Logstash: Unable to create java_pid2361.hprof: Permission denied


Today we upgraded from 6.1.1 to 6.1.3
After the upgrade, the logstash input UDP kept on failing

Looking into the logs of logstash, there wasn't any error, but on the system logs the following was coming up:

logstash: java.lang.OutOfMemoryError: Java heap space
 Dumping heap to java_pid2361.hprof ...
logstash: Unable to create java_pid2361.hprof: Permission denied

We have tried with different settings on the heap size of logstash including the default settings (was running with default settings before)

We are on a Centos 7 server running logstash 6.1.3
Input file:

input {
  udp {
    port => 9522
    type => syslog
    add_field => { "hardware_vendor" => "cisco" }


input {
  beats {
    port  => 9523
    ssl   => true
    ssl_certificate => "/etc/logstash/certs/local.crt"
    ssl_key         => "/etc/logstash/certs/local.key"

Output file:

  tcp {
   host => "xxxxx"
   codec => "json_lines"
   port => 9524
   ssl_enable => true
   ssl_cacert => "/etc/logstash/certs/ca-chain.cert.pem"
   ssl_cert => "/etc/logstash/certs/client.crt"
   ssl_key  => "/etc/logstash/certs/client.key"
   ssl_key_passphrase => ""
   # reconnect_interval => 1
   ssl_verify => true



It certainly looks like permission error, but since nothing was changed why did it occur now and how we can stop it?

This is causing all UDP connections to be dropped and all firewall logs are gone.

Any help/pointers are appreciated


I have tried on a new built server with the same specs and the issue still remains on version 6.1.3

The newest 6.2 doesn't mention anything about fixing this issue, but will try and update.

Current problem on 6.1.3 still unresolved

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.