Nagios Support Forum

tcpdump shows this: 15:36:49.697963 IP 10.28.102.1.syslog > 10.28.102.74.omnisky: SYSLOG local4.debug, length: 116 15:36:49.698836 IP 10.28.102.1.syslog > 10.28.102.74.omnisky: SYSLOG local4.debug, length: 116 15:36:49.699400 IP 10.28.102.1.syslog > 10.28.102.74.omnisky: SYSLOG local4.debug, length:...

found the problem was with my logstashserver conf files.
./logstash agent -f /usr/local/nagioslogserver/logstash/etc/conf.d --configtest
corrected the errors and the server is now running as expected.

I am having the same issue my logstash log contains these entries. [root@localhost ~]# tail -f /var/log/logstash/logstash.log {:timestamp=>"2015-10-02T14:44:38.585000+0000", :message=>"The error reported is: \n Address already in use - bind - Address already in use"} {:timestamp=...

the cisco was reconfigured to send it's syslog messages to udp port 2056 18:34:53.309964 IP 10.28.102.1.syslog > 10.28.102.74.omnisky: SYSLOG local4.debug, length: 116 18:34:53.311889 IP 10.28.102.1.syslog > 10.28.102.74.omnisky: SYSLOG local4.debug, length: 116 18:34:53.318786 IP 10.28.102.1.syslog...

Ok the ASA was changed to send it's syslog messages to udp port 2056 18:26:32.370183 IP 10.28.102.1.syslog > 10.28.102.74.omnisky: SYSLOG local4.debug, length: 116 18:26:32.418504 IP 10.28.102.1.syslog > 10.28.102.74.omnisky: SYSLOG local4.debug, length: 180 18:26:32.418533 IP 10.28.102.1.syslog > 1...

we have configured a cisco asa firewall to send it's syslog messages to a nagios log server on port 5544. When I do a tcpdump on the logserver I can see the syslog messages hitting the log servers interface: 15:41:08.682838 IP 10.28.102.1.syslog > 10.28.102.74.5544: SYSLOG local4.debug, length: 116 ...