Getting Data In

Splunk not receiving syslog messages

jslater
Engager

Hi All,

I've installed Splunk on a Windows 2008R2 server and am trying to get it to receive syslog messages on the default UDP 514 port. Adding this in via Data Inputs results in "UDP port 514 is not available" which I have seen means it's already pre-defined, and is backed up by messages in the log:

10-02-2013 13:37:38.017 +0100 ERROR AdminManager - Parameter name: UDP port 514 is not available.
10-02-2013 13:50:30.488 +0100 INFO TcpInputConfig - IPv4 port 514 is reserved for raw input

However, Splunk is not receiving anything over this port. I have confirmed this is open/working by downloading another open source syslog receiver on the same server, & this is quite happily receiving syslog messages from my test clients.

Similar questions posed have all been Linux related, is there anything special that needs to be done on a Windows server?

Thanks.

Tags (4)

dwaddle
SplunkTrust
SplunkTrust

Various things on the internet suggest that Windows XP SP2 and newer may actually be sane and require certain privileges to be able to a bind/listen on a port < 1024. Does the user running the Splunk service have administrative privileges on the server?

0 Karma

jslater
Engager

Thanks for the quick response, I only see:

[System]
UDP 0.0.0.0:514 :
Splunkd

Strangely, I could add it via the command line with:

C:\Program Files\Splunk\bin>splunk add udp 514 -sourcetype syslog
Listening for UDP input on port 514.

C:\Program Files\Splunk\bin>splunk list udp
Listening for input on the following UDP ports:
514
51414

And the port appears in the GUI. If I then delete from the GUI I can then re-add it - odd!

0 Karma

sdaniels
Splunk Employee
Splunk Employee

Sounds like port 514 is already in use on the windows server. Can you validate ports in use by which processes via netstat -b -a.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...