# Relp error: Relp::InappropriateCommand open expecting syslog
**URL:** https://discuss.elastic.co/t/relp-error-relp-inappropriatecommand-open-expecting-syslog/345125
**Category:** Logstash
**Created:** [October 16, 2023, 3:56pm UTC](https://discuss.elastic.co/t/relp-error-relp-inappropriatecommand-open-expecting-syslog/345125 "2023-10-16T15:56:45Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@MarcoV](https://discuss.elastic.co/u/MarcoV)
#### Post date: [October 16, 2023, 3:56pm UTC](https://discuss.elastic.co/t/relp-error-relp-inappropriatecommand-open-expecting-syslog/345125/1 "2023-10-16T15:56:45Z")
Hello everyone.
I have this warning in my logstash log:
```auto
Relp error: Relp::InappropriateCommand open expecting syslog
```
My logstash configuration filter has input relp as input but with this error the log from syslog aren't parsed.
The firewall is off, the logs arrives from the logcollector (verified with tcpdump)... any idea about this error?
Thank you
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 16, 2023, 4:07pm UTC](https://discuss.elastic.co/t/relp-error-relp-inappropriatecommand-open-expecting-syslog/345125/2 "2023-10-16T16:07:57Z")
That exception is most likely being raised [here](https://github.com/logstash-plugins/logstash-input-relp/blob/cc874e603221f33afe67fab49e506a1fbd0e3c34/lib/logstash/util/relp.rb#L171). The relp input [accepts](https://github.com/logstash-plugins/logstash-input-relp/blob/cc874e603221f33afe67fab49e506a1fbd0e3c34/lib/logstash/inputs/relp.rb#L125) a socket connection and then [calls](https://github.com/logstash-plugins/logstash-input-relp/blob/cc874e603221f33afe67fab49e506a1fbd0e3c34/lib/logstash/inputs/relp.rb#L169) the method that throws the exception.
When a RELP client connects I believe it has to send an "open" command (to configure the session) before it can send a "syslog" command (to log a message). The state diagrams in librelp-1.1.0/doc/relp.html suggest that too.
The only code path I can see to get to that exception would be for the first command sent to the input to be "syslog", and that violates the protocol. You have tcpdump data, so what does the stream of commands after the socket is opened look like?
---
### Author:  [@MarcoV](https://discuss.elastic.co/u/MarcoV)
#### Post date: [October 17, 2023, 7:52am UTC](https://discuss.elastic.co/t/relp-error-relp-inappropriatecommand-open-expecting-syslog/345125/3 "2023-10-17T07:52:35Z")
Thank you for your response Badger. I solved just restarting rsyslog on log collector.
Thanks for your support.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 14, 2023, 7:53am UTC](https://discuss.elastic.co/t/relp-error-relp-inappropriatecommand-open-expecting-syslog/345125/4 "2023-11-14T07:53:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.