Security

How to troubleshoot why we are getting "appserver port: already bound" on startup of Splunk 6.2.x after reboot?

arber
Communicator

Hello,

we are having the following issue while trying to start splunk (version 6.2) .

/opt/splunk/bin/splunk start

Splunk> Now with more code!

Checking prerequisites...
        Checking http port [8000]: open
        Checking mgmt port [8089]: open
        Checking appserver port [127.0.0.1:8065]: already bound
ERROR: The appserver port [127.0.0.1:8065] is already bound.  Splunk needs to use this port.
Would you like to change ports? [y/n]: y
Enter a new appserver port: 8066
Setting appserver port: 8066
The port specified is in use.  Please enter a different port.
Enter a new appserver port: 8067
Port "8067" is invalid, please enter a number between 1 and 65535
Enter a new appserver port:

The appserver port already bound.. We don't have anything on this system except Splunk. I also tried to check what process was using this port, but i didn't get any response. Also tried to set another port 8066 or 8067 but not possible. We also tried version 6.2.1 same issue.

The issue started after we did a reboot of the system

Any clue on this.

Tags (4)

mdessus_splunk
Splunk Employee
Splunk Employee

I had the same issue: it was caused by the loopback not initialized. So check your interface with a ifconfig lo

srubik
New Member

I am also seeing this same issue and the only way I was able to get around it was by setting the port to 0 in web.conf. netstat showed port 8086 not in use, and I couldn't use any other port. Were you able to figure out why you were seeing this?

0 Karma

chanfoli
Builder

Can we see what the output of the following commands is after stopping splunk or making sure that splunk processes are not running with ps etcetera:

netstat -an | grep 8065

and

lsof |grep 8065
0 Karma

arber
Communicator

Hi,

the Splunk is stopped. And both those commands do not show any result
It is very strange why it would say that the port is bound to anything

0 Karma

hvaillancourt
New Member

Did anyone ever figure this out?

0 Karma

jsanderson
New Member

In our case it turned out there was a BIND_IP defined in /opt/splunk/etc/splunk-launch.conf that was causing the issue (thought we had removed all of these).

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.