Problem

Received error “Could not bind UDP syslog input to address /0.0.0.0:514, Failed to bind to: /0.0.0.0:514, Address already in use” when adding log input using UDP 514 (default syslog port).

Explanation

In UNIX/LINUX, assigned port 1024 and below require root privilege. Either you run graylog2 as root (not recommended) or follow below workaround.

Solution

1. Create new Syslog UDP inputs and listen to any port (ex: 5514).
2. Manipulate traffic using iptable:
iptables -t nat -A PREROUTING -i eth0 -p udp -m udp --dport 514 -j REDIRECT --to-ports 5514

Incoming search terms:

  • https://advanxer com/blog/2014/10/graylog2-could-not-bind-udp-syslog-input-to-address-0-0-0-0514-failed-to-bind-to-0-0-0-0514-address-already-in-use/
  • graylog input not working
  • graylog syslog 514
  • graylog syslog input failed
  • graylog syslog udp failed
  • https://yandex ru/clck/jsredir?from=yandex ru;search;web;;&text=&etext=1825 CYnBY5_SCrDy8UwcjgCmujx7n7o8g_jDeKg_5BPc3ZSVWZUKGiCvvbOVZifC0Rwk 5ef2f6e1aacc0fe99f61a172d0dcbea3b9ac139b&uuid=&state=_BLhILn4SxNIvvL0W45KSic66uCIg23qh8iRG98qeIXme
  • https://yandex ru/clck/jsredir?from=yandex ru;search;web;;&text=&etext=1832 kzZXKHyT1W-ei0gyq8wNqi1VZrA4w-sZ63TwRuhDGHzv2fnM-PRsXQHwH_6GHsru 0a83139f8ac5c535160089439cbe41a5241831c2&uuid=&state=_BLhILn4SxNIvvL0W45KSic66uCIg23qh8iRG98qeIXme