# Error in gathering syslogs from router

**URL:** https://discuss.elastic.co/t/error-in-gathering-syslogs-from-router/228781
**Category:** Logstash
**Created:** [April 20, 2020, 4:45am UTC](https://discuss.elastic.co/t/error-in-gathering-syslogs-from-router/228781 "2020-04-20T04:45:40Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Hari\_Krishna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hari_krishna/32/62678_2.png) [@Hari\_Krishna](https://discuss.elastic.co/u/Hari_Krishna)
#### Post date: [April 20, 2020, 4:45am UTC](https://discuss.elastic.co/t/error-in-gathering-syslogs-from-router/228781/1 "2020-04-20T04:45:40Z")

</div>

```
  input {
    syslog {
        host => "10.216.123.213"
        type => "syslog"
      }
    }

```

exception=\>#\<Errno::EADDRNOTAVAIL: Cannot assign requested address - bind - Cannot assign requested address\>, :backtrace=\>["org/jruby/2.5.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:149:in `udp_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:130:in `server'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:110:in `block in run'  
exception=\>#\<Errno::EACCES: Permission denied

---

<div class="post-metadata">

### Author: ![mdt](https://avatars.discourse-cdn.com/v4/letter/m/e9c0ed/32.png) [@mdt](https://discuss.elastic.co/u/mdt)
#### Post date: [April 20, 2020, 5:56am UTC](https://discuss.elastic.co/t/error-in-gathering-syslogs-from-router/228781/2 "2020-04-20T05:56:22Z")

</div>

I'm pretty sure this is because the default port for syslog is UDP/514 and you are running Logstash as a non-privileged user. What we do is set up a non-standard port, like 10514, and send syslog traffic to that. Just add

`port => 10514`

and of course, modify the systems sending the logs so that they send to that port, and possibly add firewall rules on the Logstash system to allow inbound traffic to UDP/10514 from your sending systems.

I'm not sure if there is a way to start Logstash so that it starts up privileged, binds to a privileged port like 514, then releases its privileges.

---

<div class="post-metadata">

### Author: ![Hari\_Krishna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hari_krishna/32/62678_2.png) [@Hari\_Krishna](https://discuss.elastic.co/u/Hari_Krishna)
#### Post date: [April 20, 2020, 6:21am UTC](https://discuss.elastic.co/t/error-in-gathering-syslogs-from-router/228781/3 "2020-04-20T06:21:47Z")

</div>

Hi,

```
input {
    syslog {
            host => "10.216.131.209"
            type => "syslog"
            port => 10514
          }
    }

```

I set the port number to 10514 but it still gives me the following warning

```
Apr 11 15:09:29 hari-VirtualBox logstash[20457]: [2020-04-11T15:09:29,496][INFO][logstash.inputs.syslog][main] Starting syslog tcp listener {:address=>"10.216.131.209:10514"}
Apr 11 15:09:29 hari-VirtualBox logstash[20457]: [2020-04-11T15:09:29,499][WARN][logstash.inputs.syslog][main] syslog listener died {:protocol=>:tcp, :address=>"10.216.131.209:10514", :exception=>#<Errno::EADDRNOTAVAIL: Cannot assign requested address - bind - Cannot assign requested address>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:127:in `initialize'", "org/jruby/RubyIO.java:878:in `new'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:167:in `tcp_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:130:in `server'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:114:in `block in run'"]}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 18, 2020, 6:21am UTC](https://discuss.elastic.co/t/error-in-gathering-syslogs-from-router/228781/4 "2020-05-18T06:21:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.