Troubleshooting Tip: How to troubleshoot 'PH_PARSER_BIND_PORT_FAILURE' errors for phParser

The following error causes phParser process to remain down even after multiple attempts of turning it up.

2025-12-17T15:51:57.776933+01:00 FSIEM phParser[42569]: [PH_MODULE_ABORT]:[eventSeverity]=PHL_ERROR,[procName]=phParser,[fileName]=phBaseProcess.cpp,[lineNumber]=1600,[coreDumpFile]=(none),[phLogDetail]=Module exited abnormally
2025-12-17T15:52:02.640669+01:00 FSIEM phParser[42653]: [PH_PARSER_BIND_PORT_FAILURE]:[eventSeverity]=PHL_ERROR,[procName]=phParser,[fileName]=parserProcess.cpp,[lineNumber]=2068,[errorNoInt]=98,[phLogDetail]=Failed to bind TCP/514 ports
2025-12-17T15:52:02.640694+01:00 FSIEM phParser[42653]: [PH_PARSER_BIND_PORT_FAILURE]:[eventSeverity]=PHL_ERROR,[procName]=phParser,[fileName]=parserProcess.cpp,[lineNumber]=1144,[errorNoInt]=9,[phLogDetail]=Failed to bind TCP ports
2025-12-17T15:52:02.640709+01:00 FSIEM phParser[42653]: [PH_MODULE_INIT_FAILURE]:[eventSeverity]=PHL_ERROR,[procName]=phParser,[fileName]=phParser.cpp,[lineNumber]=31,[module]=phParser,[phLogDetail]=Module initialization failure

The below steps can be followed to resolve the issue.

• Check which process is using TCP port 514

netstat -tulpn | grep 514

• Check if rsyslog is using the same port.
• If Rsyslog is using port 514 before phParser, the process can be stopped:
  

systemctl stop rsyslog

• Start phParser:

su admin
phtools --start phParser
exit

• Once phParser is up, start rsyslog.
  

systemctl start rsyslog