Unable to add input to graylog over syslog tcp

Hi ,

i am trying to setup a new graylog 2.4.3 (on ubuntu 16.04.03 LTS) . Installation was successful. But unable to add new input for TCP Syslog . Below are the details.

root@graylogpp:/var/log/graylog-server# tail -f server.log 
2018-03-21T14:08:21.441+08:00 INFO  [HttpServer] [HttpServer] Started.
2018-03-21T14:08:21.441+08:00 INFO  [JerseyService] Started REST API at <http://172.31.27.169:9000/api/>
2018-03-21T14:08:21.441+08:00 INFO  [JerseyService] Started Web Interface at <http://172.31.27.169:9000/>
2018-03-21T14:08:21.441+08:00 INFO  [ServiceManagerListener] Services are healthy
2018-03-21T14:08:21.442+08:00 INFO  [ServerBootstrap] Services started, startup times in ms: {BufferSynchronizerService [RUNNING]=33, OutputSetupService [RUNNING]=33, KafkaJournal [RUNNING]=71, ConfigurationEtagService [RUNNING]=130, JournalReader [RUNNING]=133, InputSetupService [RUNNING]=135, StreamCacheService [RUNNING]=194, PeriodicalsService [RUNNING]=248, LookupTableService [RUNNING]=380, JerseyService [RUNNING]=10829}
2018-03-21T14:08:21.446+08:00 INFO  [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Running [LB:ALIVE]
2018-03-21T14:08:21.451+08:00 INFO  [ServerBootstrap] Graylog server up and running.
2018-03-21T14:08:21.470+08:00 INFO  [InputStateListener] Input [Syslog TCP/5a018015b3bf3808e9a2aa2e] is now STARTING
2018-03-21T14:08:21.516+08:00 WARN  [NettyTransport] receiveBufferSize (SO_RCVBUF) for input SyslogTCPInput{title=8514-tcp, type=org.graylog2.inputs.syslog.tcp.SyslogTCPInput, nodeId=null} should be 1048576 but is 212992.
2018-03-21T14:08:21.517+08:00 INFO  [InputStateListener] Input [Syslog TCP/5a018015b3bf3808e9a2aa2e] is now RUNNING

sorry the graylog server.log is wrong above…the correct one is below

root@gr18:/var/log/graylog-server# tail -f server.log 
	at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:223) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:74) ~[?:1.8.0_151]
	at org.jboss.netty.channel.socket.nio.NioServerBoss$RegisterTask.run(NioServerBoss.java:193) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.processTaskQueue(AbstractNioSelector.java:391) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:315) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.NioServerBoss.run(NioServerBoss.java:42) ~[graylog.jar:?]
	at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) ~[graylog.jar:?]
	at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) ~[graylog.jar:?]
	... 3 more
2018-03-21T14:17:59.764+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1f914c701fd125e5008ec] is now FAILED

Please post the complete logs of your Graylog node and not just some arbitrary excerpt.

hi sorry for that…

below are the logs
indent preformatted text by 4 spaces

org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
	at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:84) [graylog.jar:?]
	at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_151]
	at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_151]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]
Caused by: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:155) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
	... 7 more
Caused by: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.jboss.netty.bootstrap.ServerBootstrap.bind(ServerBootstrap.java:272) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:141) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
	... 7 more
Caused by: java.net.BindException: Address already in use
	at sun.nio.ch.Net.bind0(Native Method) ~[?:1.8.0_151]
	at sun.nio.ch.Net.bind(Net.java:433) ~[?:1.8.0_151]
	at sun.nio.ch.Net.bind(Net.java:425) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:223) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:74) ~[?:1.8.0_151]
	at org.jboss.netty.channel.socket.nio.NioServerBoss$RegisterTask.run(NioServerBoss.java:193) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.processTaskQueue(AbstractNioSelector.java:391) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:315) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.NioServerBoss.run(NioServerBoss.java:42) ~[graylog.jar:?]
	at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) ~[graylog.jar:?]
	at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) ~[graylog.jar:?]
	... 3 more
2018-03-21T14:52:31.693+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now FAILED
2018-03-21T14:52:32.535+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STOPPING
2018-03-21T14:52:32.537+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STOPPED
2018-03-21T14:52:32.539+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now TERMINATED
2018-03-21T14:52:32.540+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STARTING
2018-03-21T14:52:32.546+08:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.tcp.SyslogTCPInput] input with ID <5ab1ff19c701fd047c105eca> misfired. Reason: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
	at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:84) [graylog.jar:?]
	at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_151]
	at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_151]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]
Caused by: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:155) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
	... 7 more
Caused by: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.jboss.netty.bootstrap.ServerBootstrap.bind(ServerBootstrap.java:272) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:141) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
	... 7 more
Caused by: java.net.BindException: Address already in use
	at sun.nio.ch.Net.bind0(Native Method) ~[?:1.8.0_151]
	at sun.nio.ch.Net.bind(Net.java:433) ~[?:1.8.0_151]
	at sun.nio.ch.Net.bind(Net.java:425) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:223) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:74) ~[?:1.8.0_151]
	at org.jboss.netty.channel.socket.nio.NioServerBoss$RegisterTask.run(NioServerBoss.java:193) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.processTaskQueue(AbstractNioSelector.java:391) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:315) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.NioServerBoss.run(NioServerBoss.java:42) ~[graylog.jar:?]
	at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) ~[graylog.jar:?]
	at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) ~[graylog.jar:?]
	... 3 more
2018-03-21T14:52:32.547+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now FAILED
2018-03-21T14:52:33.228+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STOPPING
2018-03-21T14:52:33.229+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STOPPED
2018-03-21T14:52:33.230+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STARTING
2018-03-21T14:52:33.230+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now TERMINATED
2018-03-21T14:52:33.241+08:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.tcp.SyslogTCPInput] input with ID <5ab1ff19c701fd047c105eca> misfired. Reason: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
	at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:84) [graylog.jar:?]
	at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_151]
	at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_151]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]
Caused by: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:155) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
	... 7 more
Caused by: org.jboss.netty.channel.ChannelException: Failed to bind to: /172.31.8.208:8514
	at org.jboss.netty.bootstrap.ServerBootstrap.bind(ServerBootstrap.java:272) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:141) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
	... 7 more
Caused by: java.net.BindException: Address already in use
	at sun.nio.ch.Net.bind0(Native Method) ~[?:1.8.0_151]
	at sun.nio.ch.Net.bind(Net.java:433) ~[?:1.8.0_151]
	at sun.nio.ch.Net.bind(Net.java:425) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:223) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:74) ~[?:1.8.0_151]
	at org.jboss.netty.channel.socket.nio.NioServerBoss$RegisterTask.run(NioServerBoss.java:193) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.processTaskQueue(AbstractNioSelector.java:391) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:315) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.NioServerBoss.run(NioServerBoss.java:42) ~[graylog.jar:?]
	at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) ~[graylog.jar:?]
	at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) ~[graylog.jar:?]
	... 3 more
2018-03-21T14:52:33.242+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now FAILED
2018-03-21T14:52:57.126+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STOPPING
2018-03-21T14:52:57.127+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STOPPED
2018-03-21T14:52:57.127+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now TERMINATED
2018-03-21T14:53:01.336+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now STARTING
2018-03-21T14:53:01.339+08:00 ERROR [InputLauncher] The [org.graylog2.inputs.syslog.tcp.SyslogTCPInput] input with ID <5ab1ff19c701fd047c105eca> misfired. Reason: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /0.0.0.0:8514
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
	at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:84) [graylog.jar:?]
	at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_151]
	at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_151]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]
Caused by: org.graylog2.plugin.inputs.MisfireException: org.jboss.netty.channel.ChannelException: Failed to bind to: /0.0.0.0:8514
	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:155) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
	... 7 more
Caused by: org.jboss.netty.channel.ChannelException: Failed to bind to: /0.0.0.0:8514
	at org.jboss.netty.bootstrap.ServerBootstrap.bind(ServerBootstrap.java:272) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.transports.NettyTransport.launch(NettyTransport.java:141) ~[graylog.jar:?]
	at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
	... 7 more
Caused by: java.net.BindException: Address already in use
	at sun.nio.ch.Net.bind0(Native Method) ~[?:1.8.0_151]
	at sun.nio.ch.Net.bind(Net.java:433) ~[?:1.8.0_151]
	at sun.nio.ch.Net.bind(Net.java:425) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:223) ~[?:1.8.0_151]
	at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:74) ~[?:1.8.0_151]
	at org.jboss.netty.channel.socket.nio.NioServerBoss$RegisterTask.run(NioServerBoss.java:193) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.processTaskQueue(AbstractNioSelector.java:391) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:315) ~[graylog.jar:?]
	at org.jboss.netty.channel.socket.nio.NioServerBoss.run(NioServerBoss.java:42) ~[graylog.jar:?]
	at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) ~[graylog.jar:?]
	at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) ~[graylog.jar:?]
	... 3 more
2018-03-21T14:53:01.340+08:00 INFO  [InputStateListener] Input [Syslog TCP/5ab1ff19c701fd047c105eca] is now FAILED
root@gr18:/var/log/graylog-server#

There’s another process (or the same process) already using the network socket (IP address and port) which you’re trying to use in the Syslog TCP input.

Hi Jochen…my bad …it was conflicting with rsyslog’s port.
thanks very much. pls mark this resolved. thanks

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.