# Fresh install, just dies. Great... now what?

**URL:** https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831
**Category:** Logstash
**Created:** [February 16, 2016, 1:02am UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831 "2016-02-16T01:02:22Z")
**Posts on this page:** 20
**Page:** 1

<div class="post-metadata">

### Author: ![Mark\_Howells](https://avatars.discourse-cdn.com/v4/letter/m/ecae2f/32.png) [@Mark\_Howells](https://discuss.elastic.co/u/Mark_Howells)
#### Post date: [February 16, 2016, 1:02am UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/1 "2016-02-16T01:02:23Z")

</div>

So, I thought 'd give LS a try having heard so much about it.

I installed openjdk-7-jre onto a 12.04 ubuntu server then logatash 2.2.1 from the repositories (and then by hand when that didn't run). No errors are reported during install and

```
# java -version

```

returns

```
root@dns1:/# java -version
java version "1.7.0_95"
OpenJDK Runtime Environment (IcedTea 2.6.4) (7u95-2.6.4-0ubuntu0.12.04.1)
OpenJDK 64-Bit Server VM (build 24.95-b01, mixed mode)`

```

and the command

```
# root@dns1:/opt/logstash# DEBUG=1 bin/logstash -e 'input { stdin { } } output { stdout {} }'

```

hangs, until ^C

Using DEBUG=1 I see

```
DEBUG: exec /opt/logstash/vendor/jruby/bin/jruby --1.9 -J-XX:+UseParNewGC -J-XX:+UseConcMarkSweepGC -J
-Djava.awt.headless=true -J-XX:CMSInitiatingOccupancyFraction=75 -J-XX:+UseCMSInitiatingOccupancyOnly -J
XX:+HeapDumpOnOutOfMemoryError -J-Xmx1g -J-XX:HeapDumpPath=/opt/logstash/heapdump.hprof     
opt/logstash/lib/bootstrap/environment.rb logstash/runner.rb agent -e input { stdin { } } output { stdout {} }`

```

with no warnings or errors. Given that LS is supposed to be great for newbies and I've wasted two hours investigatingthis with different variants of Java I'm a bit fed up... 😉

Any ideas would be very welcome.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 16, 2016, 7:06am UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/2 "2016-02-16T07:06:21Z")

</div>

This is expected. Logstash is waiting to receive something on stdin. When you've started it, just type something into the terminal and press Enter. From where did you get the idea that you should run this command? If it's from the official documentation, perhaps there's room for improvement to correctly set users' expectations.

---

<div class="post-metadata">

### Author: ![Mark\_Howells](https://avatars.discourse-cdn.com/v4/letter/m/ecae2f/32.png) [@Mark\_Howells](https://discuss.elastic.co/u/Mark_Howells)
#### Post date: [February 16, 2016, 7:51am UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/3 "2016-02-16T07:51:28Z")

</div>

Hmmm I obviously haven't explained adequately - sorry....

Logstash isn't reading anything from stdin. If I type at it and send EOF nothing is processed at all. I've tried using echo to pipe data into it (to eliminate any tty driver issues) but that makes no difference. I was expecting the output as indicated in the Getting Started pages.

```
logstash --help

```

does nothing (no output)

Actually, running

```
logstash _anything_

```

to attempt to generate errors does nothing. Something is definitely wrong...

Regarding where I got that command from, I was following the command here  
[https://www.elastic.co/guide/en/logstash/current/first-event.html](https://www.elastic.co/guide/en/logstash/current/first-event.html)

and added the DEBUG=1 environment variable after examining the head of bin/logstash inan attempt to see something erroring

---

<div class="post-metadata">

### Author: ![Mark\_Howells](https://avatars.discourse-cdn.com/v4/letter/m/ecae2f/32.png) [@Mark\_Howells](https://discuss.elastic.co/u/Mark_Howells)
#### Post date: [February 16, 2016, 7:55am UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/4 "2016-02-16T07:55:44Z")

</div>

BTW, I've just reread my first post and the tone is a bit harsh - sorry, but it was 2am locally when I wrote it and was tired. No excuse but it still doesn't work... 😉

---

<div class="post-metadata">

### Author: ![Mark\_Howells](https://avatars.discourse-cdn.com/v4/letter/m/ecae2f/32.png) [@Mark\_Howells](https://discuss.elastic.co/u/Mark_Howells)
#### Post date: [February 18, 2016, 1:22pm UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/5 "2016-02-18T13:22:04Z")

</div>

Well, so I tried again. Fresh installation onto a different server

Same issue.

I'm beginning to think that Logstash simply doesn't work on Ubuntu 12.04.

Anyone care to comment?

---

<div class="post-metadata">

### Author: ![Mark\_Howells](https://avatars.discourse-cdn.com/v4/letter/m/ecae2f/32.png) [@Mark\_Howells](https://discuss.elastic.co/u/Mark_Howells)
#### Post date: [February 18, 2016, 2:00pm UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/9 "2016-02-18T14:00:42Z")

</div>

Here's a [pastebin](http://pastebin.com/cJckKadG) of strace output

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 18, 2016, 2:45pm UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/10 "2016-02-18T14:45:17Z")

</div>

How about `strace -f` so that we can see what the Java process does and not just the launcher shell script?

---

<div class="post-metadata">

### Author: ![Mark\_Howells](https://avatars.discourse-cdn.com/v4/letter/m/ecae2f/32.png) [@Mark\_Howells](https://discuss.elastic.co/u/Mark_Howells)
#### Post date: [February 18, 2016, 2:58pm UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/11 "2016-02-18T14:58:35Z")

</div>

Sorry.[Like this](http://pastebin.com/xjPX3gPT) ?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 18, 2016, 3:24pm UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/12 "2016-02-18T15:24:07Z")

</div>

Hmm. The end looks like this:

```auto
[pid 23512] open("/usr/lib/jvm/java-7-openjdk-amd64/jre/lib/rt.jar", O_RDONLY) = 3
...
[pid 23512] lseek(3, 30487034, SEEK_SET) = 30487034
[pid 23512] read(3, "PK\3\4\24\0\10\10\10\0\267\0335H\0\0\0\0\0\0\0\0\0\0\0\0)\0\0\0", 30) = 30
[pid 23512] lseek(3, 30487105, SEEK_SET) = 30487105
[pid 23512] read(3, "\215QMO\0021\20}\5d\21P\24\277\277\"\301\30A\23\367\340\21cB\210&$\253\36$\\"..., 338) = 338
[pid 23512] lseek(3, 30486731, SEEK_SET) = 30486731
[pid 23512] read(3, "PK\3\4\24\0\10\10\10\0\265\0335H\0\0\0\0\0\0\0\0\0\0\0\0%\0\0\0", 30) = 30

```

If this is as far as it ever gets it looks like a JRuby problem. It doesn't look like it's even starting to load the Logstash Ruby source files.

---

<div class="post-metadata">

### Author: ![Mark\_Howells](https://avatars.discourse-cdn.com/v4/letter/m/ecae2f/32.png) [@Mark\_Howells](https://discuss.elastic.co/u/Mark_Howells)
#### Post date: [February 18, 2016, 3:34pm UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/13 "2016-02-18T15:34:06Z")

</div>

OK. I let it run a bit longer - the trace never finishes. Logfile is pasted [here](http://www.pastefile.com/8lAsoi)

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 18, 2016, 6:39pm UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/14 "2016-02-18T18:39:21Z")

</div>

Soryr, I'm drawing a blank here. There are _a lot_ of small reads of rt.jar but I'm sure if that's normal and, if not, why could be the cause of it. I'd try with a different JVM.

---

<div class="post-metadata">

### Author: ![Mark\_Howells](https://avatars.discourse-cdn.com/v4/letter/m/ecae2f/32.png) [@Mark\_Howells](https://discuss.elastic.co/u/Mark_Howells)
#### Post date: [February 20, 2016, 11:54am UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/15 "2016-02-20T11:54:27Z")

</div>

Sadly, I'm going to have to give up.

I've just spent a couple of hours uninstalling java (there were several variants installed) to a clean system and then installed Oracle's Java 7. I see _exactly_ the same symptom.

Although I like the idea behind LS it's just not stable enough for my needs ☹ - on Ubuntu 12.04 at least.

---

<div class="post-metadata">

### Author: ![Mark\_Howells](https://avatars.discourse-cdn.com/v4/letter/m/ecae2f/32.png) [@Mark\_Howells](https://discuss.elastic.co/u/Mark_Howells)
#### Post date: [February 20, 2016, 12:00pm UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/16 "2016-02-20T12:00:27Z")

</div>

just checked... Oracle's Java 8 does the same too. So that's the same error under 6 different JVM's...

---

<div class="post-metadata">

### Author: ![Joe\_Lawson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_lawson/32/3390_2.png) [@Joe\_Lawson](https://discuss.elastic.co/u/Joe_Lawson)
#### Post date: [February 20, 2016, 12:37pm UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/17 "2016-02-20T12:37:41Z")

</div>

What filesystem are you running on?

---

<div class="post-metadata">

### Author: ![Joe\_Lawson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_lawson/32/3390_2.png) [@Joe\_Lawson](https://discuss.elastic.co/u/Joe_Lawson)
#### Post date: [February 20, 2016, 12:52pm UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/18 "2016-02-20T12:52:47Z")

</div>

Could you describe your environment a little more? Can you run 12.04.5?  
This sounds like an issue with jruby firing. I googled around a bit for  
jruby hanging on Ubuntu and it seems like if there are entropy issues it  
can lead to jruby hanging with no obvious reason.

Anyone know if Logstash tests run on 12.04 boxes?

What filesystem are you running on?

---

<div class="post-metadata">

### Author: ![Joe\_Lawson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_lawson/32/3390_2.png) [@Joe\_Lawson](https://discuss.elastic.co/u/Joe_Lawson)
#### Post date: [February 20, 2016, 1:10pm UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/19 "2016-02-20T13:10:51Z")

</div>

Looks like from the trace you are running SELinux? Perhaps check its log as  
well.

---

<div class="post-metadata">

### Author: ![Mark\_Howells](https://avatars.discourse-cdn.com/v4/letter/m/ecae2f/32.png) [@Mark\_Howells](https://discuss.elastic.co/u/Mark_Howells)
#### Post date: [February 20, 2016, 1:27pm UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/20 "2016-02-20T13:27:32Z")

</div>

That's an interesting train of thought.

This is a VPS, running under OpenVZ so the filesystem is a proxy-filesystem known as simfs . SE-Linux will likely be running on the host, but it's not available to me.

In case it's relevant, the kernel is

```
root@me1:/opt/logstash# uname -a
Linux me1 2.6.32-042stab102.9 #1 SMP Fri Dec 19 20:34:40 MSK 2014 x86_64 x86_64 x86_64 GNU/Linux

```

Evidently, the environment is beyond my control.

I just installed from logstash\_2.2. **2** -1\_all.deb (I was previously installing from logstash\_2.2. **1** -1\_all.deb

---

<div class="post-metadata">

### Author: ![Joe\_Lawson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_lawson/32/3390_2.png) [@Joe\_Lawson](https://discuss.elastic.co/u/Joe_Lawson)
#### Post date: [February 20, 2016, 1:25pm UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/21 "2016-02-20T13:25:46Z")

</div>

Yeah I'm going to stick with entropy issues. The last real calls are to  
open /dev/random and /dev/urandom and then logs just repeat themselves.  
check this article out:

> **[How to Setup Additional Entropy for Cloud Servers Using Haveged | DigitalOcean](https://www.digitalocean.com/community/tutorials/how-to-setup-additional-entropy-for-cloud-servers-using-haveged)**
>
> Entropy is important, and haveged is an application that can provide your system with more of it.

---

<div class="post-metadata">

### Author: ![Joe\_Lawson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_lawson/32/3390_2.png) [@Joe\_Lawson](https://discuss.elastic.co/u/Joe_Lawson)
#### Post date: [February 20, 2016, 1:44pm UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/22 "2016-02-20T13:44:40Z")

</div>

Check this Google search out: [https://www.google.com/search?q=openvz+entropy](https://www.google.com/search?q=openvz+entropy)

---

<div class="post-metadata">

### Author: ![Joe\_Lawson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joe_lawson/32/3390_2.png) [@Joe\_Lawson](https://discuss.elastic.co/u/Joe_Lawson)
#### Post date: [February 20, 2016, 1:47pm UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831/23 "2016-02-20T13:47:22Z")

</div>

Also check out the Entropy section here:  
[https://github.com/jruby/jruby/wiki/Improving-startup-time](https://github.com/jruby/jruby/wiki/Improving-startup-time) and here:  
[https://github.com/jruby/jruby/issues/1896](https://github.com/jruby/jruby/issues/1896)

[Next page](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831.md?page=2)
