# Fresh install - high CPU load

**URL:** <https://discuss.elastic.co/t/fresh-install-high-cpu-load/114552>\
**Category:** Logstash\
**Created:** [January 8, 2018, 3:50pm UTC](https://discuss.elastic.co/t/fresh-install-high-cpu-load/114552 "2018-01-08T15:50:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmnc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmnc/32/15014_2.png) [@dmnc](https://discuss.elastic.co/u/dmnc)\
**Post date:** [January 8, 2018, 3:50pm UTC](https://discuss.elastic.co/t/fresh-install-high-cpu-load/114552/1 "2018-01-08T15:50:38Z")

</div>

Hi, I'm completely new in Elastic Search. I've installed E+L+K (logstash 6.0.1) on the officially supported Debian 9.3 following the official documentation. After installation I let it be and did nothing with it, today I found that logstash is eating my CPU. I've upgraded (by apt-get upgrade) to the 6.1.1 with no difference. It is running on headless JRE from OpenJDK which is AFAIK officially supported.

Please do I need to install full JDK for some jstack tools (just googled about it) or how to find the problem?

Again, there is no custom configuration, no beats, this is brand new installation so there is something wrong with java or logstash itself. FML ☹

![VM](https://us1.discourse-cdn.com/elastic/original/3X/b/8/b8c220dca223bd12f23cf0af81f89610103b6306.png)

![ps](https://us1.discourse-cdn.com/elastic/original/3X/c/9/c940d4e1fe2b30845f4fd9aee243fa3b258bc228.png)

![ps -h](https://us1.discourse-cdn.com/elastic/original/3X/5/c/5ccb8cb4b490623b8ba55cc3fd19a3a5834f0904.png)

ps output:

```
logstash 32348 188 4.0 3445580 331980 ? SNsl 15:51 0:18 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -Xmx1g -Xms256m -Xss2048k -Djffi.boot.library.path=/usr/share/logstash/vendor/jruby/lib/jni -Xbootclasspath/a:/usr/share/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/usr/share/logstash/vendor/jruby -Djruby.lib=/usr/share/logstash/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash
```

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [January 11, 2018, 2:46pm UTC](https://discuss.elastic.co/t/fresh-install-high-cpu-load/114552/2 "2018-01-11T14:46:53Z")

</div>

Is the Logstash PID changing very often?

If so, then LS is stopping and the OS service manager (`systemd`) is restarting it. When starting there is much work to do - compiling the config, JRuby JIT compilation etc, therefore high CPU.

Logstash will exit if it does not find a config to compile or if the config or any settings have a syntax error.  
If this happens the service manager tries to restart it.

If this is the case then the error is not logged to the LS logs but to the service console and into the `journald` subsystem AFAICT.

Try using `journalctl` to access the services logs. Try looking at `dmesg` output too.

Post what you find.

---

<div class="post-metadata">

**Author:** ![dmnc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmnc/32/15014_2.png) [@dmnc](https://discuss.elastic.co/u/dmnc)\
**Post date:** [January 11, 2018, 5:01pm UTC](https://discuss.elastic.co/t/fresh-install-high-cpu-load/114552/3 "2018-01-11T17:01:45Z")

</div>

I see, it make sense. And as friend of mine wrote me too, when logstash has no work (no config, etc.) it shutdowns by itself. Thank you, problem solved.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 8, 2018, 5:01pm UTC](https://discuss.elastic.co/t/fresh-install-high-cpu-load/114552/4 "2018-02-08T17:01:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
