I have a Debian Wheezy server that has logstash-forwarder running on it.
Periodically, my PRTG reports that the /var file system is full. When I look at it and do a lsof, it reveals that the process is holding the files from being deleted.
root@edi-ftp:~# lsof | grep logstash | grep deleted logstash- 30916 root 4r REG 8,1 535 16 /.logstash-forwarder (deleted) logstash- 30916 2053 root 4r REG 8,1 535 16 /.logstash-forwarder (deleted) logstash- 30916 30918 root 4r REG 8,1 535 16 /.logstash-forwarder (deleted) logstash- 30916 30937 root 4r REG 8,1 535 16 /.logstash-forwarder (deleted) logstash- 30916 30938 root 4r REG 8,1 535 16 /.logstash-forwarder (deleted) logstash- 30916 30949 root 4r REG 8,1 535 16 /.logstash-forwarder (deleted) root@edi-ftp:~#
So doing a hard stop/start on the process flushes out the problem.
I have seen some posts on this, and they relay that the problem is fixed in prior versions to the one I am running (0.4.0). But I seem to still have an issue.
Any suggestions on what I can do?