syslog listener died Errno::EACCES: Permission denied - bind(2)

最新推荐文章于 2023-10-13 14:36:01 发布
最新推荐文章于 2023-10-13 14:36:01 发布
阅读量7.3k 收藏
点赞数 2
分类专栏： ElasticSearch学习笔记 文章标签： logstash syslog syslog listener died
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/chengyuqiang/article/details/80090810
版权

local_syslog.conf 

input {
  syslog {
    port => "514"
  }
}
output {  
    elasticsearch {  
        hosts => ["node1:9200"]  
        index => "syslog"  
    }   
}

启动logstash 报错：

[elastic@node1 logstash-6.2.3]$ bin/logstash -f config/local_syslog.conf
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
[2018-04-26T10:30:23,901][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"/opt/logstash-6.2.3/modules/netflow/configuration"}
[2018-04-26T10:30:23,925][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"/opt/logstash-6.2.3/modules/fb_apache/configuration"}
[2018-04-26T10:30:24,570][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-04-26T10:30:25,359][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"6.2.3"}
[2018-04-26T10:30:26,069][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
[2018-04-26T10:30:28,541][INFO ][logstash.pipeline        ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
[2018-04-26T10:30:29,101][INFO ][logstash.pipeline        ] Pipeline started succesfully {:pipeline_id=>"main", :thread=>"#<Thread:0x4d740a8b run>"}
[2018-04-26T10:30:29,179][INFO ][logstash.inputs.syslog   ] Starting syslog udp listener {:address=>"0.0.0.0:514"}
[2018-04-26T10:30:29,195][INFO ][logstash.inputs.syslog   ] Starting syslog tcp listener {:address=>"0.0.0.0:514"}
[2018-04-26T10:30:29,215][WARN ][logstash.inputs.syslog   ] syslog listener died {:protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2) for "0.0.0.0" port 514>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:197:in `bind'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:149:in `udp_listener'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:130:in `server'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:110:in `block in run'"]}
[2018-04-26T10:30:29,222][WARN ][logstash.inputs.syslog   ] syslog listener died {:protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2)>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:133:in `initialize'", "org/jruby/RubyIO.java:875:in `new'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:167:in `tcp_listener'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:130:in `server'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:114:in `block in run'"]}
[2018-04-26T10:30:29,228][INFO ][logstash.agent           ] Pipelines running {:count=>1, :pipelines=>["main"]}
[2018-04-26T10:30:34,222][INFO ][logstash.inputs.syslog   ] Starting syslog udp listener {:address=>"0.0.0.0:514"}
[2018-04-26T10:30:34,223][INFO ][logstash.inputs.syslog   ] Starting syslog tcp listener {:address=>"0.0.0.0:514"}
[2018-04-26T10:30:34,224][WARN ][logstash.inputs.syslog   ] syslog listener died {:protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2) for "0.0.0.0" port 514>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:197:in `bind'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:149:in `udp_listener'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:130:in `server'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:110:in `block in run'"]}
[2018-04-26T10:30:34,225][WARN ][logstash.inputs.syslog   ] syslog listener died {:protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2)>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:133:in `initialize'", "org/jruby/RubyIO.java:875:in `new'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:167:in `tcp_listener'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:130:in `server'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:114:in `block in run'"]}
[2018-04-26T10:30:39,225][INFO ][logstash.inputs.syslog   ] Starting syslog udp listener {:address=>"0.0.0.0:514"}
[2018-04-26T10:30:39,226][INFO ][logstash.inputs.syslog   ] Starting syslog tcp listener {:address=>"0.0.0.0:514"}
[2018-04-26T10:30:39,227][WARN ][logstash.inputs.syslog   ] syslog listener died {:protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2)>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:133:in `initialize'", "org/jruby/RubyIO.java:875:in `new'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:167:in `tcp_listener'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:130:in `server'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:114:in `block in run'"]}
[2018-04-26T10:30:39,227][WARN ][logstash.inputs.syslog   ] syslog listener died {:protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2) for "0.0.0.0" port 514>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:197:in `bind'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:149:in `udp_listener'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:130:in `server'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.0/lib/logstash/inputs/syslog.rb:110:in `block in run'"]}
^C[2018-04-26T10:30:41,179][WARN ][logstash.runner          ] SIGINT received. Shutting down.
[2018-04-26T10:30:42,233][INFO ][logstash.inputs.syslog   ] Starting syslog udp listener {:address=>"0.0.0.0:514"}
[2018-04-26T10:30:42,233][INFO ][logstash.inputs.syslog   ] Starting syslog tcp listener {:address=>"0.0.0.0:514"}
[2018-04-26T10:30:42,485][INFO ][logstash.pipeline        ] Pipeline has terminated {:pipeline_id=>"main", :thread=>"#<Thread:0x4d740a8b run>"}
[2018-04-26T10:30:42,623][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Stop/pipeline_id:main, :exception=>"NoMethodError", :message=>"undefined method `map' for nil:NilClass\nDid you mean?  tap", :backtrace=>["/opt/logstash-6.2.3/logstash-core/lib/logstash/util.rb:40:in `thread_info'", "/opt/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:662:in `block in plugin_threads_info'", "org/jruby/RubyArray.java:2486:in `map'", "/opt/logstash-6.2.3/logstash-core/lib/logstash/pipeline.rb:662:in `plugin_threads_info'", "/opt/logstash-6.2.3/logstash-core/lib/logstash/pipeline_reporter.rb:66:in `block in to_hash'", "/opt/logstash-6.2.3/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:80:in `inflight_batches'", "/opt/logstash-6.2.3/logstash-core/lib/logstash/pipeline_reporter.rb:56:in `to_hash'", "/opt/logstash-6.2.3/logstash-core/lib/logstash/pipeline_reporter.rb:51:in `snapshot'", "/opt/logstash-6.2.3/logstash-core/lib/logstash/shutdown_watcher.rb:88:in `pipeline_report_snapshot'", "/opt/logstash-6.2.3/logstash-core/lib/logstash/shutdown_watcher.rb:63:in `block in start'", "/opt/logstash-6.2.3/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/interval.rb:20:in `interval'", "/opt/logstash-6.2.3/logstash-core/lib/logstash/shutdown_watcher.rb:59:in `start'", "/opt/logstash-6.2.3/logstash-core/lib/logstash/shutdown_watcher.rb:35:in `block in start'"]}
[elastic@node1 logstash-6.2.3]$

可见是syslog udp listener和syslog tcp listener启动失败

syslog listener died {:protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2)>, 
syslog listener died {:protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2) for "0.0.0.0" port 514>,

百度一下，没有找到可用信息，后来参考了https://discuss.elastic.co/t/udp-listener-died/24489，找到解决办法
You need to start logstash as root as 514 is a protected port (/etc/sysconfig/logstash LS_USER=root)

所以切换到root用户，再次启动

[root@node1 logstash-6.2.3]# bin/logstash -f config/local_syslog.conf
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
[2018-04-26T10:43:14,182][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"/opt/logstash-6.2.3/modules/netflow/configuration"}
[2018-04-26T10:43:14,204][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"/opt/logstash-6.2.3/modules/fb_apache/configuration"}
[2018-04-26T10:43:14,839][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-04-26T10:43:15,820][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"6.2.3"}
[2018-04-26T10:43:16,490][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
[2018-04-26T10:43:19,426][INFO ][logstash.pipeline        ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
[2018-04-26T10:43:19,974][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://node1:9200/]}}
[2018-04-26T10:43:19,988][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://node1:9200/, :path=>"/"}
[2018-04-26T10:43:20,265][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"http://node1:9200/"}
[2018-04-26T10:43:20,367][INFO ][logstash.outputs.elasticsearch] ES Output version determined {:es_version=>6}
[2018-04-26T10:43:20,372][WARN ][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>6}
[2018-04-26T10:43:20,396][INFO ][logstash.outputs.elasticsearch] Using mapping template from {:path=>nil}
[2018-04-26T10:43:20,426][INFO ][logstash.outputs.elasticsearch] Attempting to install template {:manage_template=>{"template"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"_default_"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}}
[2018-04-26T10:43:20,501][INFO ][logstash.outputs.elasticsearch] Installing elasticsearch template to _template/logstash
[2018-04-26T10:43:20,885][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//node1:9200"]}
[2018-04-26T10:43:21,422][INFO ][logstash.pipeline        ] Pipeline started succesfully {:pipeline_id=>"main", :thread=>"#<Thread:0x2a890d7c run>"}
[2018-04-26T10:43:21,479][INFO ][logstash.inputs.syslog   ] Starting syslog udp listener {:address=>"0.0.0.0:514"}
[2018-04-26T10:43:21,493][INFO ][logstash.inputs.syslog   ] Starting syslog tcp listener {:address=>"0.0.0.0:514"}
[2018-04-26T10:43:21,533][INFO ][logstash.agent           ] Pipelines running {:count=>1, :pipelines=>["main"]}

已经正常启动了

程裕强
关注
  • 2
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 1
    评论
专栏目录
1024以前端口需要root用户来执行
liutaochn的专栏
05-12 2963
在配置logstash收集rsyslog日志时，一直抱报错，tcp和udp都无法启用。使用netstat -nap |grep 514也看不到任何进程 {:timestamp=>"2017-05-12T10:27:57.597000+0800", :message=>"syslog listener died", :protocol=>:tcp, :address=>"0.0.0.0:5
logstash问题
bing0924的博客
09-26 2602
是因为非ROOT用户启动的程序禁止监听1-1024的端口，要到修改服务启动的用户为ROOT，要到把监听端口修改为1024以上的端口即可。
使用logstash收集syslog日志时，必须使用root用户启动Logstash
12-24 755
logstash是elstic stack套件中负责收据、转换数据用的工具。 logstash其中一项功能是收集syslog日志，syslog的默认端口时514。 可能的配置文件 input { syslog { port => "514" } } output { elasticsearch { ...
CentOS7设置systemd管理Logstash服务遇到的坑
cang3691的博客
07-27 3146
Information : 玩ELK也挺久了，有时间把遇到的坑都写出来1. 测试环境CentOS7 操作系统 ， rsyslog , logstash6.2.4（二进制方式安装）2. 问题在设置以logstash用户去启动服务的时候会发生如下报错Jul2717:39:02zabbix-serverlogstash:[2019-07-27T17:39:02,995][...
bind socket报EACCES(Permission denied)错误
nb1253587023的博客
08-23 1366
a
Linux: Error: EACCES: permission denied Linux 解决方法
最新发布
雪小貂的博客
10-13 3160
Linux: Error: EACCES: permission denied Linux 解决方法
Posh-SYSLOG:从PowerShell发送SYSLOG消息
05-04
豪华系统日志描述用于从PowerShell发送SYSLOG消息的模块。 该模块支持RFC5424和RFC3164，并且可以通过TCP和UDP发送消息。 由基兰·雅各布森（Kieran Jacobsen）发表正在安装获取Posh-SYSLOG的最简单方法是使用！检查...
nim-syslog：Nim syslog模块
02-03
2. **本地和远程日志**：nim-syslog模块不仅可以将日志写入本地syslog守护进程，还可以通过UDP或TCP发送到远程syslog服务器，实现集中化的日志管理。 3. **自定义日志格式**：开发者可以定制日志消息的格式，包括...
syslog-ng-deployment:Syslog-ng部署配置
04-27
系统部署 基本安装说明： 在Ubuntu 16.04上： apt-get install syslog-ng-core git ... 包含syslog-ng configs的文件路径，默认为/ etc / syslog-ng / 0000-options.conf 包含syslog-ng的系统默认选项。 这些基
go-syslog：用于go的Syslog服务器库
02-05
Syslog服务器库，可使用RFC3164，RFC6587或RFC5424通过UDP，TCP或Unix套接字轻松构建自定义syslog服务器 安装 推荐的安装go-syslog的方法 go get gopkg.in/mcuadros/go-syslog.v2 例子 如何导入包裹 import "gopkg....
syslog-server：基于Docker的远程syslog接收器
02-09
Syslog服务器 介绍 这是一个Docker容器，可以接收Syslog消息（RFC3164），存储在数据库中并通过网站显示。 使用（来自Docker Registry） 工作正在进行中 ...使用$ sudo docker save syslog-server | pigz
docker 运行logstash出现permission denied
ljcgit的博客
04-27 2391
解决方法 在运行容器的时候加上--privileged=true。
系统学习Linux-ELK日志收集系统
weixin_66894765的博客
08-30 1260
ELK日志收集系统集群实验实验环境环境配置设置各个主机的ip地址为拓扑中的静态ip，并修改主机名安装elasticsearch。
Ubuntu下udp通信 Permission denied问题
qq_37140815的博客
03-23 2074
sendto()向广播地址发包返回errno 13, Permission denied错误 原因： 没有设置socket的SO_BROADCAST属性。特别注意：SO_BROADCAST属性要单独设置，一般习惯setsockopt时同时设置多个属性，例如SO_BROADCAST|SO_REUSEADDR，虽然大部分情况下工作正常，但工作中还是遇到了同时设置不起作用的问题； // set SO_BROADCAST int optval = 1; if (setsockopt(sock
Centos中部署vue出现Error: EACCES: permission denied问题
u010312671的专栏
04-28 7532
解决Error: EACCES: permission denied问题集锦前言错误截图总结 我通过百度看了大量该问题的解决办法，终于解决了我的问题。并把各种方式罗列出来，方便大家进行快速定位问题。
Windows安装Logstash
KingCruel的专栏
10-22 5327
Logstash是 Elastic Stack 的中央数据流引擎，用于收集、丰富和统一所有数据，而不管格式或模式。当与Elasticsearch，Kibana，及 Beats 共同使用的时候便会拥有特别强大的实时处理能力。
ELK 收集中断错误处理
weixin_34380781的博客
08-03 406
ELK收集中断，定位问题到redis发现redis内存不足，所以迁移到新的redis上elasticsearch 删除索引语句：curl-XDELETEhttp://localhost:9200/logstash-nginx.access-2016.05.31错误1：Failed to send event to RedisFailedtosendeventto...
Logstash（Windows）报错
csdn0948的博客
05-23 324
ES
完整教程：spring-boot-starter-data-elasticsearch整合elasticsearch 6.x
热门推荐
程裕强的专栏
01-09 10万+
1、前言 网上很多言论： 新版本的SpringBoot 2的spring-boot-starter-data-elasticsearch中支持的Elasticsearch版本是2.X， 但Elasticsearch实际上已经发展到6.5.X版本了，为了更好的使用Elasticsearch的新特性， 所以弃用了spring-boot-starter-data-elasticsearch依赖，而改为直...
Document PermissionError: [Errno 13] Permission denied:
09-14
根据引用，你的问题是关于一个权限被拒绝的错误（PermissionError: [Errno 13] Permission denied）。这个错误可能是由于syslog udp listener和syslog tcp listener启动失败引起的。根据引用，这个问题可能是由于代码读取路径不正确导致的。你可以检查一下你的代码，确保它们正确指定了文件路径。如果你正在进行批量转化，可以尝试运行json_to_dataset文件中的代码。 另外，根据引用，还有一个可能的解决方法是以root用户身份启动logstash。这是因为514端口是受保护的端口，需要特殊权限才能访问。你可以尝试将logstash以root用户身份启动，将配置文件/etc/sysconfig/logstash中的LS_USER设置为root。 综上所述，你可以按照以下步骤尝试解决这个问题： 1. 检查你的代码，确保文件路径正确指定。 2. 如果你正在进行批量转化，尝试运行json_to_dataset文件中的代码。 3. 以root用户身份启动logstash，将/etc/sysconfig/logstash中的LS_USER设置为root。 希望以上信息对你有帮助。如果你还有其他问题，请随时提问。
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值