Problem in the operation of the snmp module in logstash

Elastic Stack Logstash
1

After updating logstash to the latest version 8.15.1. the problems with the snmp module have been fixed.

logs:

Sep 27 08:39:17 lst01 logstash[898]:   Error: Task java.util.concurrent.CompletableFuture$AsyncSupply@615d29e7 rejected from java.util.concurrent.ThreadPoolExecutor@dc314bd[Terminated, pool size = 0, active threads = 0, queued tasks = 0, completed tasks = 104]
Sep 27 08:39:17 lst01 logstash[898]:   Exception: Java::JavaUtilConcurrent::RejectedExecutionException
Sep 27 08:39:17 lst01 logstash[898]:   Stack: java.util.concurrent.ThreadPoolExecutor$AbortPolicy.rejectedExecution(java/util/concurrent/ThreadPoolExecutor.java:2081)
Sep 27 08:39:17 lst01 logstash[898]: java.util.concurrent.ThreadPoolExecutor.reject(java/util/concurrent/ThreadPoolExecutor.java:841)
Sep 27 08:39:17 lst01 logstash[898]: java.util.concurrent.ThreadPoolExecutor.execute(java/util/concurrent/ThreadPoolExecutor.java:1376)
Sep 27 08:39:17 lst01 logstash[898]: java.util.concurrent.CompletableFuture.asyncSupplyStage(java/util/concurrent/CompletableFuture.java:1782)
Sep 27 08:39:17 lst01 logstash[898]: java.util.concurrent.CompletableFuture.supplyAsync(java/util/concurrent/CompletableFuture.java:2005)
Sep 27 08:39:17 lst01 logstash[898]: org.logstash.snmp.SnmpClientRequestAggregator$Request.submitRequestTask(org/logstash/snmp/SnmpClientRequestAggregator.java:112)
Sep 27 08:39:17 lst01 logstash[898]: org.logstash.snmp.SnmpClientRequestAggregator$Request.get(org/logstash/snmp/SnmpClientRequestAggregator.java:92)
Sep 27 08:39:17 lst01 logstash[898]: jdk.internal.reflect.DirectMethodHandleAccessor.invoke(jdk/internal/reflect/DirectMethodHandleAccessor.java:103)
Sep 27 08:39:17 lst01 logstash[898]: java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:580)
Sep 27 08:39:17 lst01 logstash[898]: org.jruby.javasupport.JavaMethod.invokeDirectWithExceptionHandling(org/jruby/javasupport/JavaMethod.java:330)
Sep 27 08:39:17 lst01 logstash[898]: org.jruby.javasupport.JavaMethod.invokeDirect(org/jruby/javasupport/JavaMethod.java:188)
Sep 27 08:39:17 lst01 logstash[898]: usr.share.logstash.vendor.bundle.jruby.$3_dot_1_dot_0.gems.logstash_minus_integration_minus_snmp_minus_4_dot_0_dot_4_minus_java.lib.logstash.inputs.snmp.poll_clients(/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-snmp-4.0.4-java/lib/logstash/inputs/snmp.rb:168)
Sep 27 08:39:17 lst01 logstash[898]: org.jruby.RubyArray.each(org/jruby/RubyArray.java:1981)
Sep 27 08:39:17 lst01 logstash[898]: usr.share.logstash.vendor.bundle.jruby.$3_dot_1_dot_0.gems.logstash_minus_integration_minus_snmp_minus_4_dot_0_dot_4_minus_java.lib.logstash.inputs.snmp.poll_clients(/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-snmp-4.0.4-java/lib/logstash/inputs/snmp.rb:153)
Sep 27 08:39:17 lst01 logstash[898]: usr.share.logstash.vendor.bundle.jruby.$3_dot_1_dot_0.gems.logstash_minus_integration_minus_snmp_minus_4_dot_0_dot_4_minus_java.lib.logstash.inputs.snmp.run(/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-snmp-4.0.4-java/lib/logstash/inputs/snmp.rb:145)
Sep 27 08:39:17 lst01 logstash[898]: usr.share.logstash.vendor.bundle.jruby.$3_dot_1_dot_0.gems.logstash_minus_integration_minus_snmp_minus_4_dot_0_dot_4_minus_java.lib.logstash.inputs.snmp.every(/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-snmp-4.0.4-java/lib/logstash/inputs/snmp.rb:352)
Sep 27 08:39:17 lst01 logstash[898]: usr.share.logstash.vendor.bundle.jruby.$3_dot_1_dot_0.gems.logstash_minus_integration_minus_snmp_minus_4_dot_0_dot_4_minus_java.lib.logstash.inputs.snmp.run(/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-integration-snmp-4.0.4-java/lib/logstash/inputs/snmp.rb:144)
Sep 27 08:39:17 lst01 logstash[898]: usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.inputworker(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:414)
Sep 27 08:39:17 lst01 logstash[898]: usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.start_input(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:405)
Sep 27 08:39:17 lst01 logstash[898]: org.jruby.RubyProc.call(org/jruby/RubyProc.java:354)
Sep 27 08:39:17 lst01 logstash[898]: java.lang.Thread.run(java/lang/Thread.java:1583)
Sep 27 08:39:18 lst01 logstash[898]: [2024-09-27T08:39:18,083][ERROR][logstash.javapipeline    ][oid-ups-pipe][b1fddafd15ef7a870481915cee698c7c2484f5baa4a556413b28a7823b1134b5] A plugin had an unrecoverable error. Will restart this plugin.
Sep 27 08:39:18 lst01 logstash[898]:   Pipeline_id:oid-ups-pipe

my config:

input {
  snmp {
    get => [".1.3.6.1.2.1.1.5.0", ".1.3.6.1.2.1.1.6.0", ".1.3.6.1.4.1.318.1.1.1.1.2.2.0", ".1.3.6.1.4.1.318.1.1.1.2.1.3.0", ".1.3.6.1.4.1.318.1.1.1.1.2.3.0", ".1.3.6.1.4.1.318.1.1.1.1.1.1.0"]
           hosts => [
{host => "udp:12.1.6.2/161" community => "psKC" version => "1" timeout => 3000},
{host => "udp:2.1.0.16/161" community => "psKC" version => "1" timeout => 3000},
{host => "udp:12.6.4.18/161" community => "psKC" version => "1" timeout => 3000},
{host => "udp:12.6.10.13/161" community => "psKC" version => "1" timeout => 3000},
... + 300 line device
]
interval => 30
  }
filter {
mutate {
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.2.1.3.0" => "Battery_Last_Replace_Date" }
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.1.2.2.0" => "Manufacture_Date"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.3.2.3.0" => "Min.Input_voltage"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.3.2.2.0" => "Max.Input_voltage"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.3.2.1.0" => "Input_voltage"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.2.2.3.0" => "Battery_life(m)"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.2.2.1.0" => "Battery_capacity(%)"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.4.3.1.0" => "Outgoing_voltage"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.4.3.3.0" => "Load(%)"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.4.3.4.0" => "Load(A)"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.4.2.8.0" => "Load(Watt)"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.4.2.9.0" => "Load(VA)"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.2.2.4.0" => "Self-diagnosis_result"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.2.2.8.0" => "Battery_bus_voltage"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.2.2.2.0" => "T_UPS"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.25.1.2.1.6.1.1" => "T_Cupboard"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.4.2.2.1.3.1" => "S/N"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.2.2.5.0" => "BatteryNumOfBattPacks"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.1.2.5.0" => "part_number"}
        rename => { "iso.org.dod.internet.mgmt.mib-2.system.sysName.0" => "SysName"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.1.2.3.0" => "SerialNumber"}
        rename => { "iso.org.dod.internet.mgmt.mib-2.system.sysLocation.0" => "Location"}
        rename => { "iso.org.dod.internet.private.enterprises.318.1.1.1.1.1.1.0" => "ModelUPS"}
}
date {
        #locale => "en"
        match => [ "Battery_Last_Replace_Date", "dd.MM.yyyy", "ISO8601", "MM/dd/yy" ]
        timezone => "Europe/Kiev"
        target => "Battery_Last_Replace_Date_end"
        }
    date {
        #locale => "en"
        match => [ "Manufacture_Date", "dd.MM.yyyy", "ISO8601", "MM/dd/yy" ]
        timezone => "Europe/Kiev"
        target => "Manufacture_Date_new"
        }
}
output {
  elasticsearch {
        hosts => ["https://eig01:9200", "https://eig02:9200"]
          index => "oid-ups-%{+YYYY}"
          user => "user"
          password => "password"
          ssl_enabled => true
          ssl_certificate_authorities => "/usr/local/share/ca-certificates/elastic-stack-ca-pub-prod.crt"
           action => update
          doc_as_upsert => true
          document_id => "%{SysName}"
         }
}

I stopped getting any actual data at all.

2

327 devices I'm polling or is that a lot, where can I see recommendations for limits? or how can this config be optimized to work?

3

The problem has been solved, the error was due to problems in the poll configuration (there was an extra space).