Syslog-ng: Error binding socket; addr='AF_INET(0.0.0.0:1234)', error='Address already in use (98)'
 

syslog-ng error

Module loaded and initialized successfully; module='syslogformat'
Error binding socket; addr='AF_INET(0.0.0.0:1234)', error='Address already in use (98)'
Error initializing message pipeline;

Version of syslog-ng

3.5.6

output of syslog-ng --version

syslog-ng 3.5.6
Installer-Version: 3.5.6
Revision: 3.5.6-2+b1 [@416d315] (Debian/unstable)
Compile-Date: Oct 1 2014 18:23:11
Available-Modules: afprog,linux-kmsg-format,csvparser,afamqp,afsql,afstomp,cryptofuncs,afsocket,afuser,afsocket-notls,afmongodb,afsmtp,redis,json-plugin,dbparser,confgen,affile,system-source,afsocket-tls,tfgeoip,syslogformat,basicfuncs
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-IPv6: on
Enable-Spoof-Source: on
Enable-TCP-Wrapper: on
Enable-Linux-Caps: on
Enable-Pcre: on

Platform

Debian 8.7

Issue

Trying to setup syslog-ng host to recieve log mesages from client s by listening on port 1234 via tcp

Failure

Module loaded and initialized successfully; module='syslogformat'
Error binding socket; addr='AF_INET(0.0.0.0:1234)', error='Address already in use (98)'
Error initializing message pipeline;



Configuration

@version: 3.5.6
@include "scl.conf"
options {
time-reap(30);
mark-freq(10);
keep-hostname(yes);
};

source s_local { system(); internal(); };

source s_network { syslog(ip(0.0.0.0) transport("tcp") port(1234) ); };

destination d_logs {
file(
"/var/log/syslog-ng/logs.txt"
owner("root")
group("root")
perm(0777)
); };
log { source(s_local); source(s_network); destination(d_logs); };

log { source(s_network); destination(d_logs); };

Habitual: that didnt work
 

I ran the "lsof -p 1234", which releases the port, but the port gets reclaimed automatically. Still get same error after resarting syslog-ng: Error binding socket; addr='AF_INET(0.0.0.0:1234)', error='Address already in use (98)'
Error initializing message pipeline;

"reclaimed automatically" by syslog-ng?

0.0.0.0 typically represents "use all interfaces", (unconfigured, possibly?)
Perhaps that is the clue?

Sorry, that's all I got.

You might also have two sources in your configuration that binds to the same port.