topic Re: Splunk not receiving syslog messages in Getting Data In

Splunk not receiving syslog messages

jslater — Wed, 02 Oct 2013 13:16:23 GMT

Hi All,

I've installed Splunk on a Windows 2008R2 server and am trying to get it to receive syslog messages on the default UDP 514 port. Adding this in via Data Inputs results in "UDP port 514 is not available" which I have seen means it's already pre-defined, and is backed up by messages in the log:

10-02-2013 13:37:38.017 +0100 ERROR AdminManager - Parameter name: UDP port 514 is not available.
10-02-2013 13:50:30.488 +0100 INFO TcpInputConfig - IPv4 port 514 is reserved for raw input

However, Splunk is not receiving anything over this port. I have confirmed this is open/working by downloading another open source syslog receiver on the same server, & this is quite happily receiving syslog messages from my test clients.

Similar questions posed have all been Linux related, is there anything special that needs to be done on a Windows server?

Thanks.

Re: Splunk not receiving syslog messages

sdaniels — Wed, 02 Oct 2013 13:37:24 GMT

Sounds like port 514 is already in use on the windows server. Can you validate ports in use by which processes via netstat -b -a.

Re: Splunk not receiving syslog messages

jslater — Wed, 02 Oct 2013 13:47:07 GMT

Thanks for the quick response, I only see:

[System]
UDP 0.0.0.0:514 :
Splunkd

Strangely, I could add it via the command line with:

C:\Program Files\Splunk\bin>splunk add udp 514 -sourcetype syslog
Listening for UDP input on port 514.

C:\Program Files\Splunk\bin>splunk list udp
Listening for input on the following UDP ports:
514
51414

And the port appears in the GUI. If I then delete from the GUI I can then re-add it - odd!

Re: Splunk not receiving syslog messages

dwaddle — Mon, 07 Oct 2013 22:10:51 GMT

Various things on the internet suggest that Windows XP SP2 and newer may actually be sane and require certain privileges to be able to a bind/listen on a port < 1024. Does the user running the Splunk service have administrative privileges on the server?