# Strange error

**URL:** <https://discuss.elastic.co/t/strange-error/201437>\
**Category:** Logstash\
**Created:** [September 27, 2019, 4:32pm UTC](https://discuss.elastic.co/t/strange-error/201437 "2019-09-27T16:32:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![BeMoore](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bemoore/32/58724_2.png) [@BeMoore](https://discuss.elastic.co/u/BeMoore)\
**Post date:** [September 27, 2019, 4:32pm UTC](https://discuss.elastic.co/t/strange-error/201437/1 "2019-09-27T16:32:30Z")

</div>

```
Sep 27 17:22:55 ldnlinsocelk01 systemd[1]: Started logstash.

```

Sep 27 17:22:55 ldnlinsocelk01 logstash[15386]: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.  
Sep 27 17:22:57 ldnlinsocelk01 logstash[15386]: WARNING: An illegal reflective access operation has occurred  
Sep 27 17:22:57 ldnlinsocelk01 logstash[15386]: WARNING: Illegal reflective access by com.headius.backport9.modules.Modules (file:/usr/share/logstash/logstash-core/lib/jars/jruby-complete-9.2.7.0.jar) to field java.io.FileDescriptor.fd  
Sep 27 17:22:57 ldnlinsocelk01 logstash[15386]: WARNING: Please consider reporting this to the maintainers of com.headius.backport9.modules.Modules  
Sep 27 17:22:57 ldnlinsocelk01 logstash[15386]: WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations  
Sep 27 17:22:57 ldnlinsocelk01 logstash[15386]: WARNING: All illegal access operations will be denied in a future release  
Sep 27 17:23:11 ldnlinsocelk01 logstash[15386]: Thread.exclusive is deprecated, use Thread::Mutex  
Sep 27 17:23:15 ldnlinsocelk01 logstash[15386]: Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties  
Sep 27 17:23:15 ldnlinsocelk01 logstash[15386]: [2019-09-27T17:23:15,628][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\<ArgumentError: Path "/var/lib/logstash" must be a writable directory. It is not writable.\>, :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/settings.rb:489:in `validate'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:271:in`validate\_value'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:182:in `block in validate_all'", "org/jruby/RubyHash.java:1419:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:181:in `validate_all'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:283:in`execute'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:242:in`run'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:73:in`'"]}  
Sep 27 17:23:15 ldnlinsocelk01 logstash[15386]: [2019-09-27T17:23:15,664][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit  
Sep 27 17:23:15 ldnlinsocelk01 systemd[1]: logstash.service: Main process exited, code=exited, status=1/FAILURE  
Sep 27 17:23:15 ldnlinsocelk01 systemd[1]: logstash.service: Failed with result 'exit-code'.  
Sep 27 17:23:16 ldnlinsocelk01 systemd[1]: logstash.service: Service hold-off time over, scheduling restart.  
Sep 27 17:23:16 ldnlinsocelk01 systemd[1]: logstash.service: Scheduled restart job, restart counter is at 29.  
Sep 27 17:23:16 ldnlinsocelk01 systemd[1]: Stopped logstash.

this is after removing and reinstalling logstash several times today.  
ran the install from a fresh downloaded .deb on ubuntu 18.04 which for the past three weeks or so has been quite happily running elk stack in a test environment.

today after finally sorting out a filter problem, i was running through the system checking that everything was running ok before changing data paths to ingest new logs when i noticed the logstash service wasn't processing any filebeats inputs.  
i restarted logstash and then the problems started.

i've completely cleaned the system of all references to logstash after the third install, cleared the synaptics cach of the downloaded install, redownloaded a fresh logstash from the [elastic.co](http://elastic.co) site, ran the installs, installed and checked permissions on every logstash directory i can find

/etc/logstash  
/usr/share/logstash  
/lib/share/logstash  
and all the other little places it drops the files......

ran with the default permissions group for logstash, changed it to root, added logstash to root, added root to logstash, followed the errors on the access denies, to conclusion and i still can't get this to work.

can someone cast their eye over this and tell me if it seems familiar? has anyone had this sort of issue on a fresh install, repeated install or otherwise?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 27, 2019, 4:35pm UTC](https://discuss.elastic.co/t/strange-error/201437/2 "2019-09-27T16:35:49Z")

</div>

> [@BeMoore](#):
>
> error=\>#\<ArgumentError: Path "/var/lib/logstash" must be a writable directory. It is not writable

What are the permissions set to on /var/lib/logstash?

---

<div class="post-metadata">

**Author:** ![BeMoore](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bemoore/32/58724_2.png) [@BeMoore](https://discuss.elastic.co/u/BeMoore)\
**Post date:** [October 1, 2019, 8:33am UTC](https://discuss.elastic.co/t/strange-error/201437/3 "2019-10-01T08:33:34Z")

</div>

Hi, thanks for replying... it was the permissions... they were set to root and not logstash 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 29, 2019, 8:46am UTC](https://discuss.elastic.co/t/strange-error/201437/4 "2019-10-29T08:46:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
