# 'Unix socket not present' in logs, but exists and verified with netcat

**URL:** <https://discuss.elastic.co/t/unix-socket-not-present-in-logs-but-exists-and-verified-with-netcat/149174>\
**Category:** Logstash\
**Created:** [September 19, 2018, 6:23pm UTC](https://discuss.elastic.co/t/unix-socket-not-present-in-logs-but-exists-and-verified-with-netcat/149174 "2018-09-19T18:23:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jworl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jworl/32/21896_2.png) [@jworl](https://discuss.elastic.co/u/jworl)\
**Post date:** [September 19, 2018, 6:23pm UTC](https://discuss.elastic.co/t/unix-socket-not-present-in-logs-but-exists-and-verified-with-netcat/149174/1 "2018-09-19T18:23:12Z")

</div>

Hello,

I have a Ceph storage cluster for S3 Object storage, and the radosgw service uses a Unix socket for logs. I have verified the socket works properly with netcat, and my work around as of late has been to pipe this to a file, then run filebeat. The filebeat solution is pretty clumsy, and using logstash with the logstash.inputs.unix plugin seems much cleaner.

Unfortunately, logstash continues to say "Socket not present" in the logs like so:  
[2018-09-19T18:16:54,184][WARN][logstash.inputs.unix] Socket not present, wait for seconds for socket to appear {:client=\>"/var/run/ceph/opslog"}  
[2018-09-19T18:16:59,184][WARN][logstash.inputs.unix] Socket not present, wait for seconds for socket to appear {:client=\>"/var/run/ceph/opslog"}  
[2018-09-19T18:17:04,184][WARN][logstash.inputs.unix] Socket not present, wait for seconds for socket to appear {:client=\>"/var/run/ceph/opslog"}

I am not sure why this is. A simple: `nc -U /var/run/ceph/opslog` presents results

```
[root@server]# nc -U /var/run/ceph/opslog
{"bucket":"ownersbucket","time":"2018-09-19 17:42:14.110497Z","time_local":"2018-09-19 17:42:14.110497","remote_addr":"10.188.50.107","object_owner":"iamowner","user":"anonymous","operation":"GET","uri":"GET /ownersbucket/test_file.tgz HTTP/1.1","http_status":"200","error_code":"","bytes_sent":8102638,"bytes_received":0,"object_size":8102638,"total_time":126889,"user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.92 Safari/537.36","referrer":""},

```

maybe I have an incorrect input configuration? Or maybe I am misunderstanding the use of this plugin? Seems pretty straight forward though.

```
input {
  unix {
    id => "radosgw"
    mode => "client"
    path => "/var/run/ceph/opslog"
    codec => "json_lines"
  }
}

```

I also verified:

- socket is not in use by someone else
- socket has read permission for everyone
- plugin-input-unix is installed

Any suggestions would be very appreciated! I would love to get away from my clunky netcat -\> flat file -\> filebeat implementation.

best regards,  
jw

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [September 20, 2018, 7:53pm UTC](https://discuss.elastic.co/t/unix-socket-not-present-in-logs-but-exists-and-verified-with-netcat/149174/2 "2018-09-20T19:53:30Z")

</div>

The way the plugin gets to this state is if Ruby's `File::socket?(path)` returns false. Since JRuby uses the Java filesystem bindings, I believe this can occur if the Java Security Manager is enabled and does not provide access to the file at that path. If you create a socket in Logstash's config directory, does the same problem persist?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 18, 2018, 7:53pm UTC](https://discuss.elastic.co/t/unix-socket-not-present-in-logs-but-exists-and-verified-with-netcat/149174/3 "2018-10-18T19:53:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.