# One or more required cgroup files or directories not found: /proc/self/cgroup, /sys/fs/cgroup/cpuacct, /sys/fs/cgroup/cpu

**URL:** <https://discuss.elastic.co/t/one-or-more-required-cgroup-files-or-directories-not-found-proc-self-cgroup-sys-fs-cgroup-cpuacct-sys-fs-cgroup-cpu/292689>\
**Category:** Logstash\
**Created:** [December 22, 2021, 1:37pm UTC](https://discuss.elastic.co/t/one-or-more-required-cgroup-files-or-directories-not-found-proc-self-cgroup-sys-fs-cgroup-cpuacct-sys-fs-cgroup-cpu/292689 "2021-12-22T13:37:48Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![rusty\_cole](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\
**Post date:** [December 22, 2021, 1:37pm UTC](https://discuss.elastic.co/t/one-or-more-required-cgroup-files-or-directories-not-found-proc-self-cgroup-sys-fs-cgroup-cpuacct-sys-fs-cgroup-cpu/292689/1 "2021-12-22T13:37:48Z")

</div>

Hi Guys,  
I have logstash running on a windows machine.  
My inputs and parsers are set up correctly and everything works fine.  
The only issue I have - when I start the logstash process, it wont ingest files, instead it just hangs with the following message - "Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}"

Only when I break with "ctrl c" it will ingest the files on exit and send them to elastic with the message - "closing all files and shuting down"

How do I make it work without closing the process?

Thanks.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 22, 2021, 1:48pm UTC](https://discuss.elastic.co/t/one-or-more-required-cgroup-files-or-directories-not-found-proc-self-cgroup-sys-fs-cgroup-cpuacct-sys-fs-cgroup-cpu/292689/2 "2021-12-22T13:48:16Z")

</div>

This message is normal, it says that logstash is running the main pipeline.

> [@rusty\_cole](#):
>
> "Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}"

What is your pipeline configuration? Please share your full pipeline configuration and an example of what you are ingesting.

---

<div class="post-metadata">

**Author:** ![rusty\_cole](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\
**Post date:** [December 22, 2021, 2:08pm UTC](https://discuss.elastic.co/t/one-or-more-required-cgroup-files-or-directories-not-found-proc-self-cgroup-sys-fs-cgroup-cpuacct-sys-fs-cgroup-cpu/292689/3 "2021-12-22T14:08:47Z")

</div>

configuration:

```auto
input
{
    file
        {
            path => "C:/Evidence/ScheduledTasks/**/*.xml"
            start_position => "beginning"
			stat_interval => "5"
            discover_interval => "5"
            sincedb_path => "NUL"
            exclude => "*.gz"
            type => "xml"
            codec => multiline {
                    pattern => "<Task " 
                    negate => "true"
                    what => "previous"
                }
        }
}

filter {
       if [message] =~ /<\?xml/ { drop {} }

}

filter {

    xml{
        source => "message"
		remove_namespaces => true
        store_xml => true
        target => "Task"
        xpath => [
            "//Task/RegistrationInfo/SecurityDescriptor/text()", "RegistrationInfo.SecurityDescriptor",
            "//Task/RegistrationInfo/Source/text()", "RegistrationInfo.Source",
            "//Task/RegistrationInfo/Author/text()", "RegistrationInfo.Author",
            "//Task/RegistrationInfo/Description/text()", "RegistrationInfo.Description",
			"//Task/RegistrationInfo/Version/text()", "RegistrationInfo.Version",
            "//Task/RegistrationInfo/URI/text()", "RegistrationInfo.TaskName",
			"//Task/Actions/Exec/Command/text()", "Actions.Command",
			"//Task/Actions/Exec/Arguments/text()", "Actions.Arguments",
			"//Task/Principals/Principal/@id", "Principals.PrincipalID",
			"//Task/Principals/Principal/UserId/text()", "Principal.UserId",
			"//Task/Principals/Principal/LogonType/text()", "Principal.LogonType",
			"//Task/Principals/Principal/RunLevel/text()", "Principal.RunLevel",
			"//Task/Settings/Enabled/text()", "Settings.TaskStatus",
			"//Task/Settings/Hidden/text()", "Settings.Hidden",
			"//Task/Settings/AllowStartOnDemand/text()", "Settings.AllowStartOnDemand",
			"//Task/Settings/RunOnlyIfIdle/text()", "Settings.RunOnlyIfIdle",
			"//Task/Settings/DisallowStartOnRemoteAppSession/text()", "Settings.DisallowStartOnRemoteAppSession",
			"//Task/Settings/UseUnifiedSchedulingEngine/text()", "Settings.UseUnifiedSchedulingEngine",
			"//Task/Settings/WakeToRun/text()", "Settings.WakeToRun",
			"//Task/Settings/ExecutionTimeLimit/text()", "Settings.ExecutionTimeLimit",
			"//Task/Settings/Priority/text()", "Settings.Priority",
			"//Task/Settings/IdleSettings/Duration/text()", "IdleSettings.Duration",
			"//Task/Settings/IdleSettings/WaitTimeout/text()", "IdleSettings.WaitTimeout",
			"//Task/Settings/IdleSettings/StopOnIdleEnd/text()", "IdleSettings.StopOnIdleEnd",
			"//Task/Settings/IdleSettings/RestartOnIdle/text()", "IdleSettings.RestartOnIdle",
			"//Task/Triggers/LogonTrigger/Enabled/text()", "LogonTrigger.Enabled",
			"//Task/Triggers/RegistrationTrigger/Enabled/text()", "RegistrationTrigger.Enabled",
			"//Task/Triggers/RegistrationTrigger/Delay/text()", "RegistrationTrigger.Delay",
			"//Task/Triggers/CalendarTrigger/StartBoundary/text()", "CalendarTrigger.TriggerStartsOn",
			"//Task/Triggers/TimeTrigger/StartBoundary/text()", "TimeTrigger.TriggerStartsOn",
			"//Task/Triggers/TimeTrigger/Enabled/text()", "TimeTrigger.Enabled"
			

        ]
    }

}

output{

elasticsearch{
        hosts => ["http://localhost:9200/"]
        index => "xml_data"
    }

}

```

XML:

```auto
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Version>1.3.36.112</Version>
    <Description>Keeps your Google software up to date. If this task is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This task uninstalls itself when there is no Google software using it.</Description>
    <URI>\GoogleUpdateTaskMachineCore</URI>
  </RegistrationInfo>
  <Triggers>
    <LogonTrigger>
      <Enabled>true</Enabled>
    </LogonTrigger>
    <CalendarTrigger>
      <StartBoundary>2021-11-24T09:31:27</StartBoundary>
      <ScheduleByDay>
        <DaysInterval>1</DaysInterval>
      </ScheduleByDay>
    </CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>S-1-5-18</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StartWhenAvailable>true</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <Enabled>true</Enabled>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>C:\Program Files (x86)\Google\Update\GoogleUpdate.exe</Command>
      <Arguments>/c</Arguments>
    </Exec>
  </Actions>
</Task>

```

---

<div class="post-metadata">

**Author:** ![rusty\_cole](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\
**Post date:** [December 22, 2021, 4:14pm UTC](https://discuss.elastic.co/t/one-or-more-required-cgroup-files-or-directories-not-found-proc-self-cgroup-sys-fs-cgroup-cpuacct-sys-fs-cgroup-cpu/292689/5 "2021-12-22T16:14:52Z")

</div>

After enabling DEBUG mode, I noticed the following message - One or more required cgroup files or directories not found: /proc/self/cgroup, /sys/fs/cgroup/cpuacct, /sys/fs/cgroup/cpu

---

<div class="post-metadata">

**Author:** ![rusty\_cole](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\
**Post date:** [December 22, 2021, 4:41pm UTC](https://discuss.elastic.co/t/one-or-more-required-cgroup-files-or-directories-not-found-proc-self-cgroup-sys-fs-cgroup-cpuacct-sys-fs-cgroup-cpu/292689/6 "2021-12-22T16:41:44Z")

</div>

The subject has been changed

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 22, 2021, 5:13pm UTC](https://discuss.elastic.co/t/one-or-more-required-cgroup-files-or-directories-not-found-proc-self-cgroup-sys-fs-cgroup-cpuacct-sys-fs-cgroup-cpu/292689/7 "2021-12-22T17:13:53Z")

</div>

> [@rusty\_cole](#):
>
> `codec => multiline`

Have you tried using the [auto\_flush\_interval](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html#plugins-codecs-multiline-auto_flush_interval) option? If that is not set then the codec will not flush an event until shutdown, or a line that matches the regexp is appended to the file.

---

<div class="post-metadata">

**Author:** ![rusty\_cole](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\
**Post date:** [December 22, 2021, 5:21pm UTC](https://discuss.elastic.co/t/one-or-more-required-cgroup-files-or-directories-not-found-proc-self-cgroup-sys-fs-cgroup-cpuacct-sys-fs-cgroup-cpu/292689/9 "2021-12-22T17:21:14Z")

</div>

Problem solved......  
THANKS Badger !!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 19, 2022, 5:21pm UTC](https://discuss.elastic.co/t/one-or-more-required-cgroup-files-or-directories-not-found-proc-self-cgroup-sys-fs-cgroup-cpuacct-sys-fs-cgroup-cpu/292689/10 "2022-01-19T17:21:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.