- Splunk Answers
- :
- Splunk Administration
- :
- Security
- :
- Re: ERROR TcpInputProc - Could not bind to port IP...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ERROR TcpInputProc - Could not bind to port IPv4 port 8002
Hi guys
i am getting below error for an 8002 input streaming for checkpoint logging.
Can you suggest how can i resolve this issue?
07-22-2020 15:51:27.889 +0200 ERROR TcpInputProc - Could not bind to port IPv4 port 8002
07-22-2020 15:58:03.290 +0200 INFO TcpInputConfig - IPv4 port 8002 is reserved for raw input
07-22-2020 15:58:03.290 +0200 INFO TcpInputConfig - IPv4 port 8002 will negotiate s2s protocol level 3
07-22-2020 15:58:03.290 +0200 ERROR TcpInputProc - Could not bind to port IPv4 port 8002
07-23-2020 07:49:42.588 +0200 INFO TcpInputConfig - IPv4 port 8002 is reserved for raw input
07-23-2020 07:49:42.588 +0200 INFO TcpInputConfig - IPv4 port 8002 will negotiate s2s protocol level 3
07-23-2020 07:49:42.589 +0200 ERROR TcpInputProc - Could not bind to port IPv4 port 8002
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Please provide more information, what you have configured in inputs.conf ? How checkpoint is sending data to splunk ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
This is the input stanza .
[tcp://8002]
connection_host = ****
index = ****
sourcetype = cp_log
disabled = 0
We are using Check Point App for Splunk and the logs are being sent via checkpoint Log Exporter through syslog. i have a data input for tcp port 8002.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Run ss -nlt | grep 8002 and check whether your device is listening on port 8002. If it is listening on port 8002 then run tcpdump & check whether you are receiving traffic or not.
As a best practice you should use syslog-ng or rsyslog to receive logs from network devices and then use Splunk UF/HF to ingest data into splunk.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
The command result
[root@********etc]# ss -nlt | grep 8002
LISTEN 0 25 *:8002 *:*
LISTEN 0 25 :::8002 :::*
But i am not sure why there is two listening status when i ran the command ? Is it normal?And the tcpdump was working fine too.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
One is IPv4 and other one is IPv6, If tcpdump is proving that you are receiving data from checkpoint then I'll suggest to look at splunkd.log for any datetime parsing warning/error.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No error related to datetime or parsing in splunkd logs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
can you give the output of the next command to us:
$SPLUNK_HOME/bin/splunk btool inputs list —debug
r. Ismo
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
