syslog-ng service not starting
I returned from being out of the office for week and realized something was "off" with syslog-ng. I was unable to restart the service. I did a 'service syslog-ng status' and it says it's stopped. When I try 'service syslog-ng start' I get the following error: Error binding socket; addr='AF_INET(0.0.0.0:443)', error='Address already in use (98)' Error initializing source driver; source='inputs', id='inputs#3' Error initializing message pipeline; There is only instance of syslog-ng installed on the server but I did a reboot to try and clear any conflicting settings, but I still get the same error. Can someone help me clear this error and get the service started again? Thanks, James McDonald System Administrator RHCSA, Security+ jmcdonald@lce.com
On Mon, Aug 6, 2012 at 5:00 PM, James McDonald <jmcdonald@lce.com> wrote:
I returned from being out of the office for week and realized something was “off” with syslog-ng. I was unable to restart the service. I did a ‘service syslog-ng status’ and it says it’s stopped. When I try ‘service syslog-ng start’ I get the following error:
Error binding socket; addr='AF_INET(0.0.0.0:443)', error='Address already in use (98)'
listening on port 443 is unusual for syslog, usually https servers are bound to it so you should check / update your config
There are other syslog-ng servers configured this way in our environments but I am only having problems with this particular one. Does anyone have any other suggestions? I tried rebooting to clear any connections and re-establish a new one, but I still get the error after a reboot. I tested restarting the service on another syslog-ng server and it worked fine. -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Sandor Geller Sent: Monday, August 06, 2012 11:13 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] syslog-ng service not starting On Mon, Aug 6, 2012 at 5:00 PM, James McDonald <jmcdonald@lce.com> wrote:
I returned from being out of the office for week and realized something was "off" with syslog-ng. I was unable to restart the service. I did a 'service syslog-ng status' and it says it's stopped. When I try 'service syslog-ng start' I get the following error:
Error binding socket; addr='AF_INET(0.0.0.0:443)', error='Address already in use (98)'
listening on port 443 is unusual for syslog, usually https servers are bound to it so you should check / update your config ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Something else is listening on port 443 and is "geting to the port first" sudo /usr/sbin/lsof | grep LISTEN | grep -w https you should get something like httpd 5196 apache 4u IPv4 19969357 0t0 TCP smew.comp.uvic.ca:https (LISTEN) That wil lbe the process that is "using" the port. If nothing shows up then a different process of trouble shooting will need to be taken. Evna. ________________________________________ From: syslog-ng-bounces@lists.balabit.hu [syslog-ng-bounces@lists.balabit.hu] On Behalf Of James McDonald [jmcdonald@LCE.com] Sent: Monday, August 06, 2012 8:33 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] syslog-ng service not starting There are other syslog-ng servers configured this way in our environments but I am only having problems with this particular one. Does anyone have any other suggestions? I tried rebooting to clear any connections and re-establish a new one, but I still get the error after a reboot. I tested restarting the service on another syslog-ng server and it worked fine. -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Sandor Geller Sent: Monday, August 06, 2012 11:13 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] syslog-ng service not starting On Mon, Aug 6, 2012 at 5:00 PM, James McDonald <jmcdonald@lce.com> wrote:
I returned from being out of the office for week and realized something was "off" with syslog-ng. I was unable to restart the service. I did a 'service syslog-ng status' and it says it's stopped. When I try 'service syslog-ng start' I get the following error:
Error binding socket; addr='AF_INET(0.0.0.0:443)', error='Address already in use (98)'
listening on port 443 is unusual for syslog, usually https servers are bound to it so you should check / update your config ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
-----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of James McDonald Sent: Monday, August 06, 2012 9:33 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] syslog-ng service not starting There are other syslog-ng servers configured this way in our environments but I am only having problems with this particular one. Does anyone have any other suggestions? I tried rebooting to clear any connections and re-establish a new one, but I still get the error after a reboot. I tested restarting the service on another syslog-ng server and it worked fine. James, Assuming you're running a linux distro of some sort: sudo netstat -lpn | grep 443 will get you to see what's listening to that port. I would suggest that this is more of an operating system issue then syslog-ng. James
I ran these commands: sudo netstat -lpn | grep 443 and sudo /usr/sbin/lsof | grep LISTEN | grep -w https and here are the results. [jmcdonald@servername ~]$ sudo netstat -lpn | grep 443 tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 3511/syslog-ng [jmcdonald@servername ~]$ sudo /usr/sbin/lsof | grep LISTEN | grep -w https syslog-ng 3511 root 11u IPv4 12997 0t0 TCP *:https (LISTEN) If syslog-ng is the one listening/accessing the port, then why am I unable to start/restart the service? -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Lay, James Sent: Monday, August 06, 2012 11:43 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] syslog-ng service not starting -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of James McDonald Sent: Monday, August 06, 2012 9:33 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] syslog-ng service not starting There are other syslog-ng servers configured this way in our environments but I am only having problems with this particular one. Does anyone have any other suggestions? I tried rebooting to clear any connections and re-establish a new one, but I still get the error after a reboot. I tested restarting the service on another syslog-ng server and it worked fine. James, Assuming you're running a linux distro of some sort: sudo netstat -lpn | grep 443 will get you to see what's listening to that port. I would suggest that this is more of an operating system issue then syslog-ng. James ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
James McDonald <jmcdonald@LCE.com> writes:
If syslog-ng is the one listening/accessing the port, then why am I unable to start/restart the service?
Do you perhaps happen to have two sources that both try to listen on port 443? -- |8]
Not that I know of. Httpd is not active and I ran both netstat and lsof commands to see what was accessing the 443 port, but only syslog-ng was mentioned in the results. Is there way to assign a service priority for a port? -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Gergely Nagy Sent: Tuesday, August 07, 2012 5:08 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] syslog-ng service not starting James McDonald <jmcdonald@LCE.com> writes:
If syslog-ng is the one listening/accessing the port, then why am I unable to start/restart the service?
Do you perhaps happen to have two sources that both try to listen on port 443? -- |8] ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
James McDonald <jmcdonald@LCE.com> writes:
Not that I know of. Httpd is not active and I ran both netstat and lsof commands to see what was accessing the 443 port, but only syslog-ng was mentioned in the results. Is there way to assign a service priority for a port?
By two sources, I meant two source{} blocks within your syslog-ng.conf. -- |8]
participants (5)
-
Evan Rempel
-
Gergely Nagy
-
James McDonald
-
Lay, James
-
Sandor Geller