# Logstash service stops every 2-3 days

**URL:** <https://discuss.elastic.co/t/logstash-service-stops-every-2-3-days/44826>\
**Category:** Logstash\
**Created:** [March 18, 2016, 9:55am UTC](https://discuss.elastic.co/t/logstash-service-stops-every-2-3-days/44826 "2016-03-18T09:55:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![meons](https://avatars.discourse-cdn.com/v4/letter/m/b5a626/32.png) [@meons](https://discuss.elastic.co/u/meons)\
**Post date:** [March 18, 2016, 9:55am UTC](https://discuss.elastic.co/t/logstash-service-stops-every-2-3-days/44826/1 "2016-03-18T09:55:14Z")

</div>

Hi there, I have 2 Logstash servers that recieve logs from different systems such as Windows and Linux machines and some networks systems such Firewalls, Switches, etc.  
The problem is that every 2-3 days the logstash process stops on both servers and in fact no more logs are forwarded until I start the service again.

In `/var/log/logstash/logstash.err` I can see the following message, I suppose that the problem comes from syslog input? Can I do something to fix that? May be should I look in an another log file?

`
tcp_receiver at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.2/lib/logstash/inputs/syslog.rb:173
  tcp_listener at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.2/lib/logstash/inputs/syslog.rb:159
Errno::EBADF: Bad file descriptor - Bad file descriptor
          each at org/jruby/RubyIO.java:3542
  tcp_receiver at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.2/lib/logstash/inputs/syslog.rb:173
  tcp_listener at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.2/lib/logstash/inputs/syslog.rb:159
log writing failed. Bad file descriptor - Bad file descriptorlog writing failed. Bad file descriptor - Bad file descriptorErrno::EBADF: Bad file descriptor - Bad file descriptor
          each at org/jruby/RubyIO.java:3542
  tcp_receiver at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.2/lib/logstash/inputs/syslog.rb:173
  tcp_listener at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-syslog-2.0.2/lib/logstash/inputs/syslog.rb:159
`

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 20, 2016, 12:27am UTC](https://discuss.elastic.co/t/logstash-service-stops-every-2-3-days/44826/2 "2016-03-20T00:27:09Z")

</div>

What version are you on?

---

<div class="post-metadata">

**Author:** ![meons](https://avatars.discourse-cdn.com/v4/letter/m/b5a626/32.png) [@meons](https://discuss.elastic.co/u/meons)\
**Post date:** [April 5, 2016, 8:18am UTC](https://discuss.elastic.co/t/logstash-service-stops-every-2-3-days/44826/3 "2016-04-05T08:18:46Z")

</div>

I'm running logstash 2.1.1 on one server and logstash 2.2.2 on the other server. And java version "1.8.0\_66" on both servers.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/logstash-service-stops-every-2-3-days/44826/4 "2017-07-06T05:03:53Z")

</div>