# Logstash Lumberjack Input Stops Processing **URL:** \ **Category:** Logstash\ **Created:** [May 20, 2015, 8:33pm UTC](https://discuss.elastic.co/t/logstash-lumberjack-input-stops-processing/1031 "2015-05-20T20:33:06Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![David\_Kleiner](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Kleiner](https://discuss.elastic.co/u/David_Kleiner)\ **Post date:** [May 20, 2015, 8:33pm UTC](https://discuss.elastic.co/t/logstash-lumberjack-input-stops-processing/1031/1 "2015-05-20T20:33:06Z")
Logstash 1.5.0 released version, logstash lumberjack input / rabbitMQ output goes idle after a few hours, in the log: ``` 2015-05-20_02:19:15.40710 {:timestamp=>"2015-05-19T21:19:15.406000-0500", :message=>"Lumberjack input, maximum connection exceeded, new connection are rejected.", :max_clients=>nil, :level=>:warn}`` ``` The doc states that max\_clients is being deprecated, should I still set it to a high number to stop this from happening? Thank you, David ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 20, 2015, 11:29pm UTC](https://discuss.elastic.co/t/logstash-lumberjack-input-stops-processing/1031/2 "2015-05-20T23:29:22Z")
This looks very similar - [https://github.com/elastic/logstash/issues/3277](https://github.com/elastic/logstash/issues/3277) ---
**Author:** ![David\_Kleiner](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Kleiner](https://discuss.elastic.co/u/David_Kleiner)\ **Post date:** [May 21, 2015, 4:30am UTC](https://discuss.elastic.co/t/logstash-lumberjack-input-stops-processing/1031/3 "2015-05-21T04:30:34Z")
Thank you Mark, logstash-forwarder client is reporting i/o timeout: ``` 2015/05/20 23:27:12.495674 Read error looking for ack: read tcp 10.x.x.x:1601: i/o timeout 2015/05/20 23:27:12.495749 Setting trusted CA from file: /etc/ssl/lumberjack.crt 2015/05/20 23:27:12.497319 Connecting to [10.x.x.x]:1601 (lumberjack.company.com) 2015/05/20 23:27:12.548516 Connected to 10.x.x.x 2015/05/20 23:27:27.548691 Read error looking for ack: read tcp 10.x.x.x:1601: i/o timeout ``` ---
**Author:** ![David\_Kleiner](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Kleiner](https://discuss.elastic.co/u/David_Kleiner)\ **Post date:** [May 22, 2015, 10:13pm UTC](https://discuss.elastic.co/t/logstash-lumberjack-input-stops-processing/1031/4 "2015-05-22T22:13:57Z")
I updated the config of the receiving LogStash process to use 8 workers and it no longer hangs, the flow is smooth again. ---
**Author:** ![m\_abdelfattah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m_abdelfattah/32/433_2.png) [@m\_abdelfattah](https://discuss.elastic.co/u/m_abdelfattah)\ **Post date:** [May 28, 2015, 3:01pm UTC](https://discuss.elastic.co/t/logstash-lumberjack-input-stops-processing/1031/5 "2015-05-28T15:01:29Z")
How did you increase the workers David? as we have 20 logstash-forwarders on remote servers that send logs to 1 logstash. We run logstash as a service. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 28, 2015, 6:35pm UTC](https://discuss.elastic.co/t/logstash-lumberjack-input-stops-processing/1031/6 "2015-05-28T18:35:46Z")
Use the `-w` startup option to Logstash to change the number of filtering threads. ---
**Author:** ![David\_Kleiner](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Kleiner](https://discuss.elastic.co/u/David_Kleiner)\ **Post date:** [May 28, 2015, 7:34pm UTC](https://discuss.elastic.co/t/logstash-lumberjack-input-stops-processing/1031/7 "2015-05-28T19:34:55Z")
Thank you Magnus, that's indeed what I've done: ``` exec chpst -u woot ./bin/logstash agent -f /home/woot/logstash/backend-feed.conf -w 12 ``` ---
**Author:** ![m\_abdelfattah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m_abdelfattah/32/433_2.png) [@m\_abdelfattah](https://discuss.elastic.co/u/m_abdelfattah)\ **Post date:** [June 5, 2015, 7:07pm UTC](https://discuss.elastic.co/t/logstash-lumberjack-input-stops-processing/1031/8 "2015-06-05T19:07:22Z")
I tried to edit /etc/init.d/logstash on line 45, and add -w 12 as follows ``` args="agent -f ${LS_CONF_DIR} -w 12 -l ${LS_LOG_FILE} ${LS_OPTS}" ``` then restarted the service but it doesn't add "-w 12", not sure why! ---
**Author:** ![David\_Kleiner](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Kleiner](https://discuss.elastic.co/u/David_Kleiner)\ **Post date:** [June 5, 2015, 8:53pm UTC](https://discuss.elastic.co/t/logstash-lumberjack-input-stops-processing/1031/9 "2015-06-05T20:53:21Z")
Hello Mahmoud, Mine is working fine: sv run: ``` exec chpst -u woot ./bin/logstash agent -f /home/woot/logstash/backend-feed.conf -w 12 ``` the process: ``` woot 31829 41.0 2.3 13766180 773052 ? Sl May28 4576:06 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Xmx500m -Xss2048k -Djffi.boot.library.path=/home/woot/dk/logstash-1.5.0.rc4/vendor/jruby/lib/jni -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Xbootclasspath/a:/home/woot/dk/logstash-1.5.0.rc4/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/home/woot/dk/logstash-1.5.0.rc4/vendor/jruby -Djruby.lib=/home/woot/dk/logstash-1.5.0.rc4/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main --1.9 /home/woot/dk/logstash-1.5.0.rc4/lib/bootstrap/environment.rb logstash/runner.rb agent -f /home/woot/logstash/backend-feed.conf -w 12 ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:38am UTC](https://discuss.elastic.co/t/logstash-lumberjack-input-stops-processing/1031/10 "2017-07-06T05:38:19Z")