Hi, thanks for your reply. This sounds like the same problem. We used the graylog Ova which is based on Ubuntu.
I am surprised an update would just break it like that. On Wednesday, December 16, 2015 at 6:16:30 PM UTC, Joi Owen wrote: > > You don't say what distro you're using. I know on Ubuntu, the older > graylog package ran the graylog processes as user root, so it had the privs > required to open a system standard port and listen on 514. The current > Ubuntu package creates a non-root 'graylog' user, and that user lacks the > privs to open 514. This caused us issues when we upgraded our graylog host > because the package design change was not documented, as I recall. > > If your host is already running rsyslog/syslog-ng, and that configuration > is already using 514, then you need to specifically tell rsyslog not to > open lo with a UDP listener. I did this for rsyslog, for example, one my > host here. (We ended up getting around the graylog-can't-open-514 issue by > creating a port redirect rule in iptables, so everything sent to 514 is > quietly moved to port 10514 where graylog can pick it up with its own input. > > I don't know if I answered your question, but I hope it helps. > > > On Wed, Dec 16, 2015 at 4:50 AM, greeneggs <[email protected] > <javascript:>> wrote: > >> Hi, >> >> I just updated from 1.1 to the latest 1.31 and now port 514 is taken by >> system. >> I stopped the system logging and restarted the external input as a quick >> work around as it is a production system., >> >> From googling around I have seen solutions that are a bit old and say to >> change the system logging port away from 514. >> >> I also upgraded a non configured, non production VM and I got the same >> issue. >> >> This doesn't seem like something that should be caused by an update ? >> >> thanks >> >> Ian >> >> >> This is after I stopped the system logging: >> >> >> -- >> You received this message because you are subscribed to the Google Groups >> "Graylog Users" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected] <javascript:>. >> To view this discussion on the web visit >> https://groups.google.com/d/msgid/graylog2/4876d278-6a6a-47be-a715-19f8350b725a%40googlegroups.com >> >> <https://groups.google.com/d/msgid/graylog2/4876d278-6a6a-47be-a715-19f8350b725a%40googlegroups.com?utm_medium=email&utm_source=footer> >> . >> For more options, visit https://groups.google.com/d/optout. >> > > > > -- > > No matter what we think of Linux versus FreeBSD, etc., the one thing I > really like about Linux is that it has Microsoft worried. Anything > that kicks a monopoly in the pants has got to be good for something. > - Chris Johnson > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/82d778a7-561a-45dd-9bbe-58709a7ab02b%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
