SNMP Trap listener died Address already in use

Elastic Stack Logstash
1

HI
I'm encountering a problem with snmptrap input

using LS 5.2
this is my conf file:

input{
        snmptrap{
                port => "5042"
                type => "test"
                community => "Public"
                yamlmibdir => "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/data/ruby/snmp/mibs/"
        }
}

output{
        if [type] == "test"
        {
                elasticsearch {
                hosts => ["hosts"]
                         index => "index"
                         user => "user"
                         password => "pass"
                         document_type => "doctype"
                }
        }
}

i keep getting the error:
SNMP Trap listener died {:exception=>#<Errno::EADDRINUSE: Address already in use - bind - Address already in use>,

and no data is coming in
any suggestions ?

2

Something else is already listening on port 5042?

3

Hi thanks for your reply
No , nothing is listening on this port
Checked that with netstat

4

Where is your configuration file stored? /etc/logstash/conf.d? What else is in that directory?

5

Hi
the conf file is in /tmp directory
currently i'm running this configuration with a logstash instance (not through the service)
Do you think this could be port related? shouldn't the error be "the port is already in use" rather then "the address is already in use" ?

6

BTW
it doesn't matter what i put in the port or host (even if i # both) i get the same errors.
looks like this:

 09:23:27.601 [[main]<snmptrap] INFO  logstash.inputs.snmptrap - It's a Trap! {:Port=>612, :Community=>["CEPublic"], :Host=>"127.0.0.1", :MibDir=>"/usr/share/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/data/ruby/snmp/mibs/", :MibModules=>["DOCS-BPI-MIB", "ACCOUNTING-CONTROL-MIB", "DOCS-CABLE-DEVICE-MIB", "ADSL-LINE-EXT-MIB", "FCIP-MGMT-MIB", "ADSL-LINE-MIB", "FDDI-SMT73-MIB", "ADSL-TC-MIB", "FIBRE-CHANNEL-FE-MIB", "ADSL2-LINE-MIB", "DOCS-IETF-BPI2-MIB", "ADSL2-LINE-TC-MIB", "FLOW-METER-MIB", "AGENTX-MIB", "FR-MFR-MIB", "AGGREGATE-MIB", "FRAME-RELAY-DTE-MIB", "ALARM-MIB", "FRNETSERV-MIB", "APM-MIB", "FRSLD-MIB", "APPC-MIB", "Finisher-MIB", "APPLETALK-MIB", "DOT3-OAM-MIB", "APPLICATION-MIB", "GMPLS-LABEL-STD-MIB", "APPN-DLUR-MIB", "GMPLS-LSR-STD-MIB", "APPN-MIB", "GMPLS-TC-STD-MIB", "APPN-TRAP-MIB", "GMPLS-TE-STD-MIB", "APS-MIB", "GSMP-MIB", "ARC-MIB", "DOT12-IF-MIB", "IP-MIB", "ATM-ACCOUNTING-INFORMATION-MIB", "HC-ALARM-MIB", "ATM-MIB", "HC-PerfHist-TC-MIB", "ATM-TC-MIB", "HC-RMON-MIB", "ATM2-MIB", "HCNUM-TC", "BGP4-MIB", "HDSL2-SHDSL-LINE-MIB", "BLDG-HVAC-MIB", "HOST-RESOURCES-MIB", "BRIDGE-MIB", "HOST-RESOURCES-TYPES", "CHARACTER-MIB", "HPR-IP-MIB", "CIRCUIT-IF-MIB", "HPR-MIB", "CLNS-MIB", "IANA-ITU-ALARM-TC-MIB", "COFFEE-POT-MIB", "DS0-MIB", "LMP-MIB", "COPS-CLIENT-MIB", "DS0BUNDLE-MIB", "DECNET-PHIV-MIB", "DS1-MIB", "MAU-MIB", "DIAL-CONTROL-MIB", "DS3-MIB", "MIP-MIB", "DIFFSERV-CONFIG-MIB", "DSA-MIB", "MTA-MIB", "DIFFSERV-DSCP-TC", "IF-CAP-STACK-MIB", "DIFFSERV-MIB", "DSMON-MIB", "DIRECTORY-SERVER-MIB", "EBN-MIB", "NAT-MIB", "DISMAN-EVENT-MIB", "EFM-CU-MIB", "DISMAN-EXPRESSION-MIB", "ENTITY-MIB", "DISMAN-NSLOOKUP-MIB", "ENTITY-SENSOR-MIB", "DISMAN-PING-MIB", "ENTITY-STATE-MIB", "DISMAN-SCHEDULE-MIB", "ENTITY-STATE-TC-MIB", "DISMAN-SCRIPT-MIB", "ETHER-CHIPSET-MIB", "DISMAN-TRACEROUTE-MIB", "IF-INVERTED-STACK-MIB", "DLSW-MIB", "ETHER-WIS", "DNS-RESOLVER-MIB", "IF-MIB", "DNS-SERVER-MIB", "INET-ADDRESS-MIB", "IGMP-STD-MIB", "DOCS-IETF-CABLE-DEVICE-NOTIFICATION-MIB", "EtherLike-MIB", "DOCS-IETF-QOS-MIB", "FC-MGMT-MIB", "DOCS-IETF-SUBMGT-MIB", "IFCP-MGMT-MIB", "DOCS-IF-MIB", "DOT3-EPON-MIB", "PIM-MIB", "FR-ATM-PVC-SERVICE-IWF-MIB", "PARALLEL-MIB", "SIP-UA-MIB", "INTEGRATED-SERVICES-GUARANTEED-MIB", "PIM-STD-MIB", "TCP-MIB", "INTEGRATED-SERVICES-MIB", "PKTC-IETF-SIG-MIB", "INTERFACETOPN-MIB", "RAQMON-MIB", "IP-FORWARD-MIB", "RDBMS-MIB", "IPATM-IPMC-MIB", "RFC1065-SMI", "IPMCAST-MIB", "POLICY-BASED-MANAGEMENT-MIB", "IPMROUTE-STD-MIB", "RFC1155-SMI", "IPOA-MIB", "RFC1158-MIB", "IPS-AUTH-MIB", "RFC1213-MIB", "IPSEC-SPD-MIB", "POWER-ETHERNET-MIB", "IPV6-FLOW-LABEL-MIB", "RFC1269-MIB", "IPV6-ICMP-MIB", "RFC1271-MIB", "IPV6-MIB", "RFC1285-MIB", "IPV6-MLD-MIB", "RFC1316-MIB", "IPV6-TCP-MIB", "RFC1381-MIB", "IPV6-UDP-MIB", "RFC1382-MIB", "ISCSI-MIB", "RFC1414-MIB", "ISDN-MIB", "RIPv2-MIB", "ISIS-MIB", "RMON-MIB", "ISNS-MIB", "RMON2-MIB", "ITU-ALARM-MIB", "PPP-BRIDGE-NCP-MIB", "ITU-ALARM-TC-MIB", "PPP-IP-NCP-MIB", "Job-Monitoring-MIB", "ROHC-MIB", "L2TP-MIB", "ROHC-RTP-MIB", "LANGTAG-TC-MIB", "ROHC-UNCOMPRESSED-MIB", "MALLOC-MIB", "RS-232-MIB", "MIDCOM-MIB", "RSTP-MIB", "MIOX25-MIB", "RSVP-MIB", "MOBILEIPV6-MIB", "PPP-LCP-MIB", "MPLS-FTN-STD-MIB", "PPP-SEC-MIB", "MPLS-L3VPN-STD-MIB", "PTOPO-MIB", "MPLS-LC-ATM-STD-MIB", "PerfHist-TC-MIB", "MPLS-LC-FR-STD-MIB", "Printer-MIB", "MPLS-LDP-ATM-STD-MIB", "PINT-MIB", "TE-MIB", "MPLS-LDP-FRAME-RELAY-STD-MIB", "PKTC-IETF-MTA-MIB", "MPLS-LDP-GENERIC-STD-MIB", "Q-BRIDGE-MIB", "MPLS-LDP-STD-MIB", "RADIUS-ACC-CLIENT-MIB", "MPLS-LSR-STD-MIB", "RADIUS-ACC-SERVER-MIB", "MPLS-TC-STD-MIB", "RADIUS-AUTH-CLIENT-MIB", "MPLS-TE-STD-MIB", "RTP-MIB", "MSDP-MIB", "SCSI-MIB", "Modem-MIB", "RADIUS-AUTH-SERVER-MIB", "NETWORK-SERVICES-MIB", "SCTP-MIB", "NHRP-MIB", "RADIUS-DYNAUTH-CLIENT-MIB", "NOTIFICATION-LOG-MIB", "SFLOW-MIB", "OPT-IF-MIB", "SIP-COMMON-MIB", "OSPF-MIB", "SIP-MIB", "OSPF-TRAP-MIB", "SIP-SERVER-MIB", "P-BRIDGE-MIB", "SNMP-COMMUNITY-MIB", "SIP-TC-MIB", "RADIUS-DYNAUTH-SERVER-MIB", "SLAPM-MIB", "SMON-MIB", "SNA-NAU-MIB", "SNA-SDLC-MIB", "SNMP-FRAMEWORK-MIB", "SNMP-MPD-MIB", "SNMP-NOTIFICATION-MIB", "SNMP-PROXY-MIB", "SNMP-REPEATER-MIB", "SNMP-TARGET-MIB", "SNMP-USER-BASED-SM-MIB", "SNMP-USM-AES-MIB", "VDSL-LINE-EXT-SCM-MIB", "SNMP-USM-DH-OBJECTS-MIB", "VDSL-LINE-MIB", "SNMP-VIEW-BASED-ACM-MIB", "SNMPv2-MIB", "SNMPv2-SMI", "SNMPv2-TM", "SNMPv2-USEC-MIB", "SONET-MIB", "SOURCE-ROUTING-MIB", "SSPM-MIB", "SYSAPPL-MIB", "VPN-TC-STD-MIB", "T11-FC-FABRIC-ADDR-MGR-MIB", "Q1LABS-MIB", "T11-FC-FABRIC-CONFIG-SERVER-MIB", "T11-FC-FABRIC-LOCK-MIB", "T11-FC-FSPF-MIB", "T11-FC-NAME-SERVER-MIB", "T11-FC-ROUTE-MIB", "T11-FC-RSCN-MIB", "VRRP-MIB", "T11-FC-VIRTUAL-FABRIC-MIB", "T11-FC-ZONE-SERVER-MIB", "T11-TC-MIB", "TCP-ESTATS-MIB", "TCPIPX-MIB", "TE-LINK-STD-MIB", "TIME-AGGREGATE-MIB", "TN3270E-MIB", "TN3270E-RT-MIB", "TOKEN-RING-RMON-MIB", "TOKENRING-MIB", "WWW-MIB", "TOKENRING-STATION-SR-MIB", "TRANSPORT-ADDRESS-MIB", "TRIP-MIB", "TRIP-TC-MIB", "TUNNEL-MIB", "UCD-SNMP-MIB", "UDP-MIB", "UDPLITE-MIB", "UPS-MIB", "URI-TC-MIB", "VDSL-LINE-EXT-MCM-MIB"]}
09:23:27.603 [[main]<snmptrap] WARN  logstash.inputs.snmptrap - SNMP Trap listener died {:exception=>#<Errno::EADDRINUSE: Address already in use - bind - Address already in use>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:161:in `bind'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/lib/snmp/manager.rb:540:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/lib/snmp/manager.rb:585:in `create_transport'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0/lib/snmp/manager.rb:618:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-snmptrap-3.0.3/lib/logstash/inputs/snmptrap.rb:75:in `build_trap_listener'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-snmptrap-3.0.3/lib/logstash/inputs/snmptrap.rb:79:in `snmptrap_listener'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-snmptrap-3.0.3/lib/logstash/inputs/snmptrap.rb:54:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:456:in `inputworker'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:449:in `start_input'"]}
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.