Filebeat 6 on Redhat (RHEL/CentOS 5) not supported!

Elastic Stack Beats
1

OS ENV：
cat /etc/redhat-release
Red Hat Enterprise Linux Server release 5.4 (Tikanga)

uname -r
2.6.18-164.el5

Filebeat version：
6.6.2

when i run cmd：./filebeat -e -c ./filebeat.yml , i got those info：
runtime: epollwait on fd 4 failed with 38
fatal error: runtime: netpoll failed

runtime stack:
runtime.throw(0x179661c, 0x17)
/usr/local/go/src/runtime/panic.go:616 +0x81
runtime.netpoll(0x158b63a61a3a5000, 0x0)
/usr/local/go/src/runtime/netpoll_epoll.go:75 +0x216
runtime.sysmon()
/usr/local/go/src/runtime/proc.go:4265 +0x424
runtime.mstart1(0x0)
/usr/local/go/src/runtime/proc.go:1227 +0xe7
runtime.mstart()
/usr/local/go/src/runtime/proc.go:1193 +0x76

goroutine 1 [runnable, locked to thread]:
regexp/syntax.(*Regexp).Simplify(0xc42032aa10, 0xc42032a930)
/usr/local/go/src/regexp/syntax/simplify.go:99 +0xb19
regexp/syntax.(*Regexp).Simplify(0xc42032aa80, 0x2)
/usr/local/go/src/regexp/syntax/simplify.go:23 +0xc0
regexp/syntax.(*Regexp).Simplify(0xc42032a8c0, 0xc42000df40)
/usr/local/go/src/regexp/syntax/simplify.go:23 +0xc0
regexp.compile(0xc4202e5480, 0x13, 0xd4, 0x13, 0xc4202e5480, 0x13)
/usr/local/go/src/regexp/regexp.go:177 +0xb9
regexp.Compile(0xc4202e5480, 0x13, 0x1, 0x2, 0xc4202e5480)
/usr/local/go/src/regexp/regexp.go:133 +0x41
regexp.MustCompile(0xc4202e5480, 0x13, 0x1)
/usr/local/go/src/regexp/regexp.go:238 +0x4d
github.com/elastic/beats/vendor/github.com/docker/distribution/reference.capture(0xc42000e2c8, 0x1, 0x1, 0xc4202f5d60)
/go/src/github.com/elastic/beats/vendor/github.com/docker/distribution/reference/regexp.go:137 +0xb9

goroutine 5 [syscall]:
os/signal.signal_recv(0xc420078fc8)
/usr/local/go/src/runtime/sigqueue.go:139 +0xa6
os/signal.loop()
/usr/local/go/src/os/signal/signal_unix.go:22 +0x22
created by os/signal.init.0
/usr/local/go/src/os/signal/signal_unix.go:28 +0x41

Please help me，my os server couldn't upgrade!
Thanks!

2

RHEL5 ... interesting since that's not a supported version for Filebeat

Did it work for you before the upgrade?

3

1.Are there some other version could support RHEL5?
2.yeah,in a short time ,my team couldn't upgrade the version of server.the jdk's version is 1.4 on the server.so the logstash is not be deployed.

4

You may also want to take this a different way. Rather than solving a problem with getting logs to come off of a rhel5 sever, perhaps you should tell them to get off rhel5. I have to imagine the support cost are fairly High, especially where this platform is at from supportability perspective from Red Hat.

5

I am using RHEL 7,and its working fine for 6.6.1. Doubt a minor update will break the upgrade process.

6

thanks for your reply.
i have to use logstash with jdk1.8 on the RHEL5,just ELK.

7

yeah.
my os'version is rhel5,there are production server online.i have to use ELK

8

i am running on java-1.8.0-openjdk ,and since there are no major technical differences with Oracle JDK we can rule that out.

Possible to try running on a sandbox with RHEL 7 installed? RHEL 5 is like coming to end of its life

9

RHEL5 uses a pretty old kernel, which I think is not supported by the go runtime. Which kernel version are you using? 2.6.18-398?

See: https://github.com/golang/go/wiki/MinimumRequirements
It says 2.6.23+ is required.

The crash occurs on the epollwait syscall.

10

yes.
Our servers'version is 2.6.18-164.el5.
I have seen "MinimumRequirements" that about golang.
The problem should be linux kernel's reason.
Thanks

11

Can we change the title of this to FileBeat and RHEL5 ?
I think most users who have read the manual undersatnd it's not supported, so drawing attention to this post is unneccesary, and is not something people need to spend time reading.

12

Updated title.