# 514 port or IP address, I don't understand

**URL:** <https://discuss.elastic.co/t/514-port-or-ip-address-i-dont-understand/206744>\
**Category:** Logstash\
**Created:** [November 6, 2019, 8:10am UTC](https://discuss.elastic.co/t/514-port-or-ip-address-i-dont-understand/206744 "2019-11-06T08:10:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lgllrd](https://avatars.discourse-cdn.com/v4/letter/l/e8c25b/32.png) [@lgllrd](https://discuss.elastic.co/u/lgllrd)\
**Post date:** [November 6, 2019, 8:10am UTC](https://discuss.elastic.co/t/514-port-or-ip-address-i-dont-understand/206744/1 "2019-11-06T08:10:52Z")

</div>

Hi it's again me !

Now I'm trying to listen the port 514 with udp, it's for syslog. Of course I've searched on the internet and all the port under 1024 are privileged. Alright so I'm trying the setcap command and I have this error message :

> [2019-11-06T08:58:54,323][INFO][logstash.inputs.udp][main] Starting UDP listener {:address=\>"0.0.0.0:514"}  
> [2019-11-06T08:58:54,326][ERROR][logstash.inputs.udp][main] UDP listener died {:exception=\>#\<Errno::EADDRINUSE: Address already in use - bind - Adresse déjà utilisée\>, :backtrace=\>["org/jruby/ext/socket/RubyUDPSocket.java:203:in `bind'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-udp-3.3.4/lib/logstash/inputs/udp.rb:116:in `udp\_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-udp-3.3.4/lib/logstash/inputs/udp.rb:68:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:314:in `inputworker'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:306:in `block in start\_input'"]}

I don't understand why it's speaking about the IP address.

thanks

---

<div class="post-metadata">

**Author:** ![lgllrd](https://avatars.discourse-cdn.com/v4/letter/l/e8c25b/32.png) [@lgllrd](https://discuss.elastic.co/u/lgllrd)\
**Post date:** [November 6, 2019, 2:31pm UTC](https://discuss.elastic.co/t/514-port-or-ip-address-i-dont-understand/206744/2 "2019-11-06T14:31:16Z")

</div>

EDIT : It's because of rsyslog wich is listening too on the 514 port

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 4, 2019, 2:31pm UTC](https://discuss.elastic.co/t/514-port-or-ip-address-i-dont-understand/206744/3 "2019-12-04T14:31:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.