Problems creating an UDP input: Error binding to socket in UDPInputProcessor: Permission Denied

[psobisch]

Hello,

After a new installation of universal forwarder 6.1.2 on a new RHEL6 machine we have just copied the appropriate app directory to the new forwarder (a procedure which was working every time in the past) but now, we've got a problem because the input which was configured in the app (udp://514), was not created.

Inside of splunkd.log I found:

Error binding to socket in UDPInputProcessor: Permission Denied

Splunk is running as splunk:splunk.

What went wrong?
Do you have any hints?

Regards,
Peter

[martin_mueller]

Non-root users cannot bind to ports below 1024 on Linux systems.

You could forward 514 to e.g. 5140 and have Splunk listen on that (talk to your Linux admins), or have your sources send data on a different port, or - probably best - have a syslog daemon receive the data on 514, write it to log files, and let the forwarder read those.

[psobisch]

thanks! Just forgotten it! 🙂
I was confused because we have an older instance of forwarder running with the same app, but, in fact splunk was running as root.