- Splunk Answers
- :
- Splunk Administration
- :
- Security
- :
- ERROR TcpInputProc - Could not bind to port IPv4 p...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ERROR TcpInputProc - Could not bind to port IPv4 port 8002
Hi guys
i am getting below error for an 8002 input streaming for checkpoint logging.
Can you suggest how can i resolve this issue?
07-22-2020 15:51:27.889 +0200 ERROR TcpInputProc - Could not bind to port IPv4 port 8002
07-22-2020 15:58:03.290 +0200 INFO TcpInputConfig - IPv4 port 8002 is reserved for raw input
07-22-2020 15:58:03.290 +0200 INFO TcpInputConfig - IPv4 port 8002 will negotiate s2s protocol level 3
07-22-2020 15:58:03.290 +0200 ERROR TcpInputProc - Could not bind to port IPv4 port 8002
07-23-2020 07:49:42.588 +0200 INFO TcpInputConfig - IPv4 port 8002 is reserved for raw input
07-23-2020 07:49:42.588 +0200 INFO TcpInputConfig - IPv4 port 8002 will negotiate s2s protocol level 3
07-23-2020 07:49:42.589 +0200 ERROR TcpInputProc - Could not bind to port IPv4 port 8002
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Please provide more information, what you have configured in inputs.conf ? How checkpoint is sending data to splunk ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
This is the input stanza .
[tcp://8002]
connection_host = ****
index = ****
sourcetype = cp_log
disabled = 0
We are using Check Point App for Splunk and the logs are being sent via checkpoint Log Exporter through syslog. i have a data input for tcp port 8002.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Run ss -nlt | grep 8002 and check whether your device is listening on port 8002. If it is listening on port 8002 then run tcpdump & check whether you are receiving traffic or not.
As a best practice you should use syslog-ng or rsyslog to receive logs from network devices and then use Splunk UF/HF to ingest data into splunk.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
The command result
[root@********etc]# ss -nlt | grep 8002
LISTEN 0 25 *:8002 *:*
LISTEN 0 25 :::8002 :::*
But i am not sure why there is two listening status when i ran the command ? Is it normal?And the tcpdump was working fine too.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
One is IPv4 and other one is IPv6, If tcpdump is proving that you are receiving data from checkpoint then I'll suggest to look at splunkd.log for any datetime parsing warning/error.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No error related to datetime or parsing in splunkd logs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
can you give the output of the next command to us:
$SPLUNK_HOME/bin/splunk btool inputs list —debug
r. Ismo
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
Routing logs with Splunk OTel Collector for Kubernetes
