Filebeat agent is causing the other processes (on same server) to crash

Elastic Stack Beats
1

Hi,

We have a ELK stack setup. It was working fine, till we setup Filebeat agent on one of our servers, where many applications are hosted. We have Filebeat agents setup on other servers, which are working fine. But on this particular server, we are seeing that the existing processes/application servers are getting auto-killed whenever we bring up Filebeat.

I felt that OOM killer is the cause, but when I rum vmstat, i can see the below output (i.e. there is free memory available)

r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
0  0      0  48603   1147  21026    0    0     1    44    4    5  3  2 94  0  0
1  0      0  48597   1147  21030    0    0     0  2230 9372 25789 11  7 81  1  0
0  0      0  48594   1147  21034    0    0     0   125 9199 24845 10  7 83  1  0
1  0      0  48591   1147  21037    0    0     0   110 7709 20366  8  5 86  1  0
2  0      0  48587   1147  21041    0    0     0  2189 10080 28472 12  7 80  1  0

Can you please advise on the possible causes/resolution.

2

have you checked any logs of your applications and kernel logs? If kernel kills a process for reason X, it's normally logged.

3

Thanks for the clarification. I have not looked at the kernel logs since I do not have access to it. I will check there and update on this thread.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.