# Logstash service stops every 42 seconds and restarts **URL:** \ **Category:** Logstash\ **Created:** [May 2, 2018, 10:33pm UTC](https://discuss.elastic.co/t/logstash-service-stops-every-42-seconds-and-restarts/130332 "2018-05-02T22:33:24Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![dalamar666](https://avatars.discourse-cdn.com/v4/letter/d/e9bcb4/32.png) [@dalamar666](https://discuss.elastic.co/u/dalamar666)\ **Post date:** [May 2, 2018, 10:33pm UTC](https://discuss.elastic.co/t/logstash-service-stops-every-42-seconds-and-restarts/130332/1 "2018-05-02T22:33:24Z")
I have all ownership in /etc/logstash/ set to logstash:logstash I have all ownership in /usr/share/logstash set to logstash:logstash The logstash service runs as logstash. When I run logstash from the /usr/share/logstash/bin manually everything works fine. When I run it from the service I get these errors. Nothing in logs ``` May 02 18:25:11 librenms logstash[18366]: at org.logstash.Logstash.run(Logstash.java:81) May 02 18:25:11 librenms logstash[18366]: at org.logstash.Logstash.main(Logstash.java:45) May 02 18:25:11 librenms logstash[18366]: 2018-05-02 18:25:11,246 main ERROR Null object returned for RollingFile in Appenders. May 02 18:25:11 librenms logstash[18366]: 2018-05-02 18:25:11,247 main ERROR Null object returned for RollingFile in Appenders. May 02 18:25:11 librenms logstash[18366]: 2018-05-02 18:25:11,248 main ERROR Null object returned for RollingFile in Appenders. May 02 18:25:11 librenms logstash[18366]: 2018-05-02 18:25:11,248 main ERROR Null object returned for RollingFile in Appenders. May 02 18:25:11 librenms logstash[18366]: 2018-05-02 18:25:11,249 main ERROR Unable to locate appender "plain_rolling" for logger config "root" May 02 18:25:11 librenms logstash[18366]: 2018-05-02 18:25:11,250 main ERROR Unable to locate appender "plain_rolling_slowlog" for logger config "slowlog" May 02 18:25:11 librenms logstash[18366]: [2018-05-02T18:25:11,321][INFO][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configurat May 02 18:25:11 librenms logstash[18366]: [2018-05-02T18:25:11,356][INFO][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/config May 02 18:25:13 librenms logstash[18366]: [2018-05-02T18:25:13,075][FATAL][logstash.runner] An unexpected error occurred! {:error=>java.nio.file.AccessDeniedException: /usr/share/logstash/data/.loc May 02 18:25:13 librenms logstash[18366]: logstash_minus_core.lib.logstash.runner.RUBY$method$run$0$ __VARARGS__ (usr/share/logstash/logstash_minus_core/lib/logstash//usr/share/logstash/logstash-core/lib/logst May 02 18:25:13 librenms logstash[18366]: [2018-05-02T18:25:13,101][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (SystemExit) exit ``` Here is the status output when it is running right before stopping librenms@librenms:/etc/logstash$ sudo service logstash status ● logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; disabled; vendor preset: enabled) Drop-In: /etc/systemd/system/logstash.service.d └─elastiflow.conf Active: active (running) since Wed 2018-05-02 18:32:25 EDT; 18s ago Main PID: 28510 (java) Tasks: 17 Memory: 536.0M CPU: 49.896s CGroup: /system.slice/logstash.service └─28510 /usr/bin/java -Xms1g -Xmx1g -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true -Dfile.encoding=UTF-8 May 02 18:32:25 librenms systemd[1]: Started logstash. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 2, 2018, 10:41pm UTC](https://discuss.elastic.co/t/logstash-service-stops-every-42-seconds-and-restarts/130332/2 "2018-05-02T22:41:21Z")
What version, how did you install it? ---
**Author:** ![dalamar666](https://avatars.discourse-cdn.com/v4/letter/d/e9bcb4/32.png) [@dalamar666](https://discuss.elastic.co/u/dalamar666)\ **Post date:** [May 3, 2018, 12:32pm UTC](https://discuss.elastic.co/t/logstash-service-stops-every-42-seconds-and-restarts/130332/3 "2018-05-03T12:32:29Z")
Version 6.2.4 I installed it through apt-get. ---
**Author:** ![dalamar666](https://avatars.discourse-cdn.com/v4/letter/d/e9bcb4/32.png) [@dalamar666](https://discuss.elastic.co/u/dalamar666)\ **Post date:** [May 3, 2018, 5:40pm UTC](https://discuss.elastic.co/t/logstash-service-stops-every-42-seconds-and-restarts/130332/4 "2018-05-03T17:40:54Z")
I had to make a new directory and give it options 755 and own to logstash. Everything started working. The permissions and ownership on the original data file was the same. The only other change I made was that /var/log/logstash was owned by logstash:root and the files inside were owned by root. Changed all that to logstash:logstash as well. Service has been running for 4 minutes without stop. That is a success to me. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 4, 2018, 5:11am UTC](https://discuss.elastic.co/t/logstash-service-stops-every-42-seconds-and-restarts/130332/5 "2018-05-04T05:11:07Z")
What OS\>? ---
**Author:** ![dalamar666](https://avatars.discourse-cdn.com/v4/letter/d/e9bcb4/32.png) [@dalamar666](https://discuss.elastic.co/u/dalamar666)\ **Post date:** [May 4, 2018, 1:17pm UTC](https://discuss.elastic.co/t/logstash-service-stops-every-42-seconds-and-restarts/130332/6 "2018-05-04T13:17:45Z")
This is for Ubuntu Server 16.04 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 1, 2018, 1:17pm UTC](https://discuss.elastic.co/t/logstash-service-stops-every-42-seconds-and-restarts/130332/7 "2018-06-01T13:17:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.