Hello,
Today we upgraded from 6.1.1 to 6.1.3
After the upgrade, the logstash input UDP kept on failing
Looking into the logs of logstash, there wasn't any error, but on the system logs the following was coming up:
logstash: java.lang.OutOfMemoryError: Java heap space
Dumping heap to java_pid2361.hprof ...
logstash: Unable to create java_pid2361.hprof: Permission denied
We have tried with different settings on the heap size of logstash including the default settings (was running with default settings before)
We are on a Centos 7 server running logstash 6.1.3
Input file:
input {
udp {
port => 9522
type => syslog
add_field => { "hardware_vendor" => "cisco" }
}
}
input {
beats {
port => 9523
ssl => true
ssl_certificate => "/etc/logstash/certs/local.crt"
ssl_key => "/etc/logstash/certs/local.key"
}
}
Output file:
tcp {
host => "xxxxx"
codec => "json_lines"
port => 9524
ssl_enable => true
ssl_cacert => "/etc/logstash/certs/ca-chain.cert.pem"
ssl_cert => "/etc/logstash/certs/client.crt"
ssl_key => "/etc/logstash/certs/client.key"
ssl_key_passphrase => ""
# reconnect_interval => 1
ssl_verify => true
}
}
Jvm.options
-Xms1g
-Xmx1g
It certainly looks like permission error, but since nothing was changed why did it occur now and how we can stop it?
This is causing all UDP connections to be dropped and all firewall logs are gone.
Any help/pointers are appreciated
Thanks