From mboxrd@z Thu Jan  1 00:00:00 1970
From: LC Bruzenak <lenny@magitekltd.com>
Subject: Re: audit collector startup help
Date: Tue, 09 Sep 2008 15:03:28 -0500
Message-ID: <1220990608.6596.200.camel@homeserver>
References: <1220984797.6596.162.camel@homeserver>
	<200809091836.m89IatSW011688@greed.delorie.com>
	<1220986021.6596.167.camel@homeserver>
	<200809091925.m89JPmTd013185@greed.delorie.com>
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <200809091925.m89JPmTd013185@greed.delorie.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: DJ Delorie <dj@redhat.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com


On Tue, 2008-09-09 at 15:25 -0400, DJ Delorie wrote:
> > Sep  9 13:41:15 fryspc auditd[3786]: Cannot bind tcp listener socket to
> > port 1237
> 
> Have you tried other ports?  There might be something on that port
> already.

I looked (with lsof) and there was nothing.
I tried port 12037; same thing.

It is not a firewall issue:
[root@fryspc etc]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         


I do not any tcp_wrappers issues. 
I also accept prelude events on this machine.

This has to be something easy I've overlooked...I do appreciate the
suggestions.

Thx,
LCB.

I have other things listening away:
rpcbind   1845       rpc    8u     IPv4       6916                 TCP
*:sunrpc (LISTEN)
rpc.statd 1864   rpcuser    9u     IPv4       6988                 TCP
*:58971 (LISTEN)
sshd      2152      root    3u     IPv4       7975                 TCP
*:ssh (LISTEN)
sshd      2152      root    4u     IPv6       7977                 TCP
*:ssh (LISTEN)
mysqld    2246     mysql   10u     IPv4       8088                 TCP
localhost.localdomain:mysql (LISTEN)
prelude-m 2277      root    0u     IPv4       8201                 TCP
localhost.localdomain:prelude (LISTEN)
prelude-m 2277      root    2u     IPv4       8204                 TCP
fryspc:prelude (LISTEN)
sendmail  2301      root    4u     IPv4       8325                 TCP
localhost.localdomain:smtp (LISTEN)
httpd     2320      root    4u     IPv6       8381                 TCP
*:http (LISTEN)
cupsd     2375      root    4u     IPv4       8606                 TCP
localhost.localdomain:ipp (LISTEN)
httpd     6341    apache    4u     IPv6       8381                 TCP
*:http (LISTEN)
httpd     6342    apache    4u     IPv6       8381                 TCP
*:http (LISTEN)
httpd     6343    apache    4u     IPv6       8381                 TCP
*:http (LISTEN)
httpd     6344    apache    4u     IPv6       8381                 TCP
*:http (LISTEN)
httpd     6345    apache    4u     IPv6       8381                 TCP
*:http (LISTEN)
httpd     6346    apache    4u     IPv6       8381                 TCP
*:http (LISTEN)
httpd     6347    apache    4u     IPv6       8381                 TCP
*:http (LISTEN)
httpd     6348    apache    4u     IPv6       8381                 TCP
*:http (LISTEN)


-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com