Logstash open file descriptors only increases

Elastic Stack Logstash
1

Hello.
I have a problem with logstash (logstash 7.12.1)

image
image1378×276 64.9 KB

file descriptors only increases. I set limits to 50000, but on another host, with the same config i have:
image
image1784×277 110 KB

may be somebody knows about this? :blush:

2

Solution:
File desriptors opened by attempts to start listen 514 port (syslog), however logstash user haven't had permissions to this operation, so descriptors couldn't become closed.
After remove syslog from my input to logstash problem has gone.
:blush:

3

That feels very much like a bug. Running

input { syslog {} }
output { stdout { codec => rubydebug { metadata => false } } }

with a non-priviliged user results in lsof showing an ever increasing number of open files. The errors that are logged are

[2021-10-15T13:52:46,426][WARN ][logstash.inputs.syslog   ][main][d2aa53ecc994ad31a69c9075a3104af82d3db4575af93e207a9b4c77fce875a2] syslog listener died {:protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2)>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:129:in `initialize'", "org/jruby/RubyIO.java:876:in `new'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:208:in `tcp_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:172:in `server'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:156:in `block in run'"]}
[2021-10-15T13:52:46,473][INFO ][logstash.inputs.syslog   ][main][d2aa53ecc994ad31a69c9075a3104af82d3db4575af93e207a9b4c77fce875a2] Starting syslog udp listener {:address=>"0.0.0.0:514"}
[2021-10-15T13:52:46,473][WARN ][logstash.inputs.syslog   ][main][d2aa53ecc994ad31a69c9075a3104af82d3db4575af93e207a9b4c77fce875a2] syslog listener died {:protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2) for "0.0.0.0" port 514>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:210:in `bind'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:191:in `udp_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:172:in `server'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:152:in `block in run'"]}

The code has ensure blocks that close the tcp/udp sockets, but it seems not to work as intended.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.