# Logstash not tracking the current position in HP-UNIX

**URL:** <https://discuss.elastic.co/t/logstash-not-tracking-the-current-position-in-hp-unix/24283>\
**Category:** Logstash\
**Created:** [June 24, 2015, 5:12pm UTC](https://discuss.elastic.co/t/logstash-not-tracking-the-current-position-in-hp-unix/24283 "2015-06-24T17:12:23Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kumaravel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kumaravel/32/52534_2.png) [@Kumaravel](https://discuss.elastic.co/u/Kumaravel)\
**Post date:** [June 24, 2015, 5:12pm UTC](https://discuss.elastic.co/t/logstash-not-tracking-the-current-position-in-hp-unix/24283/1 "2015-06-24T17:12:23Z")

</div>

Hi,

I am still facing issue for tracking the current position of the log file being read.  
Whenever I restart the logstash agent, it starts reading for the start due to which I am getting duplicate entries in my elastic search.

Please help to solve this issue

---

<div class="post-metadata">

**Author:** ![michaellizhou](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michaellizhou/32/4143_2.png) [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\
**Post date:** [June 24, 2015, 9:38pm UTC](https://discuss.elastic.co/t/logstash-not-tracking-the-current-position-in-hp-unix/24283/2 "2015-06-24T21:38:48Z")

</div>

This sounds like a sincedb problem. What is your config when you try to load your input files? I know there is a dev input style that people use when they want to make sure logstash is working. If you want to clear your elasticsearch just send it a curl -XDELETE 'localhost:9200/\_all'. That is the default command

---

<div class="post-metadata">

**Author:** ![Kumaravel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kumaravel/32/52534_2.png) [@Kumaravel](https://discuss.elastic.co/u/Kumaravel)\
**Post date:** [June 25, 2015, 1:27am UTC](https://discuss.elastic.co/t/logstash-not-tracking-the-current-position-in-hp-unix/24283/3 "2015-06-25T01:27:15Z")

</div>

My config while trying to load a file like this  
input{  
file{  
Path=\>"/etc/sample.log"  
type=\>"sample"  
sincedb =\>"/etc/"  
}  
}

The command to delete the logs from elastic search may be useful but that cannot be done everytime i restart logstash in production environment.

Is there any solution for this problem?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 25, 2015, 5:38am UTC](https://discuss.elastic.co/t/logstash-not-tracking-the-current-position-in-hp-unix/24283/4 "2015-06-25T05:38:55Z")

</div>

In the past when people have had HP-UX issues I believe it's been because of JRuby problems and that's not easily fixed by the Logstash folks. HP-UX isn't an officially supported platform for Logstash; see [https://www.elastic.co/subscriptions/matrix](https://www.elastic.co/subscriptions/matrix).

Note that with `sincedb => "/etc/"` you need to run Logstash as a user with write permissions to /etc, which typically means root. Are you? (If yes, stop doing it. Logstash should not run as root.)

---

<div class="post-metadata">

**Author:** ![jsvd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsvd/32/6203_2.png) [@jsvd](https://discuss.elastic.co/u/jsvd)\
**Post date:** [July 6, 2015, 5:47pm UTC](https://discuss.elastic.co/t/logstash-not-tracking-the-current-position-in-hp-unix/24283/5 "2015-07-06T17:47:57Z")

</div>

@Kumaravel try using a full path to sincedb instead of a directory, like

```
file {
  path => "/etc/sample.log"
  sincedb_path => "/etc/since.db"
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/logstash-not-tracking-the-current-position-in-hp-unix/24283/6 "2017-07-06T05:35:29Z")

</div>

Closed on July 6, 2017, 5:35am UTC