# Logstash open file descriptors only increases

**URL:** <https://discuss.elastic.co/t/logstash-open-file-descriptors-only-increases/285571>\
**Category:** Logstash\
**Created:** [September 30, 2021, 9:44am UTC](https://discuss.elastic.co/t/logstash-open-file-descriptors-only-increases/285571 "2021-09-30T09:44:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![N1k-3l](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/n1k-3l/32/89418_2.png) [@N1k-3l](https://discuss.elastic.co/u/N1k-3l)\
**Post date:** [September 30, 2021, 9:44am UTC](https://discuss.elastic.co/t/logstash-open-file-descriptors-only-increases/285571/1 "2021-09-30T09:44:15Z")

</div>

Hello.  
I have a problem with logstash (logstash 7.12.1)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/b/aba6b7c166063347498a2a891bc94855d59740fb.png)  
file descriptors only increases. I set limits to 50000, but on another host, with the same config i have:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/1/2117ad1acba6d3f3701936b56acdf823f0fbc1d6.jpeg)

may be somebody knows about this? 😊

---

<div class="post-metadata">

**Author:** ![N1k-3l](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/n1k-3l/32/89418_2.png) [@N1k-3l](https://discuss.elastic.co/u/N1k-3l)\
**Post date:** [October 15, 2021, 9:59am UTC](https://discuss.elastic.co/t/logstash-open-file-descriptors-only-increases/285571/2 "2021-10-15T09:59:30Z")

</div>

Solution:  
File desriptors opened by attempts to start listen 514 port (syslog), however logstash user haven't had permissions to this operation, so descriptors couldn't become closed.  
After remove syslog from my input to logstash problem has gone.  
😊

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 15, 2021, 5:58pm UTC](https://discuss.elastic.co/t/logstash-open-file-descriptors-only-increases/285571/3 "2021-10-15T17:58:09Z")

</div>

That feels very much like a bug. Running

```
input { syslog {} }
output { stdout { codec => rubydebug { metadata => false } } }

```

with a non-priviliged user results in lsof showing an ever increasing number of open files. The errors that are logged are

```auto
[2021-10-15T13:52:46,426][WARN][logstash.inputs.syslog][main][d2aa53ecc994ad31a69c9075a3104af82d3db4575af93e207a9b4c77fce875a2] syslog listener died {:protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2)>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:129:in `initialize'", "org/jruby/RubyIO.java:876:in `new'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:208:in `tcp_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:172:in `server'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:156:in `block in run'"]}
[2021-10-15T13:52:46,473][INFO][logstash.inputs.syslog][main][d2aa53ecc994ad31a69c9075a3104af82d3db4575af93e207a9b4c77fce875a2] Starting syslog udp listener {:address=>"0.0.0.0:514"}
[2021-10-15T13:52:46,473][WARN][logstash.inputs.syslog][main][d2aa53ecc994ad31a69c9075a3104af82d3db4575af93e207a9b4c77fce875a2] syslog listener died {:protocol=>:udp, :address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2) for "0.0.0.0" port 514>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:210:in `bind'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:191:in `udp_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:172:in `server'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-syslog-3.5.0/lib/logstash/inputs/syslog.rb:152:in `block in run'"]}

```

The [code](https://github.com/logstash-plugins/logstash-input-syslog/blob/3de814d5945d6fb8dfeee33422e4d480da075cbe/lib/logstash/inputs/syslog.rb#L198) has ensure blocks that close the tcp/udp sockets, but it seems not to work as intended.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 12, 2021, 5:58pm UTC](https://discuss.elastic.co/t/logstash-open-file-descriptors-only-increases/285571/4 "2021-11-12T17:58:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.