After an update to RabbitMQ 3.7.8 and Erlange 21.1 (centOS 6 server) netstat shows that beam.smp is listening on a random UDP port on all interfaces:

~$ sudo netstat -pnul | grep beam
udp        0      0*             7320/beam.smp

That port is changing with every restart and is not closed when stopping the app but changes when starting it back:

~$ sudo rabbitmqctl stop_app
Stopping rabbit application on node rabbit@host ...
~$ sudo netstat -pnul | grep beam
udp        0      0*             7320/beam.smp
~$ sudo rabbitmqctl start_app
Starting node rabbit@host ...
 completed with 7 plugins.
~$ sudo netstat -pnul | grep beam
udp        0      0*             7320/beam.smp
  • Disabling all plugins does not change this behaviour so I guess this is not plugin related.
  • tcpdump does not show any activity on this port.
  • I can't find any trace of this in the RabbitMQ's documentation.
  • I can't find anything related to this on the Internet
  • grepping the code of "rabbitmq-server" for "udp" does not give much info

The main question is what is this port used for? As a corollary, is it possible to configure this?


Seems to me it's a port bound by the syslog_logger module, coming from this RabbitMQ dependency:


Looks like it is by default is started on the RabbitMQ node and when it starts up it binds to a random port:

The dependency: https://github.com/rabbitmq/rabbitmq-server/blob/c1fb658ce13ae7f14919bd784eddd3dc77ab5144/Makefile#L139

The line where the port is opened: https://github.com/schlagert/syslog/blob/ac8b9eecd593b8cc5a8b1de332d5d7d874e25aa9/src/syslog_logger.erl#L323-L323

According to the docs this feature is default disabled, but the Erlang application is started. I guess it would be better if the application is not started when it is disabled.

If you want to verify it for yourself, you can do this:

Start a remote shell into the Rabbit Erlang VM:

% Start remote console
erl -sname test -remsh rabbit@$HOSTNAME
% Get all the port infos from the Erlang VM
PortInfos = lists:map(fun erlang:port_info/1, erlang:ports()).
% print the result
% Investigate the list for one which has the {name, udp_inet} line
% something like this: 
% And from this you can get the linked process, and see that it is a syslog_logger process

% The result will be something like this

You can see the $initial_call part, it tells you which module is it.

Currently it doesn't look like that this behaviour can be controlled. The code only does sending, no receiving is implemented in the module as I can see.

| improve this answer | |
  • Thank you for the analysis. Opening that port is required to send UDP packets to a syslog server, but it shouldn't be opened unless the module is in use. We'll see if this can be addressed - github.com/rabbitmq/rabbitmq-server/issues/1718 – Luke Bakken Oct 1 '18 at 14:26
  • Thanks for the analysis, it's really useful. The firewall is on drop policy so no real security threat here. Thanks @LukeBakken for the bug report. – Julien Oct 2 '18 at 12:44
  • In addition, sending data to that port has no effect as it is dropped anyway. – Luke Bakken Oct 3 '18 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.