NetFlow UDP 9995 not listening about sof-elk HOT 6 CLOSED

Hm, that certainly doesn't sound right. I just tested on one here:

[elk_user@sof-elk ~]$ sudo netstat -tulpn | grep 9995
udp        0      0 0.0.0.0:9995            0.0.0.0:*                           2128/java

FWI, that should be reported (with a different PID, of course) even if the firewall is not open. I can't think of a reason that port would not be listening unless the entire logstash pipeline was crashed. Do you have anything in /var/log/logstash/logstash-plain.log that may provide insight? You should be able to search for 9995 to get close.

I have the following on the same system as the netstat command was run:

[2023-10-27T20:18:49,410][INFO ][logstash.inputs.udp      ][main][945ed0156c99a0f45b4236702e814c70f307cd0e60221a10d3f8b12aa3bc11b0] Starting UDP listener {:address=>"0.0.0.0:9995"}

from sof-elk.

Also, the next release of the VM will use a new NetFlow ingest via filebeat. Not a help now, but that is running reliably in dev at this time.

from sof-elk.

Thanks for your help. I see some warnings about a cache file not being present in the logstash-plain.log. I'll do a reinstall first to exclude some weird user error on my side. Will report back when done to see if this issue was fixed for me.

from sof-elk.

sure thing. if you're seeing a template cache error, that's expected.

[2023-10-27T20:17:39,274][WARN ][logstash.codecs.netflow  ] Template Cache does not exist {:file_path=>"/var/lib/logstash//netflow_templates.cache"}

let me know what you find!

from sof-elk.

On a clean install the listener is coming up just fine. Opened the port and the NetFlow data is received! No idea what was wrong on the previous install, but... fixed! Thanks for your pointers :)

from sof-elk.

OK great! Glad to hear. That input has historically been quite stable, but has become a little flaky recently. I suspect that's somewhat related to Elastic's move from the native input to Filebeat - which we'll have enabled instead for the future version (along with proper NetFlow v9 handling and much more!)

Glad it's working!

from sof-elk.