# Logstash eating memory and eventually gets oom-killed

**URL:** <https://discuss.elastic.co/t/logstash-eating-memory-and-eventually-gets-oom-killed/205701>\
**Category:** Logstash\
**Created:** [October 29, 2019, 3:09pm UTC](https://discuss.elastic.co/t/logstash-eating-memory-and-eventually-gets-oom-killed/205701 "2019-10-29T15:09:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Peter\_Holm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peter_holm/32/49232_2.png) [@Peter\_Holm](https://discuss.elastic.co/u/Peter_Holm)\
**Post date:** [October 29, 2019, 3:09pm UTC](https://discuss.elastic.co/t/logstash-eating-memory-and-eventually-gets-oom-killed/205701/1 "2019-10-29T15:09:57Z")

</div>

I'm running logstash 7.2.0 on a Linux on z RHEL 7.4 64 bits. Everything works just fine, ie elasticsearch, logstash, kibana, for a about 1-1.5 day then logstash gets killed by the OS as a OOM. I have changed heap size in jvm.options from 1G to 2G but no real difference. The virtual memory is increasing all the time and eventually it is around 20GB it gets killed. If I restart logstash things start to flow nicely again for another 1-1.5 days.  
Oct 29 15:17:09 rl210619 kernel: Out of memory: Kill process 54400 (java) score 839 or sacrifice child  
Oct 29 15:17:09 rl210619 kernel: Killed process 54400 (java) total-vm:20772680kB, anon-rss:14015480kB, file-rss:24kB, shmem-rss:0kB  
Any idea what I can do?  
Thanks  
Peter

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 29, 2019, 3:21pm UTC](https://discuss.elastic.co/t/logstash-eating-memory-and-eventually-gets-oom-killed/205701/2 "2019-10-29T15:21:06Z")

</div>

If you have a 20 GB JVM with a 1 GB heap then it is holding on to large amounts of native memory. This could be due to finalization delays. Take a dump and see what the finalization queue looks like.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2019, 3:21pm UTC](https://discuss.elastic.co/t/logstash-eating-memory-and-eventually-gets-oom-killed/205701/3 "2019-11-26T15:21:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.