# Input File failure with high inode numbes

**URL:** <https://discuss.elastic.co/t/input-file-failure-with-high-inode-numbes/41858>\
**Category:** Logstash\
**Created:** [February 16, 2016, 8:58am UTC](https://discuss.elastic.co/t/input-file-failure-with-high-inode-numbes/41858 "2016-02-16T08:58:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![MVoelker](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@MVoelker](https://discuss.elastic.co/u/MVoelker)\
**Post date:** [February 16, 2016, 8:58am UTC](https://discuss.elastic.co/t/input-file-failure-with-high-inode-numbes/41858/1 "2016-02-16T08:58:12Z")

</div>

running logstash on RHEL 7 (logstash -2.2.1-1 / java-1.8.0-openjdk) and a very simple configuration:

more /etc/logstash/conf.d/\*  
::::::::::::::  
/etc/logstash/conf.d/10-input-messages  
::::::::::::::  
input {  
file {  
type =\> "linuxsyslog"  
path =\> "/BD/disk7/messages"  
sincedb\_path =\> "/APPL/.sincedb\_linux\_messages2"  
start\_position =\> "beginning"  
}  
}

::::::::::::::  
/etc/logstash/conf.d/90-output-stdout  
::::::::::::::  
output {  
stdout { codec =\> rubydebug { metadata =\> true } }  
}

No output from the inputfile message:

/opt/logstash/bin/logstash -f /etc/logstash/conf.d/ -w 2 -v  
Settings: User set pipeline workers: 2, Default pipeline workers: 24  
Registering file input {:path=\>["/BD/disk7/messages"], :level=\>:info}  
Starting pipeline {:id=\>"base", :pipeline\_workers=\>2, :batch\_size=\>125, :batch\_delay=\>5, :max\_inflight=\>250, :level=\>:info}  
Pipeline started {:level=\>:info}  
Logstash startup completed  
--- no file output---

I copied input file "/BD/disk7/messages" to "/BD/disk7/mess7" , changed that in 10-input-messages, and the logstash output was as expected:

/opt/logstash/bin/logstash -f /etc/logstash/conf.d/ -w 2 -v  
Settings: User set pipeline workers: 2, Default pipeline workers: 24  
Registering file input {:path=\>["/BD/disk7mess7"], :level=\>:info}  
Starting pipeline {:id=\>"base", :pipeline\_workers=\>2, :batch\_size=\>125, :batch\_delay=\>5, :max\_inflight=\>250, :level=\>:info}  
Pipeline started {:level=\>:info}  
Logstash startup completed  
{  
"message" =\> ...  
....

.sincedb content:  
0 0 0 0  
12 0 2161 1144

ls -lai /BD/disk7/mess\*  
12 -rwxr-x--- 1 root root 1144 Feb 16 09:05 /BD/disk7/mess7  
75497942 -rwxrwxrwx 1 root root 1144 Feb 2 21:00 /BD/disk7/messages

Looks like a problem with the quite high inode number of the file "messages", but its only a 2TB filesystem.  
df -HT | grep /BD/disk7  
/dev/sdh1 ext4 2.3T 11G 2.3T 1% /BD/disk7

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 16, 2016, 9:03am UTC](https://discuss.elastic.co/t/input-file-failure-with-high-inode-numbes/41858/2 "2016-02-16T09:03:39Z")

</div>

I don't think the high inode number has anything to do with things, but maybe it's a case of inode number reuse, i.e. Logstash thinks that it has already processed the file in question.

---

<div class="post-metadata">

**Author:** ![MVoelker](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@MVoelker](https://discuss.elastic.co/u/MVoelker)\
**Post date:** [February 16, 2016, 9:06am UTC](https://discuss.elastic.co/t/input-file-failure-with-high-inode-numbes/41858/3 "2016-02-16T09:06:41Z")

</div>

I deleted the .sincedb file before running logstash.  
I never saw the high inode number "75497942" in the .sincedb file, only:  
0 0 0 0

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:11am UTC](https://discuss.elastic.co/t/input-file-failure-with-high-inode-numbes/41858/4 "2017-07-06T05:11:17Z")

</div>


