# Is Filebeat, Log courier and logstash supported for CentOS RHEL 5?
**URL:** https://discuss.elastic.co/t/is-filebeat-log-courier-and-logstash-supported-for-centos-rhel-5/66740
**Category:** Beats
**Tags:** filebeat
**Created:** [November 21, 2016, 3:11pm UTC](https://discuss.elastic.co/t/is-filebeat-log-courier-and-logstash-supported-for-centos-rhel-5/66740 "2016-11-21T15:11:45Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@ajeevpk](https://discuss.elastic.co/u/ajeevpk)
#### Post date: [November 21, 2016, 3:11pm UTC](https://discuss.elastic.co/t/is-filebeat-log-courier-and-logstash-supported-for-centos-rhel-5/66740/1 "2016-11-21T15:11:45Z")
Hi ,
I want a light weight log forwarder in RHEL5 machine, looks like Filebeat, Log courier and logstash **NOT** supported for CentOS RHEL 5.
Can some one help me resolve this error
[root@ctp-fcpld1app11 ~]# service filebeat start
Starting filebeat: 2016/11/10 11:50:21.449037 beat.go:135: DBG Initializing output plugins
2016/11/10 11:50:21.449186 geolite.go:24: INFO GeoIP disabled: No paths were set under output.geoip.paths
2016/11/10 11:50:21.455787 logstash.go:106: INFO Max Retries set to: 3
2016/11/10 11:50:21.455965 client.go:100: DBG connect
2016/11/10 11:50:21.456445 client.go:100: DBG connect
2016/11/10 11:50:21.459475 outputs.go:126: INFO Activated logstash as output plugin.
2016/11/10 11:50:21.460778 publish.go:232: DBG Create output worker
2016/11/10 11:50:21.462226 publish.go:274: DBG No output is defined to store the topology. The server fields might not be filled.
2016/11/10 11:50:21.462588 publish.go:288: INFO Publisher name: ctp-fcpld1app11
2016/11/10 11:50:21.463651 async.go:78: INFO Flush Interval set to: 1s
2016/11/10 11:50:21.463862 async.go:84: INFO Max Bulk Size set to: 2048
2016/11/10 11:50:21.464056 async.go:92: DBG create bulk processing worker (interval=1s, bulk size=2048)
2016/11/10 11:50:21.464523 beat.go:147: **INFO Init Beat: filebeat; Version: 1.2.3**
**FATAL: kernel too old**
/bin/bash: line 1: 16545 Segmentation fault filebeat-god -r / -n -p /var/run/filebeat.pid -- /usr/bin/filebeat -c /etc/filebeat/filebeat.yml
[FAILED]
[root@ctp-fcpld1app11 ~]#
Is log-courier not compatible with RHEL5?
[root@podrbccls3etl01 local\_log\_courier]# rpm -ivh zeromq3-3.2.5-1.el6.x86\_64.rpm
warning: zeromq3-3.2.5-1.el6.x86\_64.rpm: Header V3 RSA/SHA256 signature: NOKEY, key ID 0608b895
error: Failed dependencies:
libc.so.6(GLIBC\_2.7)(64bit) is needed by zeromq3-3.2.5-1.el6.x86\_64
libpgm-5.1.so.0()(64bit) is needed by zeromq3-3.2.5-1.el6.x86\_64
libstdc++.so.6(GLIBCXX\_3.4.9)(64bit) is needed by zeromq3-3.2.5-1.el6.x86\_64
rpmlib(FileDigests) \<= 4.6.0-1 is needed by zeromq3-3.2.5-1.el6.x86\_64
rpmlib(PayloadIsXz) \<= 5.2-1 is needed by zeromq3-3.2.5-1.el6.x86\_64
Thanks,
Ajeev
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [November 21, 2016, 3:23pm UTC](https://discuss.elastic.co/t/is-filebeat-log-courier-and-logstash-supported-for-centos-rhel-5/66740/2 "2016-11-21T15:23:22Z")
Both Filebeat and Log Courier are written in Go. Go is not supported on RHEL5. (Some newer RHEL 5 kernels _[may](https://dave.cheney.net/2013/06/18/how-to-install-go-1-1-on-centos-5)_ work, but it's still not officially supported).
Logstash uses the JVM so if you can meet the JVM version requirements you may be able to get LS to run. Running LS on RHEL5 is [not officially supported](https://www.elastic.co/support/matrix) by Elastic.
---
### Author:  [@Eric\_S](https://discuss.elastic.co/u/Eric_S)
#### Post date: [November 21, 2016, 3:47pm UTC](https://discuss.elastic.co/t/is-filebeat-log-courier-and-logstash-supported-for-centos-rhel-5/66740/3 "2016-11-21T15:47:57Z")
i got kernel too old msg when i tried to run filebeat:
Starting filebeat: FATAL: kernel too old
here is my RHEL version:
LSB Version: :core-4.0-amd64:core-4.0-ia32:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-ia32:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-ia32:printing-4.0-noarch
Distributor ID: RedHatEnterpriseServer
Description: Red Hat Enterprise Linux Server release 5.11 (Tikanga)
Release: 5.11
Codename: Tikanga
kernel version:
kernel-2.6.18-409.el5
kernel-2.6.18-412.el5
kernel-2.6.18-416.el5
---
### Author:  [@Eric\_S](https://discuss.elastic.co/u/Eric_S)
#### Post date: [November 21, 2016, 3:59pm UTC](https://discuss.elastic.co/t/is-filebeat-log-courier-and-logstash-supported-for-centos-rhel-5/66740/4 "2016-11-21T15:59:28Z")
Andrew, are you saying that after build go 1.1 on my RHEL5-2.6.18.409.el5 kernel machine, beats might be able to run?
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [November 21, 2016, 4:15pm UTC](https://discuss.elastic.co/t/is-filebeat-log-courier-and-logstash-supported-for-centos-rhel-5/66740/5 "2016-11-21T16:15:31Z")
No, it was my understanding based on that blog post that there is a chance that a Go program might be able to run on certain RHEL5 kernels (no need to rebuild FB).
Can you trying running Filebeat directly and not as a service (e.g. `filebeat -c /etc/filebeat/filebeat.yml -e - v -d "*"`).
The "kernel too old" is probably coming from filebeat-god which is not a Go program and will need to be compiled for RHEL 5. `filebeat-god` is used to help daemonize the filebeat process in the init script. It's a build of [https://github.com/tsg/go-daemon](https://github.com/tsg/go-daemon).
---
### Author:  [@Eric\_S](https://discuss.elastic.co/u/Eric_S)
#### Post date: [November 21, 2016, 4:29pm UTC](https://discuss.elastic.co/t/is-filebeat-log-courier-and-logstash-supported-for-centos-rhel-5/66740/6 "2016-11-21T16:29:12Z")
ha, it's working i think. there is no any console output on "filebeat -c /etc/filebeat/filebeat.yml -e - v -d "\*"" but i can see msg coming in on my kibana frontend now.
i have filebeat running on RHEL5 box, then logstash, ES and Kibana on ubuntu 16 box waiting for filebeat. seems like it's working.
---
### Author:  [@Eric\_S](https://discuss.elastic.co/u/Eric_S)
#### Post date: [November 21, 2016, 4:33pm UTC](https://discuss.elastic.co/t/is-filebeat-log-courier-and-logstash-supported-for-centos-rhel-5/66740/7 "2016-11-21T16:33:06Z")
thanks so much andrew.
now since i'm a newbie on linux and beats. could you pls help me on below 2 questions:
1. how do i setup filebeats to run as a service on RHEL5?
2. what is the command to run packetbeat manually? (packetbeat is the one i want install and run next)
thanks again.
---
### Author:  [@Eric\_S](https://discuss.elastic.co/u/Eric_S)
#### Post date: [November 21, 2016, 6:39pm UTC](https://discuss.elastic.co/t/is-filebeat-log-courier-and-logstash-supported-for-centos-rhel-5/66740/8 "2016-11-21T18:39:36Z")
for packetbeat, when i try to start it with:
sudo /etc/init.d/packetbeat start
i got below error msg:
Starting packetbeat: /usr/bin/packetbeat: /lib64/libc.so.6: version `GLIBC\_2.7' not found (required by /usr/bin/packetbeat)
run: nm /usr/bin/packetbeat |grep GLIBC\_2.7
i got: U \_\_isoc99\_sscanf@@GLIBC\_2.7
seems that my RHEL5 don't have GLIBC2.7 which packetbeat needs to use \_iscc99\_sscanf function. Any idea?
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [November 21, 2016, 7:17pm UTC](https://discuss.elastic.co/t/is-filebeat-log-courier-and-logstash-supported-for-centos-rhel-5/66740/9 "2016-11-21T19:17:07Z")
> [@Eric\_S](#):
>
> 1. how do i setup filebeats to run as a service on RHEL5?
Either build a go-daemon for RHEL 5 and replace the filebeat-god binary (probably the init.d script would work as is if you did that). Or try hacking on the init script to not use filebeat-god.
> [@Eric\_S](#):
>
> 1. what is the command to run packetbeat manually?
See docs: [Debug | Packetbeat Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/packetbeat/current/enable-packetbeat-debugging.html)
`packetbeat -c /etc/packetbeat/packetbeat.yml -e -d "*"`
Packetbeat is different from Filebeat in that it depends on C libraries. You'll probably need to setup Go in your RHEL5 environment and build Packetbeat.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 19, 2016, 7:17pm UTC](https://discuss.elastic.co/t/is-filebeat-log-courier-and-logstash-supported-for-centos-rhel-5/66740/10 "2016-12-19T19:17:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.