Aggregator fails to start error 1101
search cancel

Aggregator fails to start error 1101

book

Article ID: 171570

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent Data Loss Prevention

Issue/Introduction

When starting the aggregator on the endpoint server it reports error 1101 to enforce.

Server Status Error 1101

Endpoint Server Error 1101


Aggregator Logs:

Class: com.vontu.monitor.communication.configitem.ConfigItemSource$UpdateLogger
Method: itemLoaded
Level: FINE
Message:  Loaded DetectionServerConfig: informationMonitorID=4803, uniqueName=<SERVER NAME> (ENDPOINT), channels=[isEnabled=false, maxParallelScans=1, isEnabled=false, port=1344, backlog=16, shouldInspectMultipartOnly=false, isPreventTrial=true, requestConnectionsMax=16, requestBodySizeMin=4096, requestExcludedUrls=null, requestExcludedUserAgents=null, responseConnectionsMax=16, responseBodySizeMin=4096, responseExcludedUrls=null, responseExcludedUserAgents=null, responseContentTypes=text/*
application/vnd.ms-excel
application/vnd.ms-powerpoint
application/vnd.ms-project
application/vnd.ms-works
application/msword
application/pdf, icapChannelSubType=1001, tabletIpRanges=[], isEnabled=false, isPreventTrial=true, maxConnections=12, keyStore=, isReflectMode=true, inlineSmtpChannelID=0, inlineSmtpChannelSubType=2001, smtpForwardHops=[], password=keyAlias=null, isEnabled=false, transferFolderPath=null, packetCaptureChannelID=5705, monitorNICs=[], isEnabled=false, transferFolderPath=null, isEnabled=true, aggregatorHost=0.0.0.0, aggregatorPort=8000, agentVersion=null, lastAgentUpgrade=null, replicatorCommLayerPort=10443, replicatorCommLayerHost=0.0.0.0, agentConfig=null, isEnabled=false, numSessions=12, port=10080, sessionTimeout=30000, isEnabled=false, port=8080], pgpUniversalServer=null.


Class: com.vontu.communication.transport.TransportConfig
Method: logProperties
Level: INFO
Message:  listenPort: 8000

Class: com.vontu.communication.transport.ServerChannelManager
Method: <init>
Level: SEVERE
Message:  failed to init server channel channel manager
java.net.BindException: Address already in use: bind

Class: com.vontu.communication.dataflow.TransportManager
Method: <init>
Level: SEVERE
Message:  Got IOException while trying to initialize the transport layer!
com.vontu.communication.transport.exception.TransportException: java.net.BindException: Address already in use: bind

Environment

DLP 14.x
DLP 15.x
DLP 16.x

Cause

Another program was binding to port 8000 before the DLP services started.

Resolution

The solution is to stop the program that is already binding to that port. Use the following troubleshooting steps to identify the program causing the port conflict.

- Windows:

  1. Find the port that the aggregator is trying to bind. Look at the informational message right before binding error. In the case above it we could see the listen port was attempting to bind to 8000 and then the bind errors occurred.
  2. Next stop the DLP services. then run the following command using the port listed in the logs:
Netstat -ano | find "8000"
  1. Get the process ID (PID) at the end of the line that is displayed after the "LISTENING" message
  2. Run the following command to get the process info. In the following example we use 6716
tasklist /FI "PID eq 6716"


The listed .exe is the program that is already bound on that port. Stop that program or reconfigure it to use another port. Note: When the DLP services are started and working properly then the listed .exe should be java.exe for the PID using that port.

Alternatively you can run the following command to kill the process

taskkill /FI "PID eq 6716"


Then start the DLP services. As long as the original process does not restart and bind the same port then the aggregator should bind as expected.


- Linux:

  1. Find the port that the aggregator is trying to bind. Look at the informational message right before binding error. In the case above it we could see the listen port was attempting to bind to 8000 and then the bind errors occurred.
  2. Next stop the DLP services. then run the following command using the port listed in the logs:
Netstat -ano | find "8000"
  1. Get the process ID (PID) at the end of the line that is displayed after the "LISTENING" message
  2. Run the following command to get the process info. In the following example we use 6716
ps -p 6716


The listed process is the program that is already bound on that port, it may be a java zombie process. 
Run the following command to kill the process

kill -9 6716


Then start the DLP services. As long as the original process does not restart and bind the same port then the aggregator should bind as expected.