### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [June 9, 2021, 2:20pm UTC](https://discuss.elastic.co/t/syslog-kills-process-in-logstash/275319/4 "2021-06-09T14:20:03Z")
So, your `syslog` input is not working, and not your syslog server that is killing the logstash process.
Your problem is this: `#`
You are trying to bind the syslog input to the port `514`, only the `root` user can run a process that bind to low ports, below 1024, but it is not recommended to run logstash as `root`.
You need to choose a port higher than `514`, try to use `5514` for example.
If you have devices that can only send data to the port `514`, then it is recommended that you use this port in the `rsyslog` server in your machine and redirect it to the logstash listening port.
---
### Author:  [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)
#### Post date: [June 9, 2021, 2:41pm UTC](https://discuss.elastic.co/t/syslog-kills-process-in-logstash/275319/5 "2021-06-09T14:41:06Z")
ok, I understand, I will try and let you know, thank you very much.
---
### Author:  [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)
#### Post date: [June 9, 2021, 3:00pm UTC](https://discuss.elastic.co/t/syslog-kills-process-in-logstash/275319/6 "2021-06-09T15:00:19Z")
I am looking about rsyslog and I have a question, I have to install the rsyslog agent and configure it with port 514, but how do I make it redirect to logstash in the syslog file that I already have?
---
### Author:  [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)
#### Post date: [June 9, 2021, 3:38pm UTC](https://discuss.elastic.co/t/syslog-kills-process-in-logstash/275319/7 "2021-06-09T15:38:33Z")
i have the configuration in the rsyslog.conf so:
```auto
# /etc/rsyslog.conf configuration file for rsyslog
#
# For more information install rsyslog-doc and see
# /usr/share/doc/rsyslog-doc/html/configuration/index.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf
#################
#### MODULES ####
#################
module(load="imuxsock") # provides support for local system logging
#module(load="immark") # provides --MARK-- message capability
# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")
# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")
# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")
```
---
### Author:  [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)
#### Post date: [June 9, 2021, 3:40pm UTC](https://discuss.elastic.co/t/syslog-kills-process-in-logstash/275319/8 "2021-06-09T15:40:33Z")
I have the tcp and udp modules active on port 514, but how do I redirect to logstash in my syslog file?
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [June 9, 2021, 3:50pm UTC](https://discuss.elastic.co/t/syslog-kills-process-in-logstash/275319/9 "2021-06-09T15:50:58Z")
First you need to check if you really need to use rsyslog, maybe you do not even need it.
What is going to send logs to this syslog input in logstash? Network devices? Servers?
Check if you can configure the port to where the logs would be shipped, if it is possible, just use the port you set in your logstash input.
You would only need to use rsyslog listening in `514` if you have some old device where the syslog port is hardcoded to `514`, if this is the case then you need it and you can redirect the logs to logstash.
This rsyslog question is out of the scope of this forum, I recommend that you read the [rsyslog documentation](https://www.rsyslog.com/sending-messages-to-a-remote-syslog-server/) that explains how to redirect to remote, which in your case would just be the same IP with a different port.
There are plenty of resources about rsyslog in the internet, the documentation is a pretty good start.
---
### Author:  [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)
#### Post date: [June 9, 2021, 3:58pm UTC](https://discuss.elastic.co/t/syslog-kills-process-in-logstash/275319/10 "2021-06-09T15:58:33Z")
yes, I am monitoring network devices (SWITCHES), and they go only on port 514 so I need this resource, and send emergency or device error messages.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 7, 2021, 3:59pm UTC](https://discuss.elastic.co/t/syslog-kills-process-in-logstash/275319/11 "2021-07-07T15:59:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.