# UDP listener died **URL:** \ **Category:** Logstash\ **Created:** [June 28, 2015, 12:11am UTC](https://discuss.elastic.co/t/udp-listener-died/24489 "2015-06-28T00:11:04Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![nzHillNet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nzhillnet/32/3423_2.png) [@nzHillNet](https://discuss.elastic.co/u/nzHillNet)\ **Post date:** [June 28, 2015, 12:11am UTC](https://discuss.elastic.co/t/udp-listener-died/24489/1 "2015-06-28T00:11:04Z")
Hi, Logstash version 1.5.1, Elasticsearch vesion 1.6 My ddwrt based switches can only send logs over UDP port 514. I cannot get this to work, and continually get the following error: ``` {:timestamp=>"2015-06-28T11:56:22.898000+1200", :message=>"UDP listener died", :exception=>#, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:160:in `bind'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-0.1.4/lib/logstash/inputs/udp.rb:68:in `udp_listener'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-0.1.4/lib/logstash/inputs/udp.rb:49:in `run'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/pipeline.rb:176:in `inputworker'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/pipeline.rb:170:in `start_input'"], :level=>:warn} ``` At first I did have the port already in use, but that is not the case now: ``` netstat -an|grep 514 tcp 0 0 192.168.0.10:1514 0.0.0.0:* LISTEN tcp 0 0 192.168.0.10:1514 192.168.0.10:46149 ESTABLISHED tcp 0 0 192.168.0.10:46149 192.168.0.10:1514 ESTABLISHED unix 3 [] STREAM CONNECTED 16514 ``` My logstash input statement is simply: ``` input { tcp { host => "hillnet" port => 1514 type => "syslog" } tcp { host => "hillnet" port => 1515 type => "synology" } udp { port => 514 type => "ddwrt" } } ``` I have googled, but cannot find an answer. Any help would be appreciated. ---
**Author:** ![eperry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eperry/32/551_2.png) [@eperry](https://discuss.elastic.co/u/eperry)\ **Post date:** [June 28, 2015, 8:26pm UTC](https://discuss.elastic.co/t/udp-listener-died/24489/2 "2015-06-28T20:26:23Z")
Just to cover the basics - You need to start logstash as root as 514 is a protected port (/etc/sysconfig/logstash LS\_USER=root) - try netstat -nlu to see udp ports listening (though your command would probably be sufficient) - Even though the host option is optional try setting it ---
**Author:** ![nzHillNet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nzhillnet/32/3423_2.png) [@nzHillNet](https://discuss.elastic.co/u/nzHillNet)\ **Post date:** [June 29, 2015, 8:40am UTC](https://discuss.elastic.co/t/udp-listener-died/24489/3 "2015-06-29T08:40:57Z")
Hi, Perfect, it was the protected port issue......I had read about that but for some reason didn't "connect the dots". Really appreciate the quick, accurate, advice. -- Roland ---
**Author:** ![ichandan16](https://avatars.discourse-cdn.com/v4/letter/i/ad7895/32.png) [@ichandan16](https://discuss.elastic.co/u/ichandan16)\ **Post date:** [January 29, 2016, 12:39pm UTC](https://discuss.elastic.co/t/udp-listener-died/24489/4 "2016-01-29T12:39:18Z")
I am running on udp port 5000. But while starting, I am getting following error: UDP listener died {:exception=\>#\, :backtrace=\>["/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-0.1.4/lib/logstash/inputs/udp.rb:79:in `udp_listener'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-0.1.4/lib/logstash/inputs/udp.rb:49:in`run'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/pipeline.rb:176:in `inputworker'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/pipeline.rb:170:in`start\_input'"], :level=\>:warn} ---
**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\ **Post date:** [January 29, 2016, 10:43pm UTC](https://discuss.elastic.co/t/udp-listener-died/24489/5 "2016-01-29T22:43:49Z")
That is a very old logstash. Have you tried this with logstash 2.1? ---
**Author:** ![qwertz](https://avatars.discourse-cdn.com/v4/letter/q/71e660/32.png) [@qwertz](https://discuss.elastic.co/u/qwertz)\ **Post date:** [February 1, 2016, 11:32am UTC](https://discuss.elastic.co/t/udp-listener-died/24489/6 "2016-02-01T11:32:29Z")
I have the same issue with logstash 2.1 with port 5000 ``` {:timestamp=>"2016-02-01T12:29:57.766000+0100", :message=>"syslog listener died", :protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:124:in `initialize'", "org/jruby/RubyIO.java:853:in `new'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-in put-syslog-2.0.2/lib/logstash/inputs/syslog.rb:152:in `tcp_listener'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.2/lib/logstash/inputs/syslog.rb:117 :in `server'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.2/lib/logstash/inputs/syslog.rb:101:in `run'"], :level=>:warn} ``` When i start logstash i have so many sock created (about 1 per second) I have search all post in google, [elastic.co](http://elastic.co) but never fixed When i make ps -ax | grep log\* ``` 710 pts/1 SNl 0:51 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyO nly -XX:+HeapDumpOnOutOfMemoryError -Djava.io.tmpdir=/var/lib/logstash -Xmx500m -Xss2048k -Djffi.boot.library.path=/opt/logstash/vendor/jruby/lib/jni -XX:+UseParNewGC -XX:+UseC oncMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+HeapDumpOnOutOfMemoryError -Djava.io.tmpdir=/var/lib/logst ash -XX:HeapDumpPath=/opt/logstash/heapdump.hprof -Xbootclasspath/a:/opt/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/opt/logstash/vendor/jruby -Djruby.lib=/o pt/logstash/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main --1.9 /opt/logstash/lib/bootstrap/environment.rb logstash/runner.rb agent -f /etc/logstas ``` Maybe a leak memory or something like this ? When i change my port it's ok but logstash listen on 2 port and i get the same information two times ! ---
**Author:** ![qwertz](https://avatars.discourse-cdn.com/v4/letter/q/71e660/32.png) [@qwertz](https://discuss.elastic.co/u/qwertz)\ **Post date:** [February 15, 2016, 10:34pm UTC](https://discuss.elastic.co/t/udp-listener-died/24489/7 "2016-02-15T22:34:54Z")
If you have a same issue verifiy you have not save a backup configuration in the same folder (even different name and extension !!) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:11am UTC](https://discuss.elastic.co/t/udp-listener-died/24489/8 "2017-07-06T05:11:19Z")