Port configuration in nxlog.conf file is being appended by "514"


#1 JackT@Boeing

When I start NXlog CE, I get a socket error when tryin gto connect to  the remote Graylog server

nxlog.conf...######################################### Global directives                    #########################################User nxlogGroup nxlog

include /etc/nxlog/nxlog.d/*.confLogFile /var/log/nxlog/nxlog.logLogLevel INFO

######################################### Modules                              ##########################################<Extension _syslog>#    Module      xm_syslog#</Extension>

<Extension json>   Module         xm_json</Extension>

<Extension syslog>   Module         xm_syslog</Extension>

<Input in1>   Module      im_udp    Port        1514   Exec        parse_syslog_bsd();</Input>

<Input in2>   Module      im_tcp   Port        1514</Input>

<Input kernel>   Module         im_kernel   Exec           parse_syslog_bsd();</Input>

<Input systemd>   Module         im_systemd</Input>

<Input devlog>   Module         im_uds   UDS            /dev/log   FlowControl    FALSE   Exec           $raw_event =~ s/\s+$//;   Exec           parse_syslog_bsd();</Input>

<Output fileout1>   Module      om_file   File        "/var/log/nxlog/logmsg.txt"   Exec        if $Message =~ /error/ $SeverityValue = syslog_severity_value("error");   Exec        to_syslog_bsd();</Output>

<Output fileout2>   Module      om_file   File        "/var/log/nxlog/logmsg2.txt"</Output>

<Output out>   Module         om_tcp   Host           192.79.220.162:1514   Exec           $Message = to_json(); to_syslog_bsd();</Output>

######################################### Routes                               #########################################<Route 1>   Path        in1 => fileout1</Route>

<Route tcproute>   Path        in2 => fileout2</Route>

<Route r>    Path           kernel, systemd, devlog => out</Route>...nxlog.log...2023-10-27 09:56:23 WARNING nxlog-ce received a termination request signal, exiting...2023-10-27 09:56:24 ERROR Couldn't get systemd cursor;Cannot assign requested address2023-10-27 09:56:24 ERROR Couldn't remove pidfile /run/nxlog/nxlog.pid: Permission denied2023-10-27 09:56:25 INFO configuration OK2023-10-27 09:56:25 INFO nxlog-ce-3.2.2329 started2023-10-27 09:56:25 ERROR couldn't bind socket /dev/log;Address already in use2023-10-27 09:56:25 INFO reconnecting in 1 seconds2023-10-27 09:56:25 ERROR apr_sockaddr_info failed for 192.xxx.xxx.162:1514:514;Name or service not known2023-10-27 09:56:26 INFO reconnecting in 2 seconds2023-10-27 09:56:26 ERROR apr_sockaddr_info failed for 192.xxx.xxx.162:1514:514;Name or service not known2023-10-27 09:56:28 INFO reconnecting in 4 seconds2023-10-27 09:56:28 ERROR apr_sockaddr_info failed for 192.xxx.xxx.162:1514:514;Name or service not known2023-10-27 09:56:32 INFO reconnecting in 8 seconds2023-10-27 09:56:32 ERROR apr_sockaddr_info failed for 192.xxx.xxx.162:1514:514;Name or service not known2023-10-27 09:56:40 INFO reconnecting in 16 seconds2023-10-27 09:56:40 ERROR apr_sockaddr_info failed for 192.xxx.xxx.162:1514:514;Name or service not known2023-10-27 09:56:56 INFO reconnecting in 32 seconds2023-10-27 09:56:56 ERROR apr_sockaddr_info failed for 192.xxx.xxx.162:1514:514;Name or service not known2023-10-27 09:57:28 INFO reconnecting in 64 seconds2023-10-27 09:57:28 ERROR apr_sockaddr_info failed for 192.xxx.xxx.162:1514:514;Name or service not known...    

environment description...nxlog-ce is running on Oracle Linux Server version 8.8Package version is -3.2.2329-1.x86_64 ...

relevant details...This is a new installation. The Graylog server is not receiving any logs from this machineThis problem does not involve parsing data.The problems is that the port I identified in the nxlog.conf file "1514" is being appended by "514" so the socket connection fails to the remote server. If I remove 1514 from the nxlog.conf file, the system still tries to connect at port 514 and gets denied errors since Graylog is seutp to listen on 1514...

#2 NenadMDeactivated Nxlog ✓

Hello

As far as I understand, you receive the logs on TCP/1514 port and sent the logs over TCP/1514 port. Am I right?

Also, the following error:

2023-10-27 09:56:25 ERROR couldn't bind socket /dev/log;Address already in use

seems to be related to the im_uds module…

You could maybe try a simple config (one input-one output) and check which module exactly produces the problem.