You don't say what distro you're using. I know on Ubuntu, the older graylog package ran the graylog processes as user root, so it had the privs required to open a system standard port and listen on 514. The current Ubuntu package creates a non-root 'graylog' user, and that user lacks the privs to open 514. This caused us issues when we upgraded our graylog host because the package design change was not documented, as I recall.
If your host is already running rsyslog/syslog-ng, and that configuration is already using 514, then you need to specifically tell rsyslog not to open lo with a UDP listener. I did this for rsyslog, for example, one my host here. (We ended up getting around the graylog-can't-open-514 issue by creating a port redirect rule in iptables, so everything sent to 514 is quietly moved to port 10514 where graylog can pick it up with its own input. I don't know if I answered your question, but I hope it helps. On Wed, Dec 16, 2015 at 4:50 AM, greeneggs <[email protected]> wrote: > Hi, > > I just updated from 1.1 to the latest 1.31 and now port 514 is taken by > system. > I stopped the system logging and restarted the external input as a quick > work around as it is a production system., > > From googling around I have seen solutions that are a bit old and say to > change the system logging port away from 514. > > I also upgraded a non configured, non production VM and I got the same > issue. > > This doesn't seem like something that should be caused by an update ? > > thanks > > Ian > > > This is after I stopped the system logging: > > > -- > You received this message because you are subscribed to the Google Groups > "Graylog Users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/graylog2/4876d278-6a6a-47be-a715-19f8350b725a%40googlegroups.com > <https://groups.google.com/d/msgid/graylog2/4876d278-6a6a-47be-a715-19f8350b725a%40googlegroups.com?utm_medium=email&utm_source=footer> > . > For more options, visit https://groups.google.com/d/optout. > -- No matter what we think of Linux versus FreeBSD, etc., the one thing I really like about Linux is that it has Microsoft worried. Anything that kicks a monopoly in the pants has got to be good for something. - Chris Johnson -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/CAL5rfGXuQfFRGjeMEj_TuCUU_E_evGp-MntT-CaTDa_vy%3DxFLQ%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
