/var/log/logstash errors

[cjsGSB]

Running Nagios Log Server 2.0.7 on RHEL 6.9 getting with 2 instances. Keep getting these errors every 5 seconds.
Is this an issue that should be addressed - thanks

[mbellerue]

Looks like it's potentially trying to start up another instance of logstash. The very first thing I would do is stop logstash, wait a few seconds, and then check the status of the logstash service. If it came up again, then there was a second instance waiting for port 514 to be free.

Code: Select all

service logstash stop
...wait about 10 seconds...
service logstash status

[cjsGSB]

did those commands on both instances the logstash service remains stopped until I restart it.
It does not look like another instance of logstash is trying to restart

[SteveBeauchemin]

I once had a similar issue - the port was in use and I could not make it available. Even after reboot.

Turned out to be a 3rd part app on the system that failed and was flooding my local syslog.

When I killed off that unrelated app, removed it from cron, stuff started to work again.

Just in case you have other stuff running there. Maybe look at the local messages file.

Steve B

[mbellerue]

That's a good point, Steve.

cjsGSB, could you stop logstash, and then run a netstat to see if port 514 is in use?

Code: Select all

netstat -a | grep 514

The other thing that could be happening is that Log Server isn't set up to be able to listen on privileged ports. If you haven't seen it already, take a look at this document.

https://assets.nagios.com/downloads/nag ... Server.pdf