# Help with identifying cause of Netflow IPFIX UDP service crashing randomly
**URL:** https://discuss.elastic.co/t/help-with-identifying-cause-of-netflow-ipfix-udp-service-crashing-randomly/100609
**Category:** Logstash
**Created:** [September 14, 2017, 9:43pm UTC](https://discuss.elastic.co/t/help-with-identifying-cause-of-netflow-ipfix-udp-service-crashing-randomly/100609 "2017-09-14T21:43:26Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@gtyrer](https://discuss.elastic.co/u/gtyrer)
#### Post date: [September 14, 2017, 9:43pm UTC](https://discuss.elastic.co/t/help-with-identifying-cause-of-netflow-ipfix-udp-service-crashing-randomly/100609/1 "2017-09-14T21:43:26Z")
Hi, complete newbie here.
I have setup a Debian 9.1 server running logstash 5.6.0 along with the logstash-codec-netflow (3.5.2) plugin. Input is IPFIX and output to another server running Elasticsearch. (Test environment) I get around 70 000 events a minute into elastic so it is working but what I have noticed is that the the UDP listener dies and restarts randomly. I have set java xms and xmx to 4g just incase it is running out of memory but I suspect it is something else; also have 6 input workers running.
I can see the following in the syslog at the times when it restarts:
Sep 15 07:31:24 TEST logstash[7196]: SystemStackError: stack level too deep
Sep 15 07:31:24 TEST logstash[7196]: module\_eval at org/jruby/RubyModule.java:2346
Sep 15 07:31:24 TEST logstash[7196]: define\_methods at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/int.rb:47
Sep 15 07:31:24 TEST logstash[7196]: Uint524280be at (eval):2
Sep 15 07:31:24 TEST logstash[7196]: (eval) at (eval):1
Sep 15 07:31:24 TEST logstash[7196]: module\_eval at org/jruby/RubyModule.java:2346
Sep 15 07:31:24 TEST logstash[7196]: define\_class at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/int.rb:13
Sep 15 07:31:24 TEST logstash[7196]: const\_missing at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/int.rb:198
Sep 15 07:31:24 TEST logstash[7196]: each\_pair at org/jruby/RubyHash.java:1367
Sep 15 07:31:24 TEST logstash[7196]: const\_missing at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/int.rb:194
Sep 15 07:31:24 TEST logstash[7196]: const\_get at org/jruby/RubyModule.java:2646
Sep 15 07:31:24 TEST logstash[7196]: register\_dynamic\_class at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/registry.rb:111
Sep 15 07:31:24 TEST logstash[7196]: registered? at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/registry.rb:102
Sep 15 07:31:24 TEST logstash[7196]: normalize\_name at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/registry.rb:71
Sep 15 07:31:24 TEST logstash[7196]: each at org/jruby/RubyArray.java:1613
Sep 15 07:31:24 TEST logstash[7196]: normalize\_name at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/registry.rb:63
Sep 15 07:31:24 TEST logstash[7196]: lookup at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/registry.rb:40
```
/* remove some lines due to topic limit of 7000 characters */
Sep 15 07:31:24 TEST logstash[7196]: sanitize_parameters! at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/struct.rb:345
Sep 15 07:31:24 TEST logstash[7196]: sanitize! at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/sanitize.rb:302
Sep 15 07:31:24 TEST logstash[7196]: initialize at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/sanitize.rb:210
Sep 15 07:31:24 TEST logstash[7196]: sanitize at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/sanitize.rb:192
Sep 15 07:31:24 TEST logstash[7196]: extract_args at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/base.rb:302
Sep 15 07:31:24 TEST logstash[7196]: extract_args at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/base.rb:249
Sep 15 07:31:24 TEST logstash[7196]: initialize at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/base.rb:81
Sep 15 07:31:24 TEST logstash[7196]: initialize_with_warning at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/warnings.rb:21
Sep 15 07:31:24 TEST logstash[7196]: decode_ipfix at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-3.5.2/lib/logstash/codecs/netflow.rb:318
Sep 15 07:31:24 TEST logstash[7196]: catch at org/jruby/RubyKernel.java:1242
Sep 15 07:31:24 TEST logstash[7196]: decode_ipfix at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-3.5.2/lib/logstash/codecs/netflow.rb:303
Sep 15 07:31:24 TEST logstash[7196]: each at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208
Sep 15 07:31:24 TEST logstash[7196]: each at org/jruby/RubyArray.java:1613
Sep 15 07:31:24 TEST logstash[7196]: each at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208
Sep 15 07:31:24 TEST logstash[7196]: decode_ipfix at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-3.5.2/lib/logstash/codecs/netflow.rb:302
Sep 15 07:31:24 TEST logstash[7196]: decode at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-3.5.2/lib/logstash/codecs/netflow.rb:124
Sep 15 07:31:24 TEST logstash[7196]: each at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208
Sep 15 07:31:24 TEST logstash[7196]: each at org/jruby/RubyArray.java:1613
Sep 15 07:31:24 TEST logstash[7196]: each at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/bindata-2.4.0/lib/bindata/array.rb:208
Sep 15 07:31:24 TEST logstash[7196]: decode at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-netflow-3.5.2/lib/logstash/codecs/netflow.rb:123
Sep 15 07:31:24 TEST logstash[7196]: inputworker at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1.2/lib/logstash/inputs/udp.rb:118
Sep 15 07:31:24 TEST logstash[7196]: udp_listener at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-udp-3.1.2/lib/logstash/inputs/udp.rb:89
Sep 15 07:31:25 TEST systemd[1]: logstash.service: Main process exited, code=exited, status=1/FAILURE
Sep 15 07:31:25 TEST systemd[1]: logstash.service: Unit entered failed state.
Sep 15 07:31:25 TEST systemd[1]: logstash.service: Failed with result 'exit-code'.
Sep 15 07:31:25 TEST systemd[1]: logstash.service: Service hold-off time over, scheduling restart.
Sep 15 07:31:25 TEST systemd[1]: Stopped logstash.
Sep 15 07:31:25 TEST systemd[1]: Started logstash.
```
any help would be appreciated.
---
### Author:  [@NerdSec](https://discuss.elastic.co/u/NerdSec)
#### Post date: [September 15, 2017, 3:02am UTC](https://discuss.elastic.co/t/help-with-identifying-cause-of-netflow-ipfix-udp-service-crashing-randomly/100609/2 "2017-09-15T03:02:35Z")
The output that is pasted is not formatted. Could you please format it to make it readable?
Also, what is the config?
On what port is the listener running?
And who is the user running logstash? Privileged or non privileged?
Regards
N
---
### Author:  [@gtyrer](https://discuss.elastic.co/u/gtyrer)
#### Post date: [September 15, 2017, 3:37am UTC](https://discuss.elastic.co/t/help-with-identifying-cause-of-netflow-ipfix-udp-service-crashing-randomly/100609/3 "2017-09-15T03:37:22Z")
It seems my ignorance broke it; I was attemtping to use a custom ipfix\_definitions file in my config; once remove all was stable again.
thanks for asking the question 😄
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 13, 2017, 3:37am UTC](https://discuss.elastic.co/t/help-with-identifying-cause-of-netflow-ipfix-udp-service-crashing-randomly/100609/4 "2017-10-13T03:37:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.