Socket errors in logstash log

[GhostRider2110]

Same setup as in my other thread: https://support.nagios.com/forum/viewto ... 71#p301982

Nagios Log Server Cluster:
Have added System Profiles from both systems as attachments.

iganagioslog - CentOS release 6.10 (Final)
This is the first system setup when we started using NLS, I believe it was a VMware image from Nagios.
NLS 2.1.3

iganagioslog01 - Red Hat Enterprise Linux Server release 7.7 (Maipo)
Install from downloaded tar file.
Getting the following errors in the logstash log:

{:timestamp=>"2020-01-22T07:38:28.062000-0500", :message=>"syslog listener died", :protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2)>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:124:in `initialize'", "org/jruby/RubyIO.java:871:in `new'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.5/lib/logstash/inputs/syslog.rb:152:in `tcp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.5/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.5/lib/logstash/inputs/syslog.rb:101:in `run'"], :level=>:warn}
{:timestamp=>"2020-01-22T07:38:32.448000-0500", :message=>"syslog listener died", :protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<SocketError: bind: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:160:in `bind'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.5/lib/logstash/inputs/syslog.rb:135:in `udp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.5/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.5/lib/logstash/inputs/syslog.rb:97:in `run'"], :level=>:warn}
{:timestamp=>"2020-01-22T07:38:33.064000-0500", :message=>"syslog listener died", :protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2)>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:124:in `initialize'", "org/jruby/RubyIO.java:871:in `new'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.5/lib/logstash/inputs/syslog.rb:152:in `tcp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.5/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.5/lib/logstash/inputs/syslog.rb:101:in `run'"], :level=>:warn}
{:timestamp=>"2020-01-22T07:38:37.449000-0500", :message=>"syslog listener died", :protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<SocketError: bind: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:160:in `bind'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.5/lib/logstash/inputs/syslog.rb:135:in `udp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.5/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.5/lib/logstash/inputs/syslog.rb:97:in `run'"], :level=>:warn}

[scottwilkerson]

Ports below 1024 are privileged and require additional setup on each of the servers in your cluster.

We have a document outlining the procedure
https://assets.nagios.com/downloads/nag ... Server.pdf

[GhostRider2110]

Hmmm Ok, I'll have to take a look at the configs, didn't think I had anything on that port.

[scottwilkerson]

Hmmm Ok, I'll have to take a look at the configs, didn't think I had anything on that port.

Ya, looks like there must be one configured for 514

Code: Select all

protocol=>:tcp, :address=>"0.0.0.0:514",

[GhostRider2110]

Found it, thanks. I'll have them change the port sending to if I can, for now just started the system as root as a temp fix.

Thanks
Mitch

[scottwilkerson]

Found it, thanks. I'll have them change the port sending to if I can, for now just started the system as root as a temp fix.

Thanks
Mitch

Sounds good.

Locking thread