Support Questions
Find answers, ask questions, and share your expertise

ListenSyslog won't listen on port 514 because it's a privileged port. Is there a workaround?

Solved Go to solution

ListenSyslog won't listen on port 514 because it's a privileged port. Is there a workaround?

Rising Star

By convention, syslog listens on port 514, which is a privileged port (i.e. < 1024) meaning that only processes running as root can access them. For security reasons, Nifi runs as a non-root user and so the ListenSyslog processor can't listen on port 514.

Because port 514 is a standard for syslog, devices don't always have the option to output to different port, e.g. here's a screenshot from a firewall UI:

13909-syslog-screenshot.png

If port 514 is used for the `ListenSyslog` processor, the processor is unable to bind the port and error messages containing `Caused by: java.net.SocketException: Permission denied` show up in /var/log/nifi-app.log.

Is there an easy way to configure Nifi so that only ListenSyslog runs with root permissions? Or perhaps a workaround in Linux where messages destined for port 514 are forwarded to port 1514 so they can be picked up by the processor?

1 ACCEPTED SOLUTION

Accepted Solutions

Re: ListenSyslog won't listen on port 514 because it's a privileged port. Is there a workaround?

@Alex Woolford There are a few things you can try (none of which are really NiFi concerns):

  • iptables port redirection
  • Run something like HAproxy to forward tcp traffic from 514 to the selected port in NiFi
  • Use the cap_net_bind_service available in more recent linux kernels to allow the JVM to bind to privileged ports without running as root

View solution in original post

2 REPLIES 2

Re: ListenSyslog won't listen on port 514 because it's a privileged port. Is there a workaround?

@Alex Woolford There are a few things you can try (none of which are really NiFi concerns):

  • iptables port redirection
  • Run something like HAproxy to forward tcp traffic from 514 to the selected port in NiFi
  • Use the cap_net_bind_service available in more recent linux kernels to allow the JVM to bind to privileged ports without running as root

View solution in original post

Re: ListenSyslog won't listen on port 514 because it's a privileged port. Is there a workaround?

Rising Star

Thank you, @jfrazee. Per your suggestion (#2), I used HAproxy and it's working perfectly.