# \[CLOSED \]Logstash crash after service start logstash

**URL:** <https://discuss.elastic.co/t/closed-logstash-crash-after-service-start-logstash/51324>\
**Category:** Logstash\
**Created:** [May 30, 2016, 1:19pm UTC](https://discuss.elastic.co/t/closed-logstash-crash-after-service-start-logstash/51324 "2016-05-30T13:19:41Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![zendel](https://avatars.discourse-cdn.com/v4/letter/z/d2c977/32.png) [@zendel](https://discuss.elastic.co/u/zendel)\
**Post date:** [May 30, 2016, 1:19pm UTC](https://discuss.elastic.co/t/closed-logstash-crash-after-service-start-logstash/51324/1 "2016-05-30T13:19:41Z")

</div>

hello, i'm using logstash on ubuntu (14.04LTS) with logstash\_2.3.1-1\_all.deb

After installation with dpkg, i'm trying to start logstash but logstash always stop after 30 secondes.  
I already check my conf file, it's OK. If i start logstash with /opt/logstash/bin/, its OK.

`sudo service logstash start`

I think the probleme is here, /etc/init.d/logstash :

> ```
> # Run the program!
> nice -n ${LS_NICE} chroot --userspec $LS_USER:$LS_GROUP $EXTRA_GROUPS / sh -c "
> cd $LS_HOME
> ulimit -n ${LS_OPEN_FILES}
> exec \"$program\" $args
> " > "${LS_LOG_DIR}/$name.stdout" 2> "${LS_LOG_DIR}/$name.err" &
> 
> ```

On /var/log, i have only :

> :message=\>"Pipeline main started"}  
> :message=\>"Pipeline main has been shutdown"}  
> :message=\>"stopping pipeline", :id=\>"main"}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 30, 2016, 11:59pm UTC](https://discuss.elastic.co/t/closed-logstash-crash-after-service-start-logstash/51324/2 "2016-05-30T23:59:25Z")

</div>

> [@zendel](#):
>
> I think the probleme is here, /etc/init.d/logstash :

Why do you think that?

Can you run LS directly, ie call the full path and point to the config directory and see what happens?

---

<div class="post-metadata">

**Author:** ![zendel](https://avatars.discourse-cdn.com/v4/letter/z/d2c977/32.png) [@zendel](https://discuss.elastic.co/u/zendel)\
**Post date:** [June 6, 2016, 3:34pm UTC](https://discuss.elastic.co/t/closed-logstash-crash-after-service-start-logstash/51324/3 "2016-06-06T15:34:42Z")

</div>

Sorry for the delay.

I think that because when i comment this line for :  
`

# Run the program!

# nice -n ${LS\_NICE} chroot --userspec $LS\_USER:$LS\_GROUP $EXTRA\_GROUPS / sh -c "

# cd $LS\_HOME

# ulimit -n ${LS\_OPEN\_FILES}

# exec "$program" $args

# " \> "${LS\_LOG\_DIR}/$name.stdout" 2\> "${LS\_LOG\_DIR}/$name.err" &

$program $args \>\> "${LS\_LOG\_DIR}/$name.stdout" 2\>\> "${LS\_LOG\_DIR}/$name.err" &  
`

that work fine. But its like if a start as root.

If i run LS directly (as root), that work too.

---

<div class="post-metadata">

**Author:** ![zendel](https://avatars.discourse-cdn.com/v4/letter/z/d2c977/32.png) [@zendel](https://discuss.elastic.co/u/zendel)\
**Post date:** [June 6, 2016, 3:44pm UTC](https://discuss.elastic.co/t/closed-logstash-crash-after-service-start-logstash/51324/4 "2016-06-06T15:44:00Z")

</div>

You can watch the end of strace here (not sure that help you)

```
  [pid 23470] futex(0x7f78340f9254, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f78340f9250, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1} <unfinished ...>
[pid 23480] <... mmap resumed> ) = 0x7f781aa83000
[pid 23476] <... futex resumed> ) = 0
[pid 23480] rt_sigprocmask(SIG_SETMASK, [QUIT], <unfinished ...>
[pid 23476] futex(0x7f78340f9228, FUTEX_WAIT_PRIVATE, 2, NULL <unfinished ...>
[pid 23480] <... rt_sigprocmask resumed> NULL, 8) = 0
[pid 23470] <... futex resumed> ) = 1
[pid 23480] madvise(0x7f781aa83000, 2076672, MADV_DONTNEED <unfinished ...>
[pid 23470] futex(0x7f78340f9228, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 23476] <... futex resumed> ) = 0
[pid 23470] <... futex resumed> ) = 1
[pid 23480] <... madvise resumed> ) = 0
[pid 23476] futex(0x7f78340f9228, FUTEX_WAKE_PRIVATE, 1 <unfinished ...>
[pid 23480] _exit(0) = ?
[pid 23476] <... futex resumed> ) = 0
[pid 23480] +++ exited with 0 +++
[pid 23476] mprotect(0x7f783ac2a000, 4096, PROT_READ <unfinished ...>
[pid 23470] futex(0x7f783400c054, FUTEX_WAIT_PRIVATE, 787, NULL <unfinished ...>
[pid 23476] <... mprotect resumed> ) = 0
[pid 23476] mprotect(0x7f783ac2a000, 4096, PROT_READ|PROT_WRITE) = 0
[pid 23476] mprotect(0x7f783ac2b000, 4096, PROT_NONE) = 0
[pid 23476] unlink("/tmp/hsperfdata_logstash/23456") = 0
[pid 23476] exit_group(0) = ?
[pid 23562] +++ exited with 0 +++
[pid 23548] +++ exited with 0 +++
[pid 23483] +++ exited with 0 +++
[pid 23482] +++ exited with 0 +++
[pid 23481] +++ exited with 0 +++
[pid 23478] +++ exited with 0 +++
[pid 23477] +++ exited with 0 +++
[pid 23476] +++ exited with 0 +++
[pid 23475] +++ exited with 0 +++
[pid 23474] +++ exited with 0 +++
[pid 23473] +++ exited with 0 +++
[pid 23479] +++ exited with 0 +++
[pid 23472] +++ exited with 0 +++
[pid 23471] +++ exited with 0 +++
[pid 23470] +++ exited with 0 +++
+++ exited with 0 +++
```

---

<div class="post-metadata">

**Author:** ![purbon](https://avatars.discourse-cdn.com/v4/letter/p/edb3f5/32.png) [@purbon](https://discuss.elastic.co/u/purbon)\
**Post date:** [June 6, 2016, 3:54pm UTC](https://discuss.elastic.co/t/closed-logstash-crash-after-service-start-logstash/51324/5 "2016-06-06T15:54:16Z")

</div>

we actually rewrote the whole package thing for new 5.0 alpha3, I would also test with this version if upgrade is a good thing for you.

also can you share your java version?

thanks a lot and sorry for your pain.

---

<div class="post-metadata">

**Author:** ![zendel](https://avatars.discourse-cdn.com/v4/letter/z/d2c977/32.png) [@zendel](https://discuss.elastic.co/u/zendel)\
**Post date:** [June 7, 2016, 8:04am UTC](https://discuss.elastic.co/t/closed-logstash-crash-after-service-start-logstash/51324/6 "2016-06-07T08:04:07Z")

</div>

> java version "1.7.0\_101"  
> OpenJDK Runtime Environment (IcedTea 2.6.6) (7u101-2.6.6-0ubuntu0.14.04.1)  
> OpenJDK 64-Bit Server VM (build 24.95-b01, mixed mode)

Thank you

---

<div class="post-metadata">

**Author:** ![Anton\_H](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anton_h/32/10200_2.png) [@Anton\_H](https://discuss.elastic.co/u/Anton_H)\
**Post date:** [June 8, 2016, 7:10am UTC](https://discuss.elastic.co/t/closed-logstash-crash-after-service-start-logstash/51324/7 "2016-06-08T07:10:38Z")

</div>

Have you checked java privileged port permissions?  
see: [Running logstash as a deamon](https://discuss.elastic.co/t/running-logstash-as-a-deamon/51754/8?u=anton_h)

---

<div class="post-metadata">

**Author:** ![zendel](https://avatars.discourse-cdn.com/v4/letter/z/d2c977/32.png) [@zendel](https://discuss.elastic.co/u/zendel)\
**Post date:** [June 8, 2016, 8:30am UTC](https://discuss.elastic.co/t/closed-logstash-crash-after-service-start-logstash/51324/8 "2016-06-08T08:30:04Z")

</div>

Good idea, i check this permission :

> sudo getcap /usr/lib/jvm/java-1.7.0-openjdk-amd64/jre/bin/java  
> /usr/lib/jvm/java-1.7.0-openjdk-amd64/jre/bin/java = cap\_net\_bind\_service+ep

> /usr/lib/jvm/java-1.7.0-openjdk-amd64/jre/bin/java -version  
> java version "1.7.0\_101"  
> OpenJDK Runtime Environment (IcedTea 2.6.6) (7u101-2.6.6-0ubuntu0.14.04.1)  
> OpenJDK 64-Bit Server VM (build 24.95-b01, mixed mode)

Normally, its good for permission, but logstash deamons still stop.

---

<div class="post-metadata">

**Author:** ![Anton\_H](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anton_h/32/10200_2.png) [@Anton\_H](https://discuss.elastic.co/u/Anton_H)\
**Post date:** [June 9, 2016, 6:09am UTC](https://discuss.elastic.co/t/closed-logstash-crash-after-service-start-logstash/51324/9 "2016-06-09T06:09:27Z")

</div>

I'm running with java 8 btw.

java -version  
java version "1.8.0\_91"  
Java(TM) SE Runtime Environment (build 1.8.0\_91-b14)  
Java HotSpot(TM) 64-Bit Server VM (build 25.91-b14, mixed mode)

---

<div class="post-metadata">

**Author:** ![zendel](https://avatars.discourse-cdn.com/v4/letter/z/d2c977/32.png) [@zendel](https://discuss.elastic.co/u/zendel)\
**Post date:** [June 9, 2016, 8:22am UTC](https://discuss.elastic.co/t/closed-logstash-crash-after-service-start-logstash/51324/10 "2016-06-09T08:22:25Z")

</div>

On Ubuntu 14.04LTS, java version "1.7.0\_101" is the most recent.

I made manually update, still no change

> openjdk version "1.8.0\_91"  
> OpenJDK Runtime Environment (build 1.8.0\_91-8u91-b14-0ubuntu4~14.04-b14)  
> OpenJDK 64-Bit Server VM (build 25.91-b14, mixed mode)

---

<div class="post-metadata">

**Author:** ![zendel](https://avatars.discourse-cdn.com/v4/letter/z/d2c977/32.png) [@zendel](https://discuss.elastic.co/u/zendel)\
**Post date:** [June 27, 2016, 3:31pm UTC](https://discuss.elastic.co/t/closed-logstash-crash-after-service-start-logstash/51324/11 "2016-06-27T15:31:02Z")

</div>

I have no answer but i suppose its java permission problem.

We can close this ticket, thanks for help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/closed-logstash-crash-after-service-start-logstash/51324/12 "2017-07-06T04:50:47Z")

</div>