# TCP Input "Too many files open" IOException **URL:** \ **Category:** Logstash\ **Created:** [January 5, 2022, 5:28am UTC](https://discuss.elastic.co/t/tcp-input-too-many-files-open-ioexception/293499 "2022-01-05T05:28:22Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ddth\_2022](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ddth_2022/32/99836_2.png) [@ddth\_2022](https://discuss.elastic.co/u/ddth_2022)\ **Post date:** [January 5, 2022, 5:28am UTC](https://discuss.elastic.co/t/tcp-input-too-many-files-open-ioexception/293499/1 "2022-01-05T05:28:22Z")
We're running Logstash 7.16.2. We're using a TCP input that opens up too many sockets without closing them and almost every 24 hours Logstash hangs up. [2022-01-05T05:10:59,474][WARN][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler java.io.IOException: Too many open files We have even tried increasing the ulimit but that doesn't help, is this a bug in the tcp input plugin? We observed this problem with Logstash 7.15.2 as well. ---
**Author:** ![Alex\_Marquardt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_marquardt/32/42925_2.png) [@Alex\_Marquardt](https://discuss.elastic.co/u/Alex_Marquardt)\ **Post date:** [January 5, 2022, 3:17pm UTC](https://discuss.elastic.co/t/tcp-input-too-many-files-open-ioexception/293499/2 "2022-01-05T15:17:10Z")
> [@ddth\_2022](#): > > We have even tried increasing the ulimit but that doesn't help, is this a bug in the tcp input plugin? We observed this problem with Logstash 7.15.2 as well. Do you have a load balancer driving data into Logstash? If so, it could be due to a configuration problem in a load balancer. Is the Load balancer correctly closing connections? It may be worth reviewing a tcpdump to see what is happening. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 5, 2022, 4:54pm UTC](https://discuss.elastic.co/t/tcp-input-too-many-files-open-ioexception/293499/3 "2022-01-05T16:54:22Z")
Are you using the tcp input as a server or a client? ---
**Author:** ![ddth\_2022](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ddth_2022/32/99836_2.png) [@ddth\_2022](https://discuss.elastic.co/u/ddth_2022)\ **Post date:** [January 6, 2022, 5:35am UTC](https://discuss.elastic.co/t/tcp-input-too-many-files-open-ioexception/293499/4 "2022-01-06T05:35:30Z")
Hey @Alex_Marquardt no there's no load balancer, there's a direct connection between the client (rsyslog) and Logstash. ---
**Author:** ![ddth\_2022](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ddth_2022/32/99836_2.png) [@ddth\_2022](https://discuss.elastic.co/u/ddth_2022)\ **Post date:** [January 6, 2022, 5:35am UTC](https://discuss.elastic.co/t/tcp-input-too-many-files-open-ioexception/293499/5 "2022-01-06T05:35:59Z")
Hey @Badger we're using it as a server ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [January 6, 2022, 4:14pm UTC](https://discuss.elastic.co/t/tcp-input-too-many-files-open-ioexception/293499/6 "2022-01-06T16:14:58Z")
I believe that in server mode it is up to the client to close the channel. The server will leave it open in case the client wants to use it again. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 3, 2022, 4:15pm UTC](https://discuss.elastic.co/t/tcp-input-too-many-files-open-ioexception/293499/7 "2022-02-03T16:15:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.