672616c2bdbdca] misfired. Reason: bind(…) failed: Cannot assign requested address.
    org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException:$NativeIoException: bind(…) failed: Cannot assign requested address
    at org.graylog2.plugin.inputs.MessageInput.launch( ~[graylog.jar:?]
    at org.graylog2.shared.inputs.InputLauncher$ [graylog.jar:?]
    at com.codahale.metrics.InstrumentedExecutorService$ [graylog.jar:?]
    at java.util.concurrent.Executors$ Source) [?:?]
    at Source) [?:?]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
    at java.util.concurrent.ThreadPoolExecutor$ Source) [?:?]
    at Source) [?:?]
    Caused by: org.graylog2.plugin.inputs.MisfireException:$NativeIoException: bind(…) failed: Cannot assign requested address
    at org.graylog2.inputs.transports.UdpTransport.launch( ~[graylog.jar:?]
    at org.graylog2.plugin.inputs.transports.Transport.launch( ~[graylog.jar:?]
    at org.graylog2.plugin.inputs.MessageInput.launch( ~[graylog.jar:?]
    … 7 more
    Caused by:$NativeIoException: bind(…) failed: Cannot assign requested address
    2023-09-01T05:23:54.270-04:00 WARN [UdpTransport] Failed to start channel for input SyslogUDPInput{title=Logo, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=488c6f3f-553d-476f-8294-b8484cdb2e28}$NativeIoException: bind(…) failed: Cannot assign requested address
    2023-09-01T05:23:54.271-04:00 INFO [InputStateListener] Input [Syslog UDP/Logo/64f1a5f679672616c2bdbdca] is now FAILED

opensearch configuration********* graylog /var/lib/opensearch
path.logs: /var/log/opensearch
http.port: 9200
discovery.type: single-node esnode.pem esnode-key.pem root-ca.pem false true esnode.pem esnode-key.pem root-ca.pem true true

  • CN=kirk,OU=client,O=client,L=test, C=de internal_opensearch true true [“all_access”, “security_rest_api_access”] true [“.plugins-ml-config”, “.plugins-ml-connector”, “.plugins-ml-model-group”, “.plugins-ml-model”, “.plugins-ml-task”, “.opendistro-alerting-config”, “.opendistro-alerting-alert*”, “.opendistro-anomaly-results*”, “.opendistro-anomaly-detector*”, “.opendistro-anomaly-checkpoints”, “.opendistro-anomaly-detection-state”, “.opendistro-reports-", ".opensearch-notifications-”, “.opensearch-notebooks”, “.opensearch-observability”, “.ql-datasources”, “.opendistro-asynchronous-search-response*”, “.replication-metadata-store”, “.opensearch-knn-models”]
node.max_local_storage_nodes: 3
action.auto_create_index: false true

Graylog configuration*********
is_leader = true

node_id_file = /etc/graylog/server/node-id

password_secret = mD2lN8CSXU7ukwbblBba5BW77oP2ISnG7L1HPrZxojzOqohnOJUP

root_password_sha2 = deae401f7aadd4cb506e733d7a84615

root_timezone = Asia/Shanghai

bin_dir = /usr/share/graylog-server/bin

data_dir = /var/lib/graylog-server

plugin_dir = /usr/share/graylog-server/plugin

http_bind_address =

allow_leading_wildcard_searches = false

allow_highlighting = false
output_batch_size = 500

output_flush_interval = 1

output_fault_count_threshold = 5
output_fault_penalty_seconds = 30

processbuffer_processors = 5
outputbuffer_processors = 3
processor_wait_strategy = blocking
ring_size = 65536

inputbuffer_ring_size = 65536
inputbuffer_processors = 2
inputbuffer_wait_strategy = blocking
message_journal_enabled = true
message_journal_dir = /var/lib/graylog-server/journal
lb_recognition_period_seconds = 3
mongodb_uri = mongodb://localhost/graylog
mongodb_max_connections = 1000

rsyslog configuration*********


module(load=“builtin:omfile” Template=“RSYSLOG_TraditionalFileFormat”)

module(load=“imuxsock” # provides support for local system logging (e.g. via logger command)
SysSock.Use=“off”) # Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
module(load=“imjournal” # provides access to the systemd journal
UsePid=“system” # PID nummber is retrieved as the ID of the process the journal entry originates from
StateFile=“imjournal.state”) # File to store the position in the journal

include(file=“/etc/rsyslog.d/*.conf” mode=“optional”)

module(load=“imudp”) # needs to be done just once
input(type=“imudp” port=“514”)

*.info;mail.none;authpriv.none;cron.none /var/log/messages

authpriv.* /var/log/secure

mail.* -/var/log/maillog

cron.* /var/log/cron

.emerg :omusrmsg:

uucp,news.crit /var/log/spooler

local7.* /var/log/boot.log


3. What steps have you already taken to try and solve the problem?

i don’t know how to check the issue.

4. How can the community help?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

Ports below 1024 are protected, so you can’t just use them without additional steps, from your log it’s refusing to allow it to bind to the address/port, most likely that is the cause. If you can just run the input on 1514 and have the sources send to that port it probably will work just fine.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.