Re: audit collector startup help

LC Bruzenak
2008-09-09T20:03:28Z

On Tue, 2008-09-09 at 15:25 -0400, DJ Delorie wrote:
> > Sep 9 13:41:15 fryspc auditd[3786]: Cannot bind tcp listener socket to
> > port 1237
>
> Have you tried other ports? There might be something on that port
> already.

I looked (with lsof) and there was nothing.
I tried port 12037; same thing.

It is not a firewall issue:
[root@fryspc etc]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

I do not any tcp_wrappers issues.
I also accept prelude events on this machine.

This has to be something easy I've overlooked...I do appreciate the
suggestions.

Thx,
LCB.

I have other things listening away:
rpcbind 1845 rpc 8u IPv4 6916 TCP
*:sunrpc (LISTEN)
rpc.statd 1864 rpcuser 9u IPv4 6988 TCP
*:58971 (LISTEN)
sshd 2152 root 3u IPv4 7975 TCP
*:ssh (LISTEN)
sshd 2152 root 4u IPv6 7977 TCP
*:ssh (LISTEN)
mysqld 2246 mysql 10u IPv4 8088 TCP
localhost.localdomain:mysql (LISTEN)
prelude-m 2277 root 0u IPv4 8201 TCP
localhost.localdomain:prelude (LISTEN)
prelude-m 2277 root 2u IPv4 8204 TCP
fryspc:prelude (LISTEN)
sendmail 2301 root 4u IPv4 8325 TCP
localhost.localdomain:smtp (LISTEN)
httpd 2320 root 4u IPv6 8381 TCP
*:http (LISTEN)
cupsd 2375 root 4u IPv4 8606 TCP
localhost.localdomain:ipp (LISTEN)
httpd 6341 apache 4u IPv6 8381 TCP
*:http (LISTEN)
httpd 6342 apache 4u IPv6 8381 TCP
*:http (LISTEN)
httpd 6343 apache 4u IPv6 8381 TCP
*:http (LISTEN)
httpd 6344 apache 4u IPv6 8381 TCP
*:http (LISTEN)
httpd 6345 apache 4u IPv6 8381 TCP
*:http (LISTEN)
httpd 6346 apache 4u IPv6 8381 TCP
*:http (LISTEN)
httpd 6347 apache 4u IPv6 8381 TCP
*:http (LISTEN)
httpd 6348 apache 4u IPv6 8381 TCP
*:http (LISTEN)