# Syslog Listener Died - TCP/UDP **URL:** \ **Category:** Logstash\ **Created:** [April 20, 2018, 1:33pm UTC](https://discuss.elastic.co/t/syslog-listener-died-tcp-udp/128885 "2018-04-20T13:33:51Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![ElevenB2003](https://avatars.discourse-cdn.com/v4/letter/e/b9e5f3/32.png) [@ElevenB2003](https://discuss.elastic.co/u/ElevenB2003)\ **Post date:** [April 20, 2018, 1:33pm UTC](https://discuss.elastic.co/t/syslog-listener-died-tcp-udp/128885/1 "2018-04-20T13:33:52Z")
Hello, I just did a fresh setup of the latest version of the stack (6.2.4) and everything looks good except for my Logstash syslog listeners for TCP and UDP keep dying so I'm unable to ship in any syslog data. Here is the error output: 2018-04-20T08:23:04,368][INFO][logstash.inputs.syslog] Starting syslog tcp listener {:address=\>"0.0.0.0:5005"} [2018-04-20T08:23:07,720][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/common.rb:222:in`get\_event\_type'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/common.rb:47:in `event_action_tuple'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/common.rb:36:in`block in multi\_receive'", "org/jruby/RubyArray.java:2486:in `map'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-elasticsearch-9.1.1-java/lib/logstash/outputs/elasticsearch/common.rb:36:in`multi\_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output\_delegator\_strategies/shared.rb:13:in `multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator.rb:49:in`multi\_receive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:477:in `block in output_batch'", "org/jruby/RubyHash.java:1343:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:476:in `output_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:428:in`worker\_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:386:in `block in start_workers'"]} [2018-04-20T08:23:07,784][WARN][logstash.inputs.syslog] syslog listener died {:protocol=>:udp, :address=>"0.0.0.0:5005", :exception=>#, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:152:in`udp\_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:130:in `server'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:110:in`block in run'"]} [2018-04-20T08:23:07,799][WARN][logstash.inputs.syslog] syslog listener died {:protocol=\>:tcp, :address=\>"0.0.0.0:5005", :exception=\>#\, :backtrace=\>["org/jruby/ext/socket/RubyTCPServer.java:157:in `accept'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:170:in`tcp\_listener'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:130:in `server'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-syslog-3.4.1/lib/logstash/inputs/syslog.rb:114:in`block in run'"]} [2018-04-20T08:23:07,808][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (SystemExit) exit Looking for some ideas where to look next to get this resolved. Thanks! Edit: I reverted back to a snapshot of this that I took prior to installing/adding the x-packs. The listener has no problem running with no x-packs installed. So it seems to be related to that. ---
**Author:** ![ElevenB2003](https://avatars.discourse-cdn.com/v4/letter/e/b9e5f3/32.png) [@ElevenB2003](https://discuss.elastic.co/u/ElevenB2003)\ **Post date:** [May 7, 2018, 8:55pm UTC](https://discuss.elastic.co/t/syslog-listener-died-tcp-udp/128885/2 "2018-05-07T20:55:06Z")
Was not able to find a resolution. Ended up deploying 6.2.3 instead and have not had any issues. ---
**Author:** ![Emily1](https://avatars.discourse-cdn.com/v4/letter/e/76d3ee/32.png) [@Emily1](https://discuss.elastic.co/u/Emily1)\ **Post date:** [May 22, 2018, 4:15pm UTC](https://discuss.elastic.co/t/syslog-listener-died-tcp-udp/128885/3 "2018-05-22T16:15:18Z")
Hi, I can confirm I'm seeing the same issue upon installing logstash with X-Pack and 6.2.4. Was not seeing this crash before I added X-Pack. This bug also vanishes if X-Pack 6.2.4 is run without security turned on. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 19, 2018, 4:15pm UTC](https://discuss.elastic.co/t/syslog-listener-died-tcp-udp/128885/4 "2018-06-19T16:15:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.