https://community.splunk.com/t5/Getting-Data-In/Problems-creating-an-UDP-input-Error-binding-to-socket-in/m-p/142504#M29133 <P>thanks! Just forgotten it! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> I was confused because we have an older instance of forwarder running with the same app, but, in fact splunk was running as root.</P> Tue, 15 Jul 2014 10:22:44 GMT psobisch 2014-07-15T10:22:44Z https://community.splunk.com/t5/Getting-Data-In/Problems-creating-an-UDP-input-Error-binding-to-socket-in/m-p/142502#M29131 <P>Hello,</P> <P>After a new installation of universal forwarder 6.1.2 on a new RHEL6 machine we have just copied the appropriate app directory to the new forwarder (a procedure which was working every time in the past) but now, we've got a problem because the input which was configured in the app (udp://514), was not created.</P> <P>Inside of splunkd.log I found:</P> <PRE><CODE>Error binding to socket in UDPInputProcessor: Permission Denied </CODE></PRE> <P>Splunk is running as splunk:splunk.</P> <P>What went wrong?<BR /> Do you have any hints?</P> <P>Regards,<BR /> Peter</P> Tue, 15 Jul 2014 10:07:36 GMT https://community.splunk.com/t5/Getting-Data-In/Problems-creating-an-UDP-input-Error-binding-to-socket-in/m-p/142502#M29131 psobisch 2014-07-15T10:07:36Z https://community.splunk.com/t5/Getting-Data-In/Problems-creating-an-UDP-input-Error-binding-to-socket-in/m-p/142503#M29132 <P>Non-root users cannot bind to ports below 1024 on Linux systems.</P> <P>You could forward 514 to e.g. 5140 and have Splunk listen on that (talk to your Linux admins), or have your sources send data on a different port, or - probably best - have a syslog daemon receive the data on 514, write it to log files, and let the forwarder read those.</P> Tue, 15 Jul 2014 10:10:34 GMT https://community.splunk.com/t5/Getting-Data-In/Problems-creating-an-UDP-input-Error-binding-to-socket-in/m-p/142503#M29132 martin_mueller 2014-07-15T10:10:34Z https://community.splunk.com/t5/Getting-Data-In/Problems-creating-an-UDP-input-Error-binding-to-socket-in/m-p/142504#M29133 <P>thanks! Just forgotten it! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> I was confused because we have an older instance of forwarder running with the same app, but, in fact splunk was running as root.</P> Tue, 15 Jul 2014 10:22:44 GMT https://community.splunk.com/t5/Getting-Data-In/Problems-creating-an-UDP-input-Error-binding-to-socket-in/m-p/142504#M29133 psobisch 2014-07-15T10:22:44Z