Nagios Support Forum

Support for Nagios products and services
https://support.nagios.com/forum/

logstash errors second instance syslog listener died

https://support.nagios.com/forum/viewtopic.php?t=36877

Page 1 of 2

logstash errors second instance syslog listener died

Posted: Tue Feb 02, 2016 11:32 am
by GhostRider2110
On my second instance I'm now getting:
{:timestamp=>"2016-02-02T08:52:17.531000-0500", :message=>"syslog listener died", :protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<SocketError: bind: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:160:in `bind'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:135:in `udp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:97:in `run'"], :level=>:warn}
{:timestamp=>"2016-02-02T08:52:17.531000-0500", :message=>"syslog listener died", :protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2)>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:124:in `initialize'", "org/jruby/RubyIO.java:853:in `new'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:152:in `tcp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:101:in `run'"], :level=>:warn}
{:timestamp=>"2016-02-02T08:52:22.533000-0500", :message=>"syslog listener died", :protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2)>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:124:in `initialize'", "org/jruby/RubyIO.java:853:in `new'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:152:in `tcp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:101:in `run'"], :level=>:warn}
{:timestamp=>"2016-02-02T08:52:22.534000-0500", :message=>"syslog listener died", :protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<SocketError: bind: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:160:in `bind'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:135:in `udp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:97:in `run'"], :level=>:warn}
{:timestamp=>"2016-02-02T08:52:27.534000-0500", :message=>"syslog listener died", :protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2)>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:124:in `initialize'", "org/jruby/RubyIO.java:853:in `new'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:152:in `tcp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:101:in `run'"], :level=>:warn}
Repeating every 5sec or so. Nothing in /var/log/messages.

RHEL 7.2
Nagios Log Server • 1.4.0


--Mitch

Re: logstash errors second instance syslog listener died

Posted: Tue Feb 02, 2016 3:13 pm
by GhostRider2110
I have checked to see, it looks like it is running as root:
# ps -ef | grep logstash
root 2218 1 0 08:46 ? 00:00:00 runuser -s /bin/sh -c exec /usr/local/nagioslogserver/logstash/bin/logstash agent -f /usr/local/nagioslogserver/logstash/etc/conf.d -l /var/log/logstash/logstash.log -w 4 nagios
nagios 2534 2218 0 08:46 ? 00:03:32 /bin/java -Djava.io.tmpdir=/usr/local/nagioslogserver/tmp -Djava.io.tmpdir=/usr/local/nagioslogserver/tmp -Xmx2056m -Xss2048k -Djffi.boot.library.path=/usr/local/nagioslogserver/logstash/vendor/jruby/lib/jni -Djava.io.tmpdir=/usr/local/nagioslogserver/tmp -Djava.io.tmpdir=/usr/local/nagioslogserver/tmp -Xbootclasspath/a:/usr/local/nagioslogserver/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/usr/local/nagioslogserver/logstash/vendor/jruby -Djruby.lib=/usr/local/nagioslogserver/logstash/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main --1.9 /usr/local/nagioslogserver/logstash/lib/bootstrap/environment.rb logstash/runner.rb agent -f /usr/local/nagioslogserver/logstash/etc/conf.d -l /var/log/logstash/logstash.log -w 4
root 18486 9205 0 15:08 pts/0 00:00:00 grep --color=auto logstash

Re: logstash errors second instance syslog listener died

Posted: Tue Feb 02, 2016 3:53 pm
by jolson
Are you certain that you don't have two TCP/UDP listeners on port 514? I'd like you to run the following please:

Code: Select all

cat /usr/local/nagioslogserver/logstash/etc/conf.d/*

Re: logstash errors second instance syslog listener died

Posted: Fri Feb 05, 2016 8:00 am
by GhostRider2110
Hmmm Noticed something strange now, on my logserver02, clicking on "Administration" brings up blank page. I can drill down to most items within Administration using direct URL like /admin/instance_status but not /cluster.

Anyway, here is the output you ask for.

Code: Select all

[root@iganagioslog02 logstash]# cat /usr/local/nagioslogserver/logstash/etc/conf.d/*
# 
# Logstash Configuration File
# Dynamically created by Nagios Log Server
#
# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
#
# Created Tue, 02 Feb 2016 08:33:13 -0500
#

#
# Global inputs
#

input {
    tcp {
        type => 'eventlog'
        port => 3515
        codec => json {
            charset => 'CP1252'
        }
    }
    tcp {
        type => 'import_raw'
        tags => 'import_raw'
        port => 2056
    }
    tcp {
        type => 'import_json'
        tags => 'import_json'
        port => 2057
        codec => json
    }
    syslog {
        type => 'syslog'
        port => 514
    }
    syslog {
        type => 'asa'
        port => 6544
    }
    tcp {
        port => 5544
        type => 'syslog'
    }
    udp {
        port => 5544
        type => 'syslog'
    
    }
}

#
# Local inputs
#


# 
# Logstash Configuration File
# Dynamically created by Nagios Log Server
#
# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
#
# Created Tue, 02 Feb 2016 08:33:13 -0500
#

#
# Global filters
#

filter {
    if [program] == 'apache_access' {
        grok {
            match => [ 'message', '%{COMBINEDAPACHELOG}']
        }
        date {
            match => [ 'timestamp', 'dd/MMM/yyyy:HH:mm:ss Z' ]
        }
        mutate {
            replace => [ 'type', 'apache_access' ]
             convert => [ 'bytes', 'integer' ]
             convert => [ 'response', 'integer' ]
        }
    }
     
    if [program] == 'apache_error' {
        grok {
            match => [ 'message', '\[(?<timestamp>%{DAY:day} %{MONTH:month} %{MONTHDAY} %{TIME} %{YEAR})\] \[%{WORD:class}\] \[%{WORD:originator} %{IP:clientip}\] %{GREEDYDATA:errmsg}']
        }
        mutate {
            replace => [ 'type', 'apache_error' ]
        }
    }
    if [program] == 'TrexSyncPubRep' {
    mutate {
    replace => [ 'type', 'TrexSyncPubRep' ]
    }
    }
    if [type] == 'asa' {
    grok{
    match => ['message', '%{SYSLOG5424PRI}%%{WORD:LogType}-%{INT:LogSeverity}-%{INT:LogMessageNumber}: Group = %{IPORHOST:Group}, Username = %{IPORHOST:username}, IP = %{IP:IPAddress}, Session disconnected. Session Type: %{WORD:SessionType}, Duration: %{CUSTOM1:DurationDays=[0-9]?}%{CUSTOM2=d? ?}%{INT:DurationHours:int}h:%{INT:DurationMinutes:int}m:%{INT:DurationSeconds:int}s, Bytes xmt: %{INT:BytesTransmitted:int}, Bytes rcv: %{INT:BytesReceived:int}, Reason: %{GREEDYDATA:Reason}']
    }
    geoip {
      source => "IPAddress"
    }
    }
    if [program] == 'apache_access' {
        geoip {
            source => 'clientip'
        }
    }
    if [program] == 'TrexSyncRep' {
    mutate {
    replace => [ 'type', 'TrexSyncRep' ]
    }
    }
    if [program] == 'Jupiter_log' {
    mutate {
    replace => [ 'type', 'Jupiter' ]
    }
    }
    if [program] == 'diablo_in1_video_management' {
    mutate {
    replace => [ 'type', 'diablo' ]
    }
    }
    if [program] == 'PUB_API_ACCESS' {
    mutate {
    replace => [ 'type', 'APIaccess' ]
    }
    }
    if [program] == 'sudo' {
    mutate {
    replace => [ 'type', 'sudo' ]
    }
    }
    if [program] == 'opt_lrms_logs_cmgopher' {
    mutate {
    replace => [ 'type', 'CMGopher_LRMS' ]
    }
    }
    if [program] == 'lrms_user_mgmt' {
    mutate {
    replace => [ 'type', 'User_Mgmt_LRMS' ]
    }
    }
    if [program] == 'opt_lrms_logs_uam' {
    mutate {
    replace => [ 'type', 'UAMGopher_LRMS' ]
    }
    }
    if [program] == 'cm_log' {
    mutate {
    replace => [ 'type', 'CM_LOG' ]
    }
    }
    if [program] == 'Epsy_log' {
    mutate {
    replace => [ 'type', 'Epsy_log' ]
    }
    }
    if [program] == 'Wowzastream_access' {
    mutate {
    replace => [ 'type', 'wowzastream' ]
    }
    }
    if [program] == 'Wowzastream_error' {
    mutate {
    replace => [ 'type', 'wowzastream' ]
    }
    }
    if [program] == 'lrms_logs' {
    mutate {
    replace => [ 'type', 'LRMS_LOG' ]
    }
    }
    if [program] == 'ca_logs' {
    mutate {
    replace => [ 'type', 'CA_LOG' ]
    }
    }
    if [program] == 'datacleanup_logs' {
    mutate {
    replace => [ 'type', 'DATACLEANUP_LOG' ]
    }
    }
    if [program] == 'draftingrequest_logs' {
    mutate {
    replace => [ 'type', 'DRAFTINGREQUEST_LOG' ]
    }
    }
    if [program] == 'cmgopher_log' {
    mutate {
    replace => [ 'type', 'CMGHPHER_LOG' ]
    }
    }
    if [program] == 'lm_log' {
    mutate {
    replace => [ 'type', 'LM_LOG' ]
    }
    }
    if [type] == "syslog" {
       grok {
           match => { "message" => "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
    }
    }
}

#
# Local filters
#


# 
# Logstash Configuration File
# Dynamically created by Nagios Log Server
#
# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
#
# Created Tue, 02 Feb 2016 08:33:13 -0500
#

#
# Required output for Nagios Log Server
#

output {
    elasticsearch {
        cluster => '25e0abdc-5b56-4815-adcb-4239555d0899'
        host => 'localhost'
        document_type => '%{type}'
        node_name => '64030bad-57ce-463a-8dac-a5317c1369f2'
        protocol => 'transport'
        workers => 4
    }
}

#
# Global outputs
#



#
# Local outputs
#

Re: logstash errors second instance syslog listener died

Posted: Fri Feb 05, 2016 1:14 pm
by hsmith
logserver02 didn't run out of disk space, did it?

Re: logstash errors second instance syslog listener died

Posted: Sun Feb 07, 2016 11:39 pm
by Box293
In larger deployments of Log Server, PHP needs the memory_limit increased from the default of 128M. This needs to be performed on all Log Server nodes.

The following steps will increase the value to 256M.

Establish an SSH session to each Log Server node.

Code: Select all

sed -i 's/^memory_limit.*/memory_limit = 256M/g' /etc/php.ini
service httpd restart
Once the service has restarted, the Administration page will be accessible. If the problem persists, please increase the value again.

Re: logstash errors second instance syslog listener died

Posted: Tue Feb 09, 2016 10:01 am
by GhostRider2110
Thanks box293, that was the problem. I had already increased that on the original logserver and had not when I added the second.

Along those lines I also double checked the make sure the config's for both systems were the same. Everything checks out except for /etc/sysconfig/logstash. The originial NLS has the following line at the end of the file:

Code: Select all

setcap 'cap_net_bind_service=+ep' $(readlink -f $(which java))
which is not present in the NLS server added later which is producing the errors in the logstash.log file.

See-ya
Mitch

Re: logstash errors second instance syslog listener died

Posted: Tue Feb 09, 2016 10:53 am
by jolson
setcap 'cap_net_bind_service=+ep' $(readlink -f $(which java))
This line must be added manually to each instance in your cluster in accordance with the following document: https://assets.nagios.com/downloads/nag ... Server.pdf

I'm glad to hear the PHP memory limit resolved your issue. Is there anything else we can help you out with?

Re: logstash errors second instance syslog listener died

Posted: Thu Feb 11, 2016 8:18 am
by GhostRider2110
Still getting the "syslog listener died" error.

Code: Select all

{:timestamp=>"2016-02-02T03:30:43.607000-0500", :message=>"syslog listener died", :protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<SocketError: initialize: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:106:in `initialize'", "org/jruby/ext/socket/RubyUDPSocket.java:115:in `initialize'", "org/jruby/RubyIO.java:853:in `new'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:134:in `udp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:97:in `run'"], :level=>:warn}
{:timestamp=>"2016-02-02T03:30:43.608000-0500", :message=>"syslog listener died", :protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<SocketError: initialize: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:126:in `initialize'", "org/jruby/RubyIO.java:853:in `new'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:152:in `tcp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:101:in `run'"], :level=>:warn}
{:timestamp=>"2016-02-02T03:30:48.608000-0500", :message=>"syslog listener died", :protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<SocketError: initialize: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:106:in `initialize'", "org/jruby/ext/socket/RubyUDPSocket.java:115:in `initialize'", "org/jruby/RubyIO.java:853:in `new'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:134:in `udp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:97:in `run'"], :level=>:warn}
{:timestamp=>"2016-02-02T03:30:48.608000-0500", :message=>"syslog listener died", :protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<SocketError: initialize: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:126:in `initialize'", "org/jruby/RubyIO.java:853:in `new'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:152:in `tcp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:101:in `run'"], :level=>:warn}
{:timestamp=>"2016-02-02T03:30:53.609000-0500", :message=>"syslog listener died", :protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<SocketError: initialize: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:106:in `initialize'", "org/jruby/ext/socket/RubyUDPSocket.java:115:in `initialize'", "org/jruby/RubyIO.java:853:in `new'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:134:in `udp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:97:in `run'"], :level=>:warn}
{:timestamp=>"2016-02-02T03:30:53.610000-0500", :message=>"syslog listener died", :protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<SocketError: initialize: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:126:in `initialize'", "org/jruby/RubyIO.java:853:in `new'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:152:in `tcp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:101:in `run'"], :level=>:warn}
{:timestamp=>"2016-02-02T03:30:58.610000-0500", :message=>"syslog listener died", :protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<SocketError: initialize: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:106:in `initialize'", "org/jruby/ext/socket/RubyUDPSocket.java:115:in `initialize'", "org/jruby/RubyIO.java:853:in `new'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:134:in `udp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:97:in `run'"], :level=>:warn}
{:timestamp=>"2016-02-02T03:30:58.611000-0500", :message=>"syslog listener died", :protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<SocketError: initialize: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:126:in `initialize'", "org/jruby/RubyIO.java:853:in `new'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:152:in `tcp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:101:in `run'"], :level=>:warn}
{:timestamp=>"2016-02-02T03:31:03.612000-0500", :message=>"syslog listener died", :protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<SocketError: initialize: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:106:in `initialize'", "org/jruby/ext/socket/RubyUDPSocket.java:115:in `initialize'", "org/jruby/RubyIO.java:853:in `new'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:134:in `udp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:97:in `run'"], :level=>:warn}
{:timestamp=>"2016-02-02T03:31:03.612000-0500", :message=>"syslog listener died", :protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<SocketError: initialize: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:126:in `initialize'", "org/jruby/RubyIO.java:853:in `new'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:152:in `tcp_listener'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:117:in `server'", "/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-0.1.6/lib/logstash/inputs/syslog.rb:101:in `run'"], :level=>:warn

Re: logstash errors second instance syslog listener died

Posted: Thu Feb 11, 2016 11:38 am
by rkennedy
I believe this is related to Logstash not being able to listen on port 514, as Logstash can't listen to anything below 1024 by default.

Can you try following this documentation? http://assets.nagios.com/downloads/nagi ... Server.pdf
All times are UTC-05:00
Page 1 of 2

Powered by phpBB® Forum Software © phpBB Limited