, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:133:in `initialize'", "org/jruby/RubyIO.java:878:in `new'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:167:in `tcp_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:130:in `server'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:114:in `block in run'"]}
```
---
### Author:  [@ptamba](https://discuss.elastic.co/u/ptamba)
#### Post date: [May 5, 2020, 9:31am UTC](https://discuss.elastic.co/t/permission-denied-error-while-collecting-logs-from-external-ip/231112/2 "2020-05-05T09:31:59Z")
you need root permission to bind to port number lower than 1024. i suppose you run logstash with logstash user ?
---
### Author:  [@Hari\_Krishna](https://discuss.elastic.co/u/Hari_Krishna)
#### Post date: [May 5, 2020, 9:42am UTC](https://discuss.elastic.co/t/permission-denied-error-while-collecting-logs-from-external-ip/231112/3 "2020-05-05T09:42:14Z")
So should i change the port number?
Sorry,I am new to networking ๐
How do i know if the logs are actually coming to the particular IP i have configured?
---
### Author:  [@ptamba](https://discuss.elastic.co/u/ptamba)
#### Post date: [May 5, 2020, 9:44am UTC](https://discuss.elastic.co/t/permission-denied-error-while-collecting-logs-from-external-ip/231112/4 "2020-05-05T09:44:39Z")
yes, change the port number higher than 1024, then configure your device to send the log to the port.
you can use tcpdump to check whether the log is coming
---
### Author:  [@Hari\_Krishna](https://discuss.elastic.co/u/Hari_Krishna)
#### Post date: [May 5, 2020, 9:53am UTC](https://discuss.elastic.co/t/permission-denied-error-while-collecting-logs-from-external-ip/231112/5 "2020-05-05T09:53:08Z")
Hi,
I configured the router to send logs via port 31320.
Now when i run tcpdump in the server where logstash is running i get this.
```
15:20:00.973235 IP 10.216.131.17.514 > 10.216.133.193.514: SYSLOG cron.info, length: 84
15:20:00.973282 IP 10.216.133.193 > 10.216.131.17: ICMP 10.216.133.193 udp port 514 unreachable, length 120
15:20:00.973326 IP 10.216.131.17.514 > 10.216.133.193.514: SYSLOG cron.info, length: 84
15:20:00.973334 IP 10.216.133.193 > 10.216.131.17: ICMP 10.216.133.193 udp port 514 unreachable, length 120
```
---
### Author:  [@ptamba](https://discuss.elastic.co/u/ptamba)
#### Post date: [May 5, 2020, 9:56am UTC](https://discuss.elastic.co/t/permission-denied-error-while-collecting-logs-from-external-ip/231112/6 "2020-05-05T09:56:40Z")
have you run logstash on port 31320 as well?
---
### Author:  [@Hari\_Krishna](https://discuss.elastic.co/u/Hari_Krishna)
#### Post date: [May 5, 2020, 9:57am UTC](https://discuss.elastic.co/t/permission-denied-error-while-collecting-logs-from-external-ip/231112/7 "2020-05-05T09:57:12Z")
Yeah i changed in the logstash too.
But this has nothing to do with logstash right?
The logs are not coming to that IP
---
### Author:  [@ptamba](https://discuss.elastic.co/u/ptamba)
#### Post date: [May 5, 2020, 9:59am UTC](https://discuss.elastic.co/t/permission-denied-error-while-collecting-logs-from-external-ip/231112/8 "2020-05-05T09:59:09Z")
of your config is correct, you can try to dump the logstash output to stdout. if not you will need to work out the syslog portion first
---
### Author:  [@Hari\_Krishna](https://discuss.elastic.co/u/Hari_Krishna)
#### Post date: [May 7, 2020, 6:55am UTC](https://discuss.elastic.co/t/permission-denied-error-while-collecting-logs-from-external-ip/231112/9 "2020-05-07T06:55:41Z")
Hi,
can i run logstash as root?
So that i can listen to port 514
---
### Author:  [@ptamba](https://discuss.elastic.co/u/ptamba)
#### Post date: [May 7, 2020, 7:35am UTC](https://discuss.elastic.co/t/permission-denied-error-while-collecting-logs-from-external-ip/231112/10 "2020-05-07T07:35:24Z")
you can, though itโs generally not recommended. should there is vuln in logstash, exploiting the vuln will give the attacker root privileges.
if you have to use port 514, there are a couple of alternatives. you could run standard syslog on that forward and forward, have logstash listen on another port, then use syslog forwarding to forward incoming packets to your logstash instance. you can also use iptables for forwarding. there is also a utility called authbind that allows low privileged user to bind to privileged ports.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 4, 2020, 7:35am UTC](https://discuss.elastic.co/t/permission-denied-error-while-collecting-logs-from-external-ip/231112/11 "2020-06-04T07:35:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.