EADDRINUSE error="Address already in use - bind(2) for \"0.0.0.0\" port 5044"

[Phillip_Groven]

I am setting up an EFK cluster and filebeats are not being received I believe the error is due to the following EADDRINUSE error="Address already in use - bind(2) for "0.0.0.0" port 5044"
when elasticserch and td-agent are stopped I dont see anything listening on port 5044
When running netstat -tupln | grep 5044 I see the following
tcp 0 0 0.0.0.0:5044 0.0.0.0:* LISTEN 17991/ruby

I have taken out everything in the conf file for port 5044 but I still see the error.
What is binding to port 5044?

[warkolm (Mark Walkom)]

You may need to use something like lsof to find that out.

[Phillip_Groven]

When td-agent is not running port 5044 is not in use
When td-agent is running I see the following
root@ip-172-20-72-161 ~]# lsof -i | grep 19475
ruby 19475 td-agent 10u IPv4 179788 0t0 TCP *:lxi-evntsvc (LISTEN)
ruby 19475 td-agent 11u IPv4 179789 0t0 TCP ip-172-18-72-161.us-west-2.compute.internal:24230 (LISTEN)
ruby 19475 td-agent 15u IPv4 179792 0t0 TCP ip-172-18-72-161.us-west-2.compute.internal:td-agent (LISTEN)
ruby 19475 td-agent 16u IPv4 170736 0t0 TCP ip-172-18-72-161.us-west-2.compute.internal:ddi-tcp-1 (LISTEN)
ruby 19475 td-agent 17u IPv4 179793 0t0 UDP ip-172-18-72-161.us-west-2.compute.internal:td-agent

[Phillip_Groven]

Sorry maybe my last post was not clear
When td-agent is running I see the following output
lsof -wni tcp:5044
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ruby 19641 td-agent 10u IPv4 176936 0t0 TCP *:lxi-evntsvc (LISTEN)

When it is not running I see no output