# Fleet integration for Barracauda Firewall logs **URL:** \ **Category:** Elastic Agent\ **Tags:** fleet, integrations\ **Created:** [December 8, 2023, 10:52am UTC](https://discuss.elastic.co/t/fleet-integration-for-barracauda-firewall-logs/348882 "2023-12-08T10:52:36Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![maadhav](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maadhav/32/46127_2.png) [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Post date:** [December 8, 2023, 10:52am UTC](https://discuss.elastic.co/t/fleet-integration-for-barracauda-firewall-logs/348882/1 "2023-12-08T10:52:36Z")
Hi Team We have configured Fleet server and added Elastic Agents. Output is configured using Logstash. Agent policy is added which contains system integration, its working fine and sending logs to logstash output. When we try to add Barracauda Cloudgen Firewall integration, integration gets added but its showing following error: ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/5/f5d9949cfaf6e290dd02bb688b6de0b3aab33549.png) Documentation suggests that it receives output via Lumberjack protocol. There are lumberjack plugins there for `logstash-input-lumberjack` and `logstash-output-lumberjack` . Do we need to install any of this plugin ? or it should be fixed any other way, please guide. Regards ---
**Author:** ![maadhav](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maadhav/32/46127_2.png) [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Post date:** [December 8, 2023, 12:26pm UTC](https://discuss.elastic.co/t/fleet-integration-for-barracauda-firewall-logs/348882/2 "2023-12-08T12:26:35Z")
Following are the logs from elastic agent log file for reference: > {"log.level":"error","@timestamp":"2023-12-08T07:09:38.411Z","log.origin":{"file.name":"coordinator/coordinator.go","file.line":857},"message":"Spawned new component lumberjack-default: input not supported","log":{"source":"elastic-agent"},"component":{"id":"lumberjack-default","state":"FAILED"},"ecs.version":"1.6.0"} > {"log.level":"error","@timestamp":"2023-12-08T07:09:38.411Z","log.origin":{"file.name":"coordinator/coordinator.go","file.line":857},"message":"Spawned new unit lumberjack-default-lumberjack-barracuda\_cloudgen\_firewall-542abf24-7edb-4c28-852a-b3454c5fa5a7: input not supported","log":{"source":"elastic-agent"},"component":{"id":"lumberjack-default","state":"FAILED"},"unit":{"id":"lumberjack-default-lumberjack-barracuda\_cloudgen\_firewall-542abf24-7edb-4c28-852a-b3454c5fa5a7","type":"input","state":"FAILED"},"ecs.version":"1.6.0"} > {"log.level":"error","@timestamp":"2023-12-08T07:09:38.411Z","log.origin":{"file.name":"coordinator/coordinator.go","file.line":857},"message":"Spawned new unit lumberjack-default: input not supported","log":{"source":"elastic-agent"},"component":{"id":"lumberjack-default","state":"FAILED"},"unit":{"id":"lumberjack-default","type":"output","state":"FAILED"},"ecs.version":"1.6.0"} ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [December 8, 2023, 3:12pm UTC](https://discuss.elastic.co/t/fleet-integration-for-barracauda-firewall-logs/348882/3 "2023-12-08T15:12:13Z")
What does your input configuration looks like? Please share how you configured the input of the Integration. ---
**Author:** ![maadhav](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maadhav/32/46127_2.png) [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Post date:** [December 8, 2023, 4:00pm UTC](https://discuss.elastic.co/t/fleet-integration-for-barracauda-firewall-logs/348882/4 "2023-12-08T16:00:20Z")
@leandrojmp Adding Barracauda Cloudgen Firewall integration required 2 inputs: Listen Address : 0.0.0.0 Listen Port: 5044 other parameters are kept as defaults. let me know if you are asking for any other configuration more details: output of ` elastic-agent status --output=json` contains following error: > ... > ... > { > "id": "lumberjack-default", > "name": "", > "state": 4, > "message": "input not supported", > "units": [ > { > "unit\_id": "lumberjack-default", > "unit\_type": 1, > "state": 4, > "message": "input not supported" > }, > { > "unit\_id": "lumberjack-default-lumberjack-barracuda\_cloudgen\_firewall-542abf24-7edb-4c28-852a-b3454c5fa5a7", > "unit\_type": 0, > "state": 4, > "message": "input not supported" > } > ], > "version\_info": { > "name": "", > "version": "" > } > }, > ... > ... ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [December 8, 2023, 4:03pm UTC](https://discuss.elastic.co/t/fleet-integration-for-barracauda-firewall-logs/348882/5 "2023-12-08T16:03:31Z")
> [@maadhav](#): > > Output is configured using Logstash. Agent policy is added which contains system integration, its working fine and sending logs to logstash output. Where is this Logstash running? On a different server of the Elastic Agent or in the same server? ---
**Author:** ![maadhav](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maadhav/32/46127_2.png) [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Post date:** [December 8, 2023, 4:31pm UTC](https://discuss.elastic.co/t/fleet-integration-for-barracauda-firewall-logs/348882/6 "2023-12-08T16:31:50Z")
@leandrojmp Logstash is running on a separate server. Elastic Agent is on a dedicated host. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [December 8, 2023, 4:36pm UTC](https://discuss.elastic.co/t/fleet-integration-for-barracauda-firewall-logs/348882/7 "2023-12-08T16:36:51Z")
Yeah, not sure what could be this issue, the only thing I could think of is that if the Agent could not bind to the IP port because there was something else using the port `5044` on the same server. Can you confirm that the port `5044` is not being used on the server that the Elastic Agent with the barracuda integration is running? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [December 8, 2023, 4:39pm UTC](https://discuss.elastic.co/t/fleet-integration-for-barracauda-firewall-logs/348882/8 "2023-12-08T16:39:03Z")
> [@maadhav](#): > > We have configured Fleet server and added Elastic Agents. Also, what is the version you are running? Looking on Github I found this [issue](https://github.com/elastic/integrations/issues/5912) that was fixed on 8.7.1 ---
**Author:** ![maadhav](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maadhav/32/46127_2.png) [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Post date:** [December 8, 2023, 5:12pm UTC](https://discuss.elastic.co/t/fleet-integration-for-barracauda-firewall-logs/348882/9 "2023-12-08T17:12:20Z")
Thanks @leandrojmp, we are using version 8.6.2 for fleet and elastic agent, and logstash is using version 8.7.0. Looks like we may need to update versions. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [December 8, 2023, 5:18pm UTC](https://discuss.elastic.co/t/fleet-integration-for-barracauda-firewall-logs/348882/10 "2023-12-08T17:18:05Z")
Yeah, it seems that the `lumberjack` input on Elastic Agent was removed between version 8.5.3 and 8.6.0 and added back on 8.7.1 according to this [issue](https://github.com/elastic/elastic-agent/pull/2511). I'm not sure you can run Elastic Agent on a minor version higher than the rest of the stack, so you will probably need to upgrade your entire stack, Elasticasearch, Kibana, Fleet and then the Agents. ---
**Author:** ![maadhav](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maadhav/32/46127_2.png) [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Post date:** [December 9, 2023, 5:46am UTC](https://discuss.elastic.co/t/fleet-integration-for-barracauda-firewall-logs/348882/11 "2023-12-09T05:46:04Z")
yes @leandrojmp, correct. we may need to update entire stack, thanks for your valuable inputs, really appreciate it. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 6, 2024, 5:47am UTC](https://discuss.elastic.co/t/fleet-integration-for-barracauda-firewall-logs/348882/12 "2024-01-06T05:47:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.