EBADF: Bad file descriptor

Elastic Stack Logstash
1

Logstash is throwing the following error:
[2018-09-14T13:53:47,371][WARN ][logstash.inputs.websocket] websocket input client threw exception, restarting {:exception=>#<Errno::EBADF: Bad file descriptor - No message available>}

I've checked the forum here and on github, and there are reports of this, but no one appears to be doing anything to resolve it. In fact topics here get closed after a month of no activity and no responses. Is this product still supported? The websocket plugin documentation says it was released this past June. Is it still supported?

I'd be happy to provide further details and config info if needed.

2

The Websocket Input Plugin is a community-contributed plugin that is not (currently) included in the Logstash distribution. If you have a reproducible error, we would be glad to help in getting a patch in to fix it, but the plugin does not appear to be under active development.

There are a number of reasons why Ruby's Socket library would throw a EBADF, mostly having to do with the socket being cleaned up out of under it by the operating system. Can you turn on debug logging? Doing so will cause the error log to include a backtrace.

A TCP dump capturing traffic on the relevant ports may also prove helpful.

3

New to Logstash. How do I turn on the debug logging, and where would the logs end up?

4

You can use the --log.level debug command-line flag, or you can set log.level: debug in your logstash.yml. Additional information about logging, and where logs go based on what distribution you are using (e.g., tarball, deb, rpm), can be found here:

https://www.elastic.co/guide/en/logstash/current/logging.html

5

Got the debug logging. How much of the log do you want to see? I don't see a backtrace on the error.

[2018-09-17T14:46:16,104][DEBUG][logstash.pipeline ] Pushing flush onto pipeline {:pipeline_id=>"main", :thread=>"#<Thread:0x24df9a4a sleep>"}
[2018-09-17T14:46:17,009][WARN ][logstash.inputs.websocket] websocket input client threw exception, restarting {:exception=>#<Errno::EBADF: Bad file descriptor - No message available>}
[2018-09-17T14:46:17,352][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2018-09-17T14:46:17,352][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2018-09-17T14:46:21,116][DEBUG][logstash.pipeline ] Pushing flush onto pipeline {:pipeline_id=>"main", :thread=>"#<Thread:0x24df9a4a sleep>"}
[2018-09-17T14:46:22,364][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2018-09-17T14:46:22,364][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2018-09-17T14:46:26,123][DEBUG][logstash.pipeline ] Pushing flush onto pipeline {:pipeline_id=>"main", :thread=>"#<Thread:0x24df9a4a sleep>"}
[2018-09-17T14:46:27,387][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2018-09-17T14:46:27,387][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2018-09-17T14:46:31,128][DEBUG][logstash.pipeline ] Pushing flush onto pipeline {:pipeline_id=>"main", :thread=>"#<Thread:0x24df9a4a sleep>"}
[2018-09-17T14:46:32,403][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2018-09-17T14:46:32,403][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2018-09-17T14:46:36,140][DEBUG][logstash.pipeline ] Pushing flush onto pipeline {:pipeline_id=>"main", :thread=>"#<Thread:0x24df9a4a sleep>"}
[2018-09-17T14:46:37,419][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2018-09-17T14:46:37,419][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2018-09-17T14:46:39,057][WARN ][logstash.inputs.websocket] websocket input client threw exception, restarting {:exception=>#<Errno::EBADF: Bad file descriptor - No message available>}

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.