# During Logstash forwarder startup throws "Failed to tls handshake EOF" Error **URL:** \ **Category:** Logstash\ **Created:** [September 8, 2015, 7:19am UTC](https://discuss.elastic.co/t/during-logstash-forwarder-startup-throws-failed-to-tls-handshake-eof-error/28816 "2015-09-08T07:19:48Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![vino](https://avatars.discourse-cdn.com/v4/letter/v/c2a13f/32.png) [@vino](https://discuss.elastic.co/u/vino)\ **Post date:** [September 8, 2015, 7:19am UTC](https://discuss.elastic.co/t/during-logstash-forwarder-startup-throws-failed-to-tls-handshake-eof-error/28816/1 "2015-09-08T07:19:48Z")
I have a 7 node setup where we have 3 logstash, 3 elastic search and 1 logstash-forwarder. I have both the logstash-forwarder and load balancer (haproxy) running in the same VM. All the three logstash communicates with the loadbalancer. And loadbalancer communicates with the logstash-forwarder. Versions: logstash 1 - 1.5.3 logstash2 - 1.4.2 logstash3 - 1.4.3 logstashforwarder - 0.4.0 Distributor ID: CentOS Release: 6.5 This is our setup. The setup was working without any issues, suddenly we are facing the issue while starting up logstash forwarder. Below error is displayed while starting logstash-forwarder, 2015/09/03 12:50:33.843148 Waiting for 2 prospectors to initialise 2015/09/03 12:50:33.843329 All prospectors initialised with 0 states to persist 2015/09/03 12:50:33.843431 Loading client ssl certificate: /etc/pki/tls/certs/logstash-forwarder.crt and /etc/pki/tls/private/logstash-forwarder.key 2015/09/03 12:50:34.013314 Setting trusted CA from file: /etc/pki/tls/certs/logstash-forwarder.crt 2015/09/03 12:50:34.013891 Connecting to [10.xxx.xxx.xxx]:5043 (Loadbalancer) 2015/09/03 12:50:34.014713 Failed to tls handshake with 10.xxx.xxx.xxx EOF Please let me know if you need any further info. Logstash-Forwarder configuration { "network": { "servers": ["Loadbalancer:5043"], "ssl certificate": "/etc/pki/tls/certs/logstash-forwarder.crt", "ssl key": "/etc/pki/tls/private/logstash-forwarder.key", "ssl ca": "/etc/pki/tls/certs/logstash-forwarder.crt", "timeout": 60 }, "files": [ { "paths": [""], "fields": { "Component": "ABC", "logtype": "log" } }, { "paths": [""], "fields": { "Component": "ABC", "logtype": "audit" } } ] } ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 8, 2015, 8:18am UTC](https://discuss.elastic.co/t/during-logstash-forwarder-startup-throws-failed-to-tls-handshake-eof-error/28816/2 "2015-09-08T08:18:54Z")
> [@vino](#): > > 10.xxx.xxx.xxx Have you looked at the logs on that host to see what is happening? ---
**Author:** ![vino](https://avatars.discourse-cdn.com/v4/letter/v/c2a13f/32.png) [@vino](https://discuss.elastic.co/u/vino)\ **Post date:** [September 8, 2015, 8:44am UTC](https://discuss.elastic.co/t/during-logstash-forwarder-startup-throws-failed-to-tls-handshake-eof-error/28816/3 "2015-09-08T08:44:26Z")
I checked the logs in /var/log/logstash-forwarder. The logstash-forwarder.log file is empty, while logstash-forwarder.err contains the same error lines. Attaching: 2015/09/02 16:01:20.407785 --- options ------- 2015/09/02 16:01:20.407828 config-arg: /etc/logstash-forwarder.conf 2015/09/02 16:01:20.407840 idle-timeout: 5s 2015/09/02 16:01:20.407846 spool-size: 1024 2015/09/02 16:01:20.407851 harvester-buff-size: 16384 2015/09/02 16:01:20.407855 --- flags --------- 2015/09/02 16:01:20.407859 tail (on-rotation): false 2015/09/02 16:01:20.407864 log-to-syslog: false 2015/09/02 16:01:20.407868 quiet: false 2015/09/02 16:01:20.407907 { "network": { "servers": ["Loadbalancer:5043"], "ssl certificate": "/etc/pki/tls/certs/logstash-forwarder.crt", "ssl key": "/etc/pki/tls/private/logstash-forwarder.key", "ssl ca": "/etc/pki/tls/certs/logstash-forwarder.crt" }, "files": [ { "paths": ["/home/_.log"], "fields": { "Component": "ABC", "logtype": "log" } }, { "paths": ["/home/_.audit"], "fields": { "Component": "ABC", "logtype": "audit" } } ] } 2015/09/02 16:01:20.408631 Waiting for 2 prospectors to initialise 2015/09/02 16:01:20.409966 All prospectors initialised with 0 states to persist 2015/09/02 16:01:20.410182 Loading client ssl certificate: /etc/pki/tls/certs/logstash-forwarder.crt and /etc/pki/tls/private/logstash-forwarder.key 2015/09/02 16:01:20.585241 Setting trusted CA from file: /etc/pki/tls/certs/logstash-forwarder.crt 2015/09/02 16:01:20.592656 Connecting to [10.xxx.xxx.xxx]:5043 (Loadbalancer) 2015/09/02 16:01:20.593842 Failed to tls handshake with 10.78.220.180 EOF 2015/09/02 16:01:21.594730 Connecting to [10.xxx.xxx.xxx]:5043 (Loadbalancer) 2015/09/02 16:01:21.595063 Failed to tls handshake with 10.78.220.180 EOF 2015/09/02 16:01:22.595800 Connecting to [10.xxx.xxx.xxx]:5043 (Loadbalancer) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 8, 2015, 8:56am UTC](https://discuss.elastic.co/t/during-logstash-forwarder-startup-throws-failed-to-tls-handshake-eof-error/28816/4 "2015-09-08T08:56:55Z")
Does your loadbalancer pass through the SSL to LS or does it terminate there? ---
**Author:** ![vino](https://avatars.discourse-cdn.com/v4/letter/v/c2a13f/32.png) [@vino](https://discuss.elastic.co/u/vino)\ **Post date:** [September 8, 2015, 9:01am UTC](https://discuss.elastic.co/t/during-logstash-forwarder-startup-throws-failed-to-tls-handshake-eof-error/28816/5 "2015-09-08T09:01:04Z")
Warkolm, I am not sure how to verify it . is there a way i can check it ? please guide me. Thanks, Vino ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 8, 2015, 9:02am UTC](https://discuss.elastic.co/t/during-logstash-forwarder-startup-throws-failed-to-tls-handshake-eof-error/28816/6 "2015-09-08T09:02:08Z")
It depends on how you set it up! Did you set things up like that or not? ---
**Author:** ![vino](https://avatars.discourse-cdn.com/v4/letter/v/c2a13f/32.png) [@vino](https://discuss.elastic.co/u/vino)\ **Post date:** [September 8, 2015, 9:03am UTC](https://discuss.elastic.co/t/during-logstash-forwarder-startup-throws-failed-to-tls-handshake-eof-error/28816/7 "2015-09-08T09:03:50Z")
i generated the keys mentioned in ssl certificate, ssl key and shared it. I did not make any other configurations ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:29am UTC](https://discuss.elastic.co/t/during-logstash-forwarder-startup-throws-failed-to-tls-handshake-eof-error/28816/8 "2017-07-06T05:29:46Z")