FTP Receiver app Troubleshooting

[DEAD_BEEF]

I'm trying to get logs from a remote system via SFTP. I read that the FTP Receiver app sets up a HF to act like a FTP server to retrieve files, monitor the log directory as an input, and send them to the indexers.

I deployed the app to my HF and created a separate account to login to the HF (credentials matching the account to retrieve the FTP logs) and with all the various permissions from the README, but I'm just getting errors saying that the service could not start.

The HF is running on RHEL 7.6 and the ftp service is enabled in firewalld. I tried telnet on 20 and 21 from another host in my environment to the HF and there was no route and then connection refused (respectively).

In the Data Input > FTP > Port I tried both 20 and 21 with no success.

Not sure what else I need to do to setup the app. @LukeMurphey

=================UPDATE=================
Changed port to 2022 and now no more errors. But not seeing any data either. What can I check next?

[LukeMurphey]

Linux/Unix does not allow non-root users to open a port less than 1024 by default. See https://www.geeksforgeeks.org/bind-port-number-less-1024-non-root-access/ for details on how to get around this issue.

[DEAD_BEEF]

The app requires that this be on port 20/21? I switched it to 2022 as you suggested but not seeing any messages in _internal anymore.

[LukeMurphey]

I'm wondering if the OS is disallowing the port to be opened because Splunk isn't running as root. You could test this by changing the port to something above 1024 (like 2022). Let me know if that works.

[DEAD_BEEF]

@LukeMurphey I updated the port to 2022 as you suggested and I'm not seeing the errors anymore. I ran the _internal search and there isn't anything new besides when it started the FTP server on the new port. I checked the index (main for now) and no data as of yet. What would you suggest I check next?