Logstash Windows Service Filling up C:\Windows\Temp

[saravanan_palanivel (Saravanan)]

Hi Team,

I'm running Logstash 6.5.0 as Windows service (and i installed that using NSSM), whenever Logstash service running in the background, it creating temp jar files into C:\Windows\Temp directory, eventually C:\ drive's disk space got filled up.

Please suggest work around or fix for this situation ? we are facing this issue in our PROD instance of ELK server as well.

Thanks,
Saravanan

[saravanan_palanivel (Saravanan)]

Could someone please help us with this issue ?

[bigphil (Philip Nunn)]

The temp jruby files should only be created when the service starts. Are you restarting the service many, many times? On my system, the files only account for 300KB for each folder...hardly enough to cause an issue even with hundreds of folders. If it really is a problem for you, create a script to delete the old jruby* folders and have it run on a schedule.

*edit: there are also some dll's that are created in the same folder (netty*, jffi*) that account for more space (2.16MB) that correspond to the same time the service starts that you should cleanup as well.

[saravanan_palanivel (Saravanan)]

Thanks so much Philip! I've noticed my Logstash windows service was installed with incorrect *.json file instead of valid *.conf file. Due to that it was keep on restarting.

So i've updated my pipelines.yml with list of pipelines and kept my *.conf files into logstash-6.5.0\bin directory and reinstalled Logstash windows service using NSSM, now i could see jruby*.jar/jiffi*.dll files created only when Logstash restarts. Thanks again!