# Problems starting logstash (snmptrap)

**URL:** https://discuss.elastic.co/t/problems-starting-logstash-snmptrap/319230
**Category:** Logstash
**Created:** [November 17, 2022, 5:25pm UTC](https://discuss.elastic.co/t/problems-starting-logstash-snmptrap/319230 "2022-11-17T17:25:56Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![sharbich](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@sharbich](https://discuss.elastic.co/u/sharbich)
#### Post date: [November 17, 2022, 5:25pm UTC](https://discuss.elastic.co/t/problems-starting-logstash-snmptrap/319230/1 "2022-11-17T17:25:56Z")

</div>

Hello,  
I have a problem starting logstash.  
If I start logstash via "systemctl start logstash.service" I get the following error message:

```auto
[2022-11-17T18:11:59,947][WARN][logstash.inputs.snmptrap][main][eed358a3fbc6028b0f3e6330ddca60ef9da803f3401328b89fa1f198705010a9] SNMP Trap listener died {:exception=>#<Errno::EADDRINUSE: Address already in use - bind - Keine Berechtigungbind(2) for "192.168.150.21" port 162>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:200:in `bind'", "/usr/share/logstash/vendor/bundle/jruby/2.6.0/gems/snmp-1.3.2/lib/snmp/manager.rb:544:in `initialize'", "org/jruby/RubyClass.java:911:in `new'", "/usr/share/logstash/vendor/bundle/jruby/2.6.0/gems/snmp-1.3.2/lib/snmp/manager.rb:590:in `create_transport'", "/usr/share/logstash/vendor/bundle/jruby/2.6.0/gems/snmp-1.3.2/lib/snmp/manager.rb:622:in `initialize'", "org/jruby/RubyClass.java:911:in `new'", "/usr/share/logstash/vendor/bundle/jruby/2.6.0/gems/logstash-input-snmptrap-3.1.0/lib/logstash/inputs/snmptrap.rb:95:in `build_trap_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.6.0/gems/logstash-input-snmptrap-3.1.0/lib/logstash/inputs/snmptrap.rb:99:in `snmptrap_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.6.0/gems/logstash-input-snmptrap-3.1.0/lib/logstash/inputs/snmptrap.rb:74:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:410:in `inputworker'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:401:in `block in start_input'"]}

```

If I start logstash like this "/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/02-snmp.conf" I don't get an error message and I see that the server is listening on port 162.

```auto
[INFO] 2022-11-17 18:23:15.064 [[main]<snmptrap] snmptrap - It's a Trap! {:Port=>162, :Community=>["public"], :Host=>"192.168.150.21"}
[INFO] 2022-11-17 18:23:15.160 [Agent thread] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}

```

I just don't understand.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 17, 2022, 7:00pm UTC](https://discuss.elastic.co/t/problems-starting-logstash-snmptrap/319230/2 "2022-11-17T19:00:05Z")

</div>

When started as a service it is getting an error saying the address is already in use. If it does not do so when path.config points specifically to /etc/logstash/conf.d/02-snmp.conf then perhaps the service has path.config pointing to a directory and the directory contains more than one configuration file that has an snmp input. An 02-snmp.conf.backup perhaps.

---

<div class="post-metadata">

### Author: ![sharbich](https://avatars.discourse-cdn.com/v4/letter/s/5daacb/32.png) [@sharbich](https://discuss.elastic.co/u/sharbich)
#### Post date: [November 18, 2022, 1:33pm UTC](https://discuss.elastic.co/t/problems-starting-logstash-snmptrap/319230/3 "2022-11-18T13:33:47Z")

</div>

I got that. Please allow me a question: "How can I configure logtash to use both input entries?

```auto
root@dsme01:/etc/logstash/conf.d# cat 02-snmp.conf.old 
input {
  snmptrap {
    type => "snmptrap"
    host => "192.168.150.21"
    port => 162
  }
}...

```

and

```auto
input {
  beats {
    host => "logstash.intern.harnet.de"
    port => 5044
    client_inactivity_timeout => "600"
    ssl => true
    ssl_certificate => "/etc/logstash/config/certs/logstash.intern.example.com.crt"
    ssl_key => "/etc/logstash/config/certs/logstash.intern.exemple.com.pkcs8.key"
  }
}...

```

Without an error message that the address is already in use?

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [November 18, 2022, 3:14pm UTC](https://discuss.elastic.co/t/problems-starting-logstash-snmptrap/319230/4 "2022-11-18T15:14:32Z")

</div>

Maybe the error is a little misleading?

If you are running Logstash as a service, I'm not sure that it will be able to bind to port `162` as this is a reserved port.

It may work when you run in the cli as the root user because the root can bind to that port.

Make a little test, change the port `162` in the `snmptrap` input to `1620` and see if it works.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 16, 2022, 3:15pm UTC](https://discuss.elastic.co/t/problems-starting-logstash-snmptrap/319230/5 "2022-12-16T15:15:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.