Unable to add input to graylog over syslog tcp


(Sargoo) #1

Hi ,

i am trying to setup a new graylog 2.4.3 (on ubuntu 16.04.03 LTS) . Installation was successful. But unable to add new input for TCP Syslog . Below are the details.

root@graylogpp:/var/log/graylog-server# tail -f server.log 
2018-03-21T14:08:21.441+08:00 INFO  [HttpServer] [HttpServer] Started.
2018-03-21T14:08:21.441+08:00 INFO  [JerseyService] Started REST API at <http://172.31.27.169:9000/api/>
2018-03-21T14:08:21.441+08:00 INFO  [JerseyService] Started Web Interface at <http://172.31.27.169:9000/>
2018-03-21T14:08:21.441+08:00 INFO  [ServiceManagerListener] Services are healthy
2018-03-21T14:08:21.442+08:00 INFO  [ServerBootstrap] Services started, startup times in ms: {BufferSynchronizerService [RUNNING]=33, OutputSetupService [RUNNING]=33, KafkaJournal [RUNNING]=71, ConfigurationEtagService [RUNNING]=130, JournalReader [RUNNING]=133, InputSetupService [RUNNING]=135, StreamCacheService [RUNNING]=194, PeriodicalsService [RUNNING]=248, LookupTableService [RUNNING]=380, JerseyService [RUNNING]=10829}
2018-03-21T14:08:21.446+08:00 INFO  [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Running [LB:ALIVE]
2018-03-21T14:08:21.451+08:00 INFO  [ServerBootstrap] Graylog server up and running.
2018-03-21T14:08:21.470+08:00 INFO  [InputStateListener] Input [Syslog TCP/5a018015b3bf3808e9a2aa2e] is now STARTING
2018-03-21T14:08:21.516+08:00 WARN  [NettyTransport] receiveBufferSize (SO_RCVBUF) for input SyslogTCPInput{title=8514-tcp, type=org.graylog2.inputs.syslog.tcp.SyslogTCPInput, nodeId=null} should be 1048576 but is 212992.
2018-03-21T14:08:21.517+08:00 INFO  [InputStateListener] Input [Syslog TCP/5a018015b3bf3808e9a2aa2e] is now RUNNING


(Sargoo) #2

sorry the graylog server.log is wrong above…the correct one is below

root@gr18:/var/log/graylog-server# tail -f server.log 
	at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:223) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:74) ~[?:1.8.0_151]
	at org.jboss.netty.channel.socket.nio.NioServerBoss$RegisterTask.run(NioServerBoss.java:193) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.processTaskQueue(AbstractNioSelector.java:391) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:315) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.NioServerBoss.run(NioServerBoss.java:42) ~[graylog.jar:?]
	at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) ~[graylog.jar:?]
	at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) ~[graylog.jar:?]
	... 3 more
2018-03-21T14:17:59.764+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1f914c701fd125e5008ec] is now FAILED

(Jochen) #3

Please post the complete logs of your Graylog node and not just some arbitrary excerpt.


(Sargoo) #4

hi sorry for that…

below are the logs
indent preformatted text by 4 spaces

org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
	at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:84) [graylog.jar:?]
	at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_151]
	at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_151]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]
Caused by: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:155) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
	... 7 more
Caused by: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.jboss.netty.bootstrap.ServerBootstrap.bind(ServerBootstrap.java:272) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:141) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
	... 7 more
Caused by: java.net.BindException: Address already in use
	at sun.nio.ch.Net.bind0(Native Method) ~[?:1.8.0_151]
	at sun.nio.ch.Net.bind(Net.java:433) ~[?:1.8.0_151]
	at sun.nio.ch.Net.bind(Net.java:425) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:223) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:74) ~[?:1.8.0_151]
	at org.jboss.netty.channel.socket.nio.NioServerBoss$RegisterTask.run(NioServerBoss.java:193) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.processTaskQueue(AbstractNioSelector.java:391) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:315) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.NioServerBoss.run(NioServerBoss.java:42) ~[graylog.jar:?]
	at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) ~[graylog.jar:?]
	at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) ~[graylog.jar:?]
	... 3 more
2018-03-21T14:52:31.693+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now FAILED
2018-03-21T14:52:32.535+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STOPPING
2018-03-21T14:52:32.537+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STOPPED
2018-03-21T14:52:32.539+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now TERMINATED
2018-03-21T14:52:32.540+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STARTING
2018-03-21T14:52:32.546+08:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.tcp.SyslogTCPInput] input with ID <5ab1ff19c701fd047c105eca> misfired. Reason: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
	at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:84) [graylog.jar:?]
	at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_151]
	at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_151]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]
Caused by: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:155) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
	... 7 more
Caused by: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.jboss.netty.bootstrap.ServerBootstrap.bind(ServerBootstrap.java:272) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:141) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
	... 7 more
Caused by: java.net.BindException: Address already in use
	at sun.nio.ch.Net.bind0(Native Method) ~[?:1.8.0_151]
	at sun.nio.ch.Net.bind(Net.java:433) ~[?:1.8.0_151]
	at sun.nio.ch.Net.bind(Net.java:425) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:223) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:74) ~[?:1.8.0_151]
	at org.jboss.netty.channel.socket.nio.NioServerBoss$RegisterTask.run(NioServerBoss.java:193) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.processTaskQueue(AbstractNioSelector.java:391) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:315) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.NioServerBoss.run(NioServerBoss.java:42) ~[graylog.jar:?]
	at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) ~[graylog.jar:?]
	at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) ~[graylog.jar:?]
	... 3 more
2018-03-21T14:52:32.547+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now FAILED
2018-03-21T14:52:33.228+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STOPPING
2018-03-21T14:52:33.229+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STOPPED
2018-03-21T14:52:33.230+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STARTING
2018-03-21T14:52:33.230+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now TERMINATED
2018-03-21T14:52:33.241+08:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.tcp.SyslogTCPInput] input with ID <5ab1ff19c701fd047c105eca> misfired. Reason: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
	at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:84) [graylog.jar:?]
	at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_151]
	at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_151]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]
Caused by: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:155) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
	... 7 more
Caused by: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.jboss.netty.bootstrap.ServerBootstrap.bind(ServerBootstrap.java:272) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:141) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
	... 7 more
Caused by: java.net.BindException: Address already in use
	at sun.nio.ch.Net.bind0(Native Method) ~[?:1.8.0_151]
	at sun.nio.ch.Net.bind(Net.java:433) ~[?:1.8.0_151]
	at sun.nio.ch.Net.bind(Net.java:425) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:223) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:74) ~[?:1.8.0_151]
	at org.jboss.netty.channel.socket.nio.NioServerBoss$RegisterTask.run(NioServerBoss.java:193) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.processTaskQueue(AbstractNioSelector.java:391) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:315) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.NioServerBoss.run(NioServerBoss.java:42) ~[graylog.jar:?]
	at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) ~[graylog.jar:?]
	at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) ~[graylog.jar:?]
	... 3 more
2018-03-21T14:52:33.242+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now FAILED
2018-03-21T14:52:57.126+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STOPPING
2018-03-21T14:52:57.127+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STOPPED
2018-03-21T14:52:57.127+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now TERMINATED
2018-03-21T14:53:01.336+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STARTING
2018-03-21T14:53:01.339+08:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.tcp.SyslogTCPInput] input with ID <5ab1ff19c701fd047c105eca> misfired. Reason: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /0.0.0.0:8514
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
	at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:84) [graylog.jar:?]
	at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_151]
	at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_151]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]
Caused by: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /0.0.0.0:8514
	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:155) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
	... 7 more
Caused by: org.jboss.netty.channel.ChannelException: Failed to bind to: /0.0.0.0:8514
	at org.jboss.netty.bootstrap.ServerBootstrap.bind(ServerBootstrap.java:272) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:141) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
	... 7 more
Caused by: java.net.BindException: Address already in use
	at sun.nio.ch.Net.bind0(Native Method) ~[?:1.8.0_151]
	at sun.nio.ch.Net.bind(Net.java:433) ~[?:1.8.0_151]
	at sun.nio.ch.Net.bind(Net.java:425) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:223) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:74) ~[?:1.8.0_151]
	at org.jboss.netty.channel.socket.nio.NioServerBoss$RegisterTask.run(NioServerBoss.java:193) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.processTaskQueue(AbstractNioSelector.java:391) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:315) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.NioServerBoss.run(NioServerBoss.java:42) ~[graylog.jar:?]
	at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) ~[graylog.jar:?]
	at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) ~[graylog.jar:?]
	... 3 more
2018-03-21T14:53:01.340+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now FAILED
root@gr18:/var/log/graylog-server#

(Jochen) #5

There’s another process (or the same process) already using the network socket (IP address and port) which you’re trying to use in the Syslog TCP input.


(Sargoo) #6

Hi Jochen…my bad …it was conflicting with rsyslog’s port.
thanks very much. pls mark this resolved. thanks


(system) #7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.