Hi,
The logstash service is constantly consuming high CPU above 150%. Below is the error but not sure what to do.
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
32381 logstash 39 19 6650912 283140 17616 S 190.7 2.3 0:06.39 java
1041 kibana 20 0 1267528 76520 10056 R 0.7 0.6 1835:10 node
Error :
[2020-04-22T05:22:21,076][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"}
[2020-04-22T05:22:21,078][DEBUG][logstash.plugins.registry] Adding plugin to the registry {:name=>"netflow", :type=>:modules, :class=>#<LogStash::Modules::Scaffold:0x7362835d @kibana_version_parts=["5", "6", "0"], @module_name="netflow", @directory="/usr/share/logstash/modules/netflow/configuration">}
[2020-04-22T05:22:21,079][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"}
[2020-04-22T05:22:21,079][DEBUG][logstash.plugins.registry] Adding plugin to the registry {:name=>"fb_apache", :type=>:modules, :class=>#<LogStash::Modules::Scaffold:0x66429216 @kibana_version_parts=["5", "6", "0"], @module_name="fb_apache", @directory="/usr/share/logstash/modules/fb_apache/configuration">}
[2020-04-22T05:22:21,090][DEBUG][logstash.runner ] -------- Logstash Settings (* means modified) ---------
[2020-04-22T05:22:21,090][DEBUG][logstash.runner ] node.name: "dfmel1log01"
[2020-04-22T05:22:21,090][DEBUG][logstash.runner ] *path.config: "/usr/share/logstash/config"
[2020-04-22T05:22:21,090][DEBUG][logstash.runner ] path.data: "/usr/share/logstash/data"
[2020-04-22T05:22:21,090][DEBUG][logstash.runner ] modules.cli: []
[2020-04-22T05:22:21,090][DEBUG][logstash.runner ] modules: []
[2020-04-22T05:22:21,090][DEBUG][logstash.runner ] modules_setup: false
[2020-04-22T05:22:21,090][DEBUG][logstash.runner ] config.test_and_exit: false
[2020-04-22T05:22:21,090][DEBUG][logstash.runner ] config.reload.automatic: false
[2020-04-22T05:22:21,090][DEBUG][logstash.runner ] config.support_escapes: false
[2020-04-22T05:22:21,090][DEBUG][logstash.runner ] config.reload.interval: 3
[2020-04-22T05:22:21,091][DEBUG][logstash.runner ] metric.collect: true
[2020-04-22T05:22:21,091][DEBUG][logstash.runner ] pipeline.id: "main"
[2020-04-22T05:22:21,091][DEBUG][logstash.runner ] pipeline.system: false
[2020-04-22T05:22:21,091][DEBUG][logstash.runner ] pipeline.workers: 2
[2020-04-22T05:22:21,092][DEBUG][logstash.runner ] pipeline.output.workers: 1
[2020-04-22T05:22:21,092][DEBUG][logstash.runner ] pipeline.batch.size: 125
[2020-04-22T05:22:21,092][DEBUG][logstash.runner ] pipeline.batch.delay: 5
[2020-04-22T05:22:21,092][DEBUG][logstash.runner ] pipeline.unsafe_shutdown: false
[2020-04-22T05:22:21,092][DEBUG][logstash.runner ] path.plugins: []
[2020-04-22T05:22:21,092][DEBUG][logstash.runner ] *config.debug: true (default: false)
[2020-04-22T05:22:21,092][DEBUG][logstash.runner ] *log.level: "debug" (default: "info")
[2020-04-22T05:22:21,092][DEBUG][logstash.runner ] version: false
[2020-04-22T05:22:21,092][DEBUG][logstash.runner ] help: false
[2020-04-22T05:22:21,092][DEBUG][logstash.runner ] log.format: "plain"
[2020-04-22T05:22:21,092][DEBUG][logstash.runner ] http.host: "127.0.0.1"
[2020-04-22T05:22:21,092][DEBUG][logstash.runner ] http.port: 9600..9700
[2020-04-22T05:22:21,092][DEBUG][logstash.runner ] http.environment: "production"
[2020-04-22T05:22:21,092][DEBUG][logstash.runner ] queue.type: "memory"
[2020-04-22T05:22:21,092][DEBUG][logstash.runner ] queue.drain: false
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] queue.page_capacity: 262144000
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] queue.max_bytes: 1073741824
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] queue.max_events: 0
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] queue.checkpoint.acks: 1024
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] queue.checkpoint.writes: 1024
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] queue.checkpoint.interval: 1000
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] dead_letter_queue.enable: false
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] dead_letter_queue.max_bytes: 1073741824
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] slowlog.threshold.warn: -1
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] slowlog.threshold.info: -1
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] slowlog.threshold.debug: -1
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] slowlog.threshold.trace: -1
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] path.queue: "/usr/share/logstash/data/queue"
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] path.dead_letter_queue: "/usr/share/logstash/data/dead_letter_queue"
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] *path.settings: "/etc/logstash" (default: "/usr/share/logstash/config")
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] *path.logs: "/var/log/logstash" (default: "/usr/share/logstash/logs")
[2020-04-22T05:22:21,093][DEBUG][logstash.runner ] --------------- Logstash Settings -------------------
[2020-04-22T05:22:21,100][FATAL][logstash.runner ] An unexpected error occurred! {:error=>java.nio.file.AccessDeniedException: /usr/share/logstash/data/.lock, :backtrace=>["sun.nio.fs.UnixException.translateToIOException(sun/nio/fs/UnixException.java:84)", "sun.nio.fs.UnixException.rethrowAsIOException(sun/nio/fs/UnixException.java:102)", "sun.nio.fs.UnixException.rethrowAsIOException(sun/nio/fs/UnixException.java:107)", "sun.nio.fs.UnixFileSystemProvider.newFileChannel(sun/nio/fs/UnixFileSystemProvider.java:177)", "java.nio.channels.FileChannel.open(java/nio/channels/FileChannel.java:287)", "java.nio.channels.FileChannel.open(java/nio/channels/FileChannel.java:335)", "org.logstash.FileLockFactory.obtainLock(org/logstash/FileLockFactory.java:84)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:498)", "RUBY.execute(/usr/share/logstash/logstash-core/lib/logstash/runner.rb:309)", "RUBY.run(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67)", "RUBY.run(/usr/share/logstash/logstash-core/lib/logstash/runner.rb:204)", "RUBY.run(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132)", "usr.share.logstash.lib.bootstrap.environment.(root)(/usr/share/logstash/lib/bootstrap/environment.rb:71)", "usr.share.logstash.lib.bootstrap.environment.(root)(usr/share/logstash/lib/bootstrap//usr/share/logstash/lib/bootstrap/environment.rb:71)"]}
root@dfmel1log01:/var/log/logstash#`Preformatted text`Please format your code/logs/config using the </> button, or markdown style back ticks. It helps to make things easy to read which helps us help you 
That's a little odd. How did you install Logstash?
Hi Warkolm,
It was installed long back and I am not really sure how it was installed.
Ok, well something is up with that file and the permissions on it. What does an ls -l on it look like?
root@dfmel1log01:/usr/share/logstash/data# stat .lock
File: '.lock'
Size: 0 Blocks: 0 IO Block: 4096 regular empty file
Device: fc00h/64512d Inode: 261818 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 999/logstash) Gid: ( 999/logstash)
Access: 2020-04-22 10:41:33.585013018 +1000
Modify: 2020-01-14 13:03:30.858511134 +1100
Change: 2020-04-22 08:15:11.447641163 +1000
Birth: -
root@dfmel1log01:/usr/share/logstash/data# ls -al
total 20
drwxrwxr-x 4 logstash logstash 4096 Jan 14 13:03 .
drwxrwxr-x 11 logstash logstash 4096 Apr 22 03:36 ..
drwxr-xr-x 2 logstash logstash 4096 Oct 9 2019 dead_letter_queue
-rw-r--r-- 1 logstash logstash 0 Jan 14 13:03 .lock
drwxr-xr-x 2 logstash logstash 4096 Feb 13 2017 queue
-rw-r--r-- 1 logstash logstash 36 Jan 14 13:03 uuid
root@dfmel1log01:/usr/share/logstash/data#
Please format your code/logs/config using the </> button, or markdown style back ticks. It helps to make things easy to read which helps us help you 
Is that what you wanted me to do?
Modified the logs using the </> button. Hope that,s what you asked...
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.