Unable to start splunk forwarder service

[catch_mili]

Unable to start splunk forwarder service, below error returns.

checking mgmt port [8089]: already bound
ERROR: The mgmt port [8089] is already bound. Splunk needs to use this port.
Would you like to change ports? [y/n]:

[HansK]

seems there is allready another service listening on 8089, eiter change the splunk port or the other software's port.

try this:
netstat --tcp --udp --listening --program

[catch_mili]

Thanks. Vince.

[vincesesto]

Hey catch_milli, try checking the running processes like:
ps aux | grep 8089
Regards Vince

[HansK]

and like this?:
lsof -i TCP:8089

[catch_mili]

I dont see 8089 used by any other application
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 :nrpe *: LISTEN 1321/xinetd
tcp 0 0 :nsca *: LISTEN 1321/xinetd
tcp 0 0 :http *: LISTEN 8343/httpd
tcp 0 0 localhost:oa-system

[martin_mueller]

As the error says, someone else (a splunk instance?) is hogging port 8089. Either kill them or switch to a different one.