# Logstash 2.3.3 does not run as a service on red hat

**URL:** <https://discuss.elastic.co/t/logstash-2-3-3-does-not-run-as-a-service-on-red-hat/54718>\
**Category:** Logstash\
**Created:** [July 5, 2016, 10:37am UTC](https://discuss.elastic.co/t/logstash-2-3-3-does-not-run-as-a-service-on-red-hat/54718 "2016-07-05T10:37:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![arek](https://avatars.discourse-cdn.com/v4/letter/a/46a35a/32.png) [@arek](https://discuss.elastic.co/u/arek)\
**Post date:** [July 5, 2016, 10:37am UTC](https://discuss.elastic.co/t/logstash-2-3-3-does-not-run-as-a-service-on-red-hat/54718/1 "2016-07-05T10:37:32Z")

</div>

Hi,  
I downloaded .tar version of logstash 2.3.3 and trying to running it as service, but it fails. My system is Red Hat Enterprise Linux Server release 6.6 (Santiago).  
When I am testing configuration file everything's ok:

```
./bin/logstash -f /var/opt/logstash-2.3.3/config/05-redis.conf --configtest
Configuration OK'

```

When I am starting logstash it also works fine:

```
./bin/logstash -f /var/opt/logstash-2.3.3/config/05-redis.conf
Settings: Default pipeline workers: 4
Pipeline main started

```

When I am trying to start logstash as a service it fails. I'm using init script that was used with logstash 1.5 (maybe this is the root cause, but it worked with logstash 1.5) :

```
#!/bin/sh
# Init script for logstash
# Maintained by Elasticsearch
# Generated by pleaserun.
# Implemented based on LSB Core 3.1:

PATH=/sbin:/usr/sbin:/bin:/usr/bin
export PATH

if [`id -u` -ne 0]; then
   echo "You need root privileges to run this script"
   exit 1
fi

name=logstash
pidfile="/var/run/$name.pid"

LS_USER=elk
LS_GROUP=elk
LS_HOME=/var/opt/logstash-2.3.3
LS_HEAP_SIZE="500m"
LS_JAVA_OPTS="-Djava.io.tmpdir=${LS_HOME}"
LS_LOG_DIR=/var/opt/logstash-2.3.3/log
LS_LOG_FILE="${LS_LOG_DIR}/$name.log"
LS_CONF_DIR=/var/opt/logstash-2.3.3/config
LS_OPEN_FILES=16384
LS_NICE=19
LS_OPTS=""

[-r /etc/default/$name] && . /etc/default/$name
[-r /etc/sysconfig/$name] && . /etc/sysconfig/$name

program=$LS_HOME/bin/logstash
args="agent -f ${LS_CONF_DIR} -l ${LS_LOG_FILE} ${LS_OPTS}"

start() {

  JAVA_OPTS=${LS_JAVA_OPTS}
  HOME=${LS_HOME}
  export PATH HOME JAVA_OPTS LS_HEAP_SIZE LS_JAVA_OPTS LS_USE_GC_LOGGING

  # set ulimit as (root, presumably) first, before we drop privileges
  ulimit -n ${LS_OPEN_FILES}

  # Run the program!
  nice -n ${LS_NICE} chroot --userspec $LS_USER:$LS_GROUP / sh -c "
    cd $LS_HOME
    ulimit -n ${LS_OPEN_FILES}
    exec \"$program\" $args
  " > "${LS_LOG_DIR}/$name.stdout" 2> "${LS_LOG_DIR}/$name.err" &

  # Generate the pidfile from here. If we instead made the forked process
  # generate it there will be a race condition between the pidfile writing
  # and a process possibly asking for status.
  echo $! > $pidfile

  echo "$name started."
  return 0
}

stop() {
  # Try a few times to kill TERM the program
  if status ; then
    pid=`cat "$pidfile"`
    echo "Killing $name (pid $pid) with SIGTERM"
    kill -TERM $pid
    # Wait for it to exit.
    for i in 1 2 3 4 5 ; do
      echo "Waiting $name (pid $pid) to die..."
      status || break
      sleep 1
    done
    if status ; then
      echo "$name stop failed; still running."
    else
      echo "$name stopped."
    fi
  fi
}

status() {
  if [-f "$pidfile"] ; then
    pid=`cat "$pidfile"`
    if kill -0 $pid > /dev/null 2> /dev/null ; then
      # process by this pid is running.
      # It may not be our pid, but that's what you get with just pidfiles.
      # TODO(sissel): Check if this process seems to be the same as the one we
      # expect. It'd be nice to use flock here, but flock uses fork, not exec,
      # so it makes it quite awkward to use in this case.
      return 0
    else
      return 2 # program is dead but pid file exists
    fi
  else
    return 3 # program is not running
  fi
}

force_stop() {
  if status ; then
    stop
    status && kill -KILL `cat "$pidfile"`
  fi
}

case "$1" in
  start)
    status
    code=$?
    if [$code -eq 0]; then
      echo "$name is already running"
    else
      start
      code=$?
    fi
    exit $code
    ;;
  stop) stop ;;
  force-stop) force_stop ;;
  status) 
    status
    code=$?
    if [$code -eq 0] ; then
      echo "$name is running"
    else
      echo "$name is not running"
    fi
    exit $code
    ;;
  restart) 
    
    stop && start 
    ;;
  *)
    echo "Usage: $SCRIPTNAME {start|stop|force-stop|status|restart}" >&2
    exit 3
  ;;
esac

exit $?

```

I am starting logstash:

```
service logstash start
logstash started.

```

But it does not start:

```
 service logstash status
logstash is not running

```

My RedHat is not connected to internet so .tar file seemed to be good option. I also added elk user to adm group which did not help  
Thanks in advance for all hints!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 5, 2016, 10:38am UTC](https://discuss.elastic.co/t/logstash-2-3-3-does-not-run-as-a-service-on-red-hat/54718/2 "2016-07-05T10:38:55Z")

</div>

Wy not use the RPM repos, that comes with a bundled service file.

---

<div class="post-metadata">

**Author:** ![arek](https://avatars.discourse-cdn.com/v4/letter/a/46a35a/32.png) [@arek](https://discuss.elastic.co/u/arek)\
**Post date:** [July 5, 2016, 2:49pm UTC](https://discuss.elastic.co/t/logstash-2-3-3-does-not-run-as-a-service-on-red-hat/54718/3 "2016-07-05T14:49:37Z")

</div>

I downloaded .rpm repo and skipped init script mentioned above. Logstash is working fine.  
Thank you for hint.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/logstash-2-3-3-does-not-run-as-a-service-on-red-hat/54718/4 "2017-07-06T04:49:26Z")

</div>