514 port or IP address, I don't understand

Elastic Stack Logstash
1

Hi it's again me !

Now I'm trying to listen the port 514 with udp, it's for syslog. Of course I've searched on the internet and all the port under 1024 are privileged. Alright so I'm trying the setcap command and I have this error message :

[2019-11-06T08:58:54,323][INFO ][logstash.inputs.udp ][main] Starting UDP listener {:address=>"0.0.0.0:514"}
[2019-11-06T08:58:54,326][ERROR][logstash.inputs.udp ][main] UDP listener died {:exception=>#<Errno::EADDRINUSE: Address already in use - bind - Adresse déjà utilisée>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:203:in `bind'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-udp-3.3.4/lib/logstash/inputs/udp.rb:116:in `udp_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-udp-3.3.4/lib/logstash/inputs/udp.rb:68:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:314:in `inputworker'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:306:in `block in start_input'"]}

I don't understand why it's speaking about the IP address.

thanks

2

EDIT : It's because of rsyslog wich is listening too on the 514 port

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.