# Logstash service using almost 200% CPU **URL:** \ **Category:** Logstash\ **Created:** [April 22, 2020, 1:32am UTC](https://discuss.elastic.co/t/logstash-service-using-almost-200-cpu/229154 "2020-04-22T01:32:08Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![jai.waghela](https://avatars.discourse-cdn.com/v4/letter/j/aca169/32.png) [@jai.waghela](https://discuss.elastic.co/u/jai.waghela)\ **Post date:** [April 22, 2020, 1:32am UTC](https://discuss.elastic.co/t/logstash-service-using-almost-200-cpu/229154/1 "2020-04-22T01:32:08Z")
``` Hi, The logstash service is constantly consuming high CPU above 150%. Below is the error but not sure what to do. PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 32381 logstash 39 19 6650912 283140 17616 S 190.7 2.3 0:06.39 java 1041 kibana 20 0 1267528 76520 10056 R 0.7 0.6 1835:10 node Error : [2020-04-22T05:22:21,076][INFO][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"} [2020-04-22T05:22:21,078][DEBUG][logstash.plugins.registry] Adding plugin to the registry {:name=>"netflow", :type=>:modules, :class=>#} [2020-04-22T05:22:21,079][INFO][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"} [2020-04-22T05:22:21,079][DEBUG][logstash.plugins.registry] Adding plugin to the registry {:name=>"fb_apache", :type=>:modules, :class=>#} [2020-04-22T05:22:21,090][DEBUG][logstash.runner] -------- Logstash Settings (* means modified) --------- [2020-04-22T05:22:21,090][DEBUG][logstash.runner] node.name: "dfmel1log01" [2020-04-22T05:22:21,090][DEBUG][logstash.runner] *path.config: "/usr/share/logstash/config" [2020-04-22T05:22:21,090][DEBUG][logstash.runner] path.data: "/usr/share/logstash/data" [2020-04-22T05:22:21,090][DEBUG][logstash.runner] modules.cli: [] [2020-04-22T05:22:21,090][DEBUG][logstash.runner] modules: [] [2020-04-22T05:22:21,090][DEBUG][logstash.runner] modules_setup: false [2020-04-22T05:22:21,090][DEBUG][logstash.runner] config.test_and_exit: false [2020-04-22T05:22:21,090][DEBUG][logstash.runner] config.reload.automatic: false [2020-04-22T05:22:21,090][DEBUG][logstash.runner] config.support_escapes: false [2020-04-22T05:22:21,090][DEBUG][logstash.runner] config.reload.interval: 3 [2020-04-22T05:22:21,091][DEBUG][logstash.runner] metric.collect: true [2020-04-22T05:22:21,091][DEBUG][logstash.runner] pipeline.id: "main" [2020-04-22T05:22:21,091][DEBUG][logstash.runner] pipeline.system: false [2020-04-22T05:22:21,091][DEBUG][logstash.runner] pipeline.workers: 2 [2020-04-22T05:22:21,092][DEBUG][logstash.runner] pipeline.output.workers: 1 [2020-04-22T05:22:21,092][DEBUG][logstash.runner] pipeline.batch.size: 125 [2020-04-22T05:22:21,092][DEBUG][logstash.runner] pipeline.batch.delay: 5 [2020-04-22T05:22:21,092][DEBUG][logstash.runner] pipeline.unsafe_shutdown: false [2020-04-22T05:22:21,092][DEBUG][logstash.runner] path.plugins: [] [2020-04-22T05:22:21,092][DEBUG][logstash.runner] *config.debug: true (default: false) [2020-04-22T05:22:21,092][DEBUG][logstash.runner] *log.level: "debug" (default: "info") [2020-04-22T05:22:21,092][DEBUG][logstash.runner] version: false [2020-04-22T05:22:21,092][DEBUG][logstash.runner] help: false [2020-04-22T05:22:21,092][DEBUG][logstash.runner] log.format: "plain" [2020-04-22T05:22:21,092][DEBUG][logstash.runner] http.host: "127.0.0.1" [2020-04-22T05:22:21,092][DEBUG][logstash.runner] http.port: 9600..9700 [2020-04-22T05:22:21,092][DEBUG][logstash.runner] http.environment: "production" [2020-04-22T05:22:21,092][DEBUG][logstash.runner] queue.type: "memory" [2020-04-22T05:22:21,092][DEBUG][logstash.runner] queue.drain: false [2020-04-22T05:22:21,093][DEBUG][logstash.runner] queue.page_capacity: 262144000 [2020-04-22T05:22:21,093][DEBUG][logstash.runner] queue.max_bytes: 1073741824 [2020-04-22T05:22:21,093][DEBUG][logstash.runner] queue.max_events: 0 [2020-04-22T05:22:21,093][DEBUG][logstash.runner] queue.checkpoint.acks: 1024 [2020-04-22T05:22:21,093][DEBUG][logstash.runner] queue.checkpoint.writes: 1024 [2020-04-22T05:22:21,093][DEBUG][logstash.runner] queue.checkpoint.interval: 1000 [2020-04-22T05:22:21,093][DEBUG][logstash.runner] dead_letter_queue.enable: false [2020-04-22T05:22:21,093][DEBUG][logstash.runner] dead_letter_queue.max_bytes: 1073741824 [2020-04-22T05:22:21,093][DEBUG][logstash.runner] slowlog.threshold.warn: -1 [2020-04-22T05:22:21,093][DEBUG][logstash.runner] slowlog.threshold.info: -1 [2020-04-22T05:22:21,093][DEBUG][logstash.runner] slowlog.threshold.debug: -1 [2020-04-22T05:22:21,093][DEBUG][logstash.runner] slowlog.threshold.trace: -1 [2020-04-22T05:22:21,093][DEBUG][logstash.runner] path.queue: "/usr/share/logstash/data/queue" [2020-04-22T05:22:21,093][DEBUG][logstash.runner] path.dead_letter_queue: "/usr/share/logstash/data/dead_letter_queue" [2020-04-22T05:22:21,093][DEBUG][logstash.runner] *path.settings: "/etc/logstash" (default: "/usr/share/logstash/config") [2020-04-22T05:22:21,093][DEBUG][logstash.runner] *path.logs: "/var/log/logstash" (default: "/usr/share/logstash/logs") [2020-04-22T05:22:21,093][DEBUG][logstash.runner] --------------- Logstash Settings ------------------- [2020-04-22T05:22:21,100][FATAL][logstash.runner] An unexpected error occurred! {:error=>java.nio.file.AccessDeniedException: /usr/share/logstash/data/.lock, :backtrace=>["sun.nio.fs.UnixException.translateToIOException(sun/nio/fs/UnixException.java:84)", "sun.nio.fs.UnixException.rethrowAsIOException(sun/nio/fs/UnixException.java:102)", "sun.nio.fs.UnixException.rethrowAsIOException(sun/nio/fs/UnixException.java:107)", "sun.nio.fs.UnixFileSystemProvider.newFileChannel(sun/nio/fs/UnixFileSystemProvider.java:177)", "java.nio.channels.FileChannel.open(java/nio/channels/FileChannel.java:287)", "java.nio.channels.FileChannel.open(java/nio/channels/FileChannel.java:335)", "org.logstash.FileLockFactory.obtainLock(org/logstash/FileLockFactory.java:84)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:498)", "RUBY.execute(/usr/share/logstash/logstash-core/lib/logstash/runner.rb:309)", "RUBY.run(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67)", "RUBY.run(/usr/share/logstash/logstash-core/lib/logstash/runner.rb:204)", "RUBY.run(/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132)", "usr.share.logstash.lib.bootstrap.environment.(root)(/usr/share/logstash/lib/bootstrap/environment.rb:71)", "usr.share.logstash.lib.bootstrap.environment.(root)(usr/share/logstash/lib/bootstrap//usr/share/logstash/lib/bootstrap/environment.rb:71)"]} root@dfmel1log01:/var/log/logstash#`Preformatted text` ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 22, 2020, 1:34am UTC](https://discuss.elastic.co/t/logstash-service-using-almost-200-cpu/229154/2 "2020-04-22T01:34:42Z")
Please format your code/logs/config using the `` button, or markdown style back ticks. It helps to make things easy to read which helps us help you 🙂 > [@jai.waghela](#): > > An unexpected error occurred! {:error=\>java.nio.file.AccessDeniedException: /usr/share/logstash/data/.lock That's a little odd. How did you install Logstash? ---
**Author:** ![jai.waghela](https://avatars.discourse-cdn.com/v4/letter/j/aca169/32.png) [@jai.waghela](https://discuss.elastic.co/u/jai.waghela)\ **Post date:** [April 22, 2020, 1:48am UTC](https://discuss.elastic.co/t/logstash-service-using-almost-200-cpu/229154/3 "2020-04-22T01:48:42Z")
Hi Warkolm, It was installed long back and I am not really sure how it was installed. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 22, 2020, 1:50am UTC](https://discuss.elastic.co/t/logstash-service-using-almost-200-cpu/229154/4 "2020-04-22T01:50:56Z")
Ok, well something is up with that file and the permissions on it. What does an `ls -l` on it look like? ---
**Author:** ![jai.waghela](https://avatars.discourse-cdn.com/v4/letter/j/aca169/32.png) [@jai.waghela](https://discuss.elastic.co/u/jai.waghela)\ **Post date:** [April 22, 2020, 1:52am UTC](https://discuss.elastic.co/t/logstash-service-using-almost-200-cpu/229154/5 "2020-04-22T01:52:33Z")
root@dfmel1log01:/usr/share/logstash/data# stat .lock File: '.lock' Size: 0 Blocks: 0 IO Block: 4096 regular empty file Device: fc00h/64512d Inode: 261818 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 999/logstash) Gid: ( 999/logstash) Access: 2020-04-22 10:41:33.585013018 +1000 Modify: 2020-01-14 13:03:30.858511134 +1100 Change: 2020-04-22 08:15:11.447641163 +1000 Birth: - root@dfmel1log01:/usr/share/logstash/data# ls -al total 20 drwxrwxr-x 4 logstash logstash 4096 Jan 14 13:03 . drwxrwxr-x 11 logstash logstash 4096 Apr 22 03:36 .. drwxr-xr-x 2 logstash logstash 4096 Oct 9 2019 dead\_letter\_queue -rw-r--r-- 1 logstash logstash 0 Jan 14 13:03 .lock drwxr-xr-x 2 logstash logstash 4096 Feb 13 2017 queue -rw-r--r-- 1 logstash logstash 36 Jan 14 13:03 uuid root@dfmel1log01:/usr/share/logstash/data# ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 22, 2020, 1:53am UTC](https://discuss.elastic.co/t/logstash-service-using-almost-200-cpu/229154/6 "2020-04-22T01:53:40Z")
**Please format your code/logs/config** using the `` button, or markdown style back ticks. It helps to make things easy to read which helps us help you 🙂 ---
**Author:** ![jai.waghela](https://avatars.discourse-cdn.com/v4/letter/j/aca169/32.png) [@jai.waghela](https://discuss.elastic.co/u/jai.waghela)\ **Post date:** [April 22, 2020, 1:56am UTC](https://discuss.elastic.co/t/logstash-service-using-almost-200-cpu/229154/7 "2020-04-22T01:56:10Z")
Is that what you wanted me to do? ---
**Author:** ![jai.waghela](https://avatars.discourse-cdn.com/v4/letter/j/aca169/32.png) [@jai.waghela](https://discuss.elastic.co/u/jai.waghela)\ **Post date:** [April 22, 2020, 2:00am UTC](https://discuss.elastic.co/t/logstash-service-using-almost-200-cpu/229154/8 "2020-04-22T02:00:57Z")
Modified the logs using the `` button. Hope that,s what you asked... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 20, 2020, 2:01am UTC](https://discuss.elastic.co/t/logstash-service-using-almost-200-cpu/229154/9 "2020-05-20T02:01:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.