Windows: wrong number of arguments calling peeraddr (1 for 0)

[Rajeshkumar123]

I have installed log-courier 1.6 and logstash-input-log-courier 1.6 gems in logstash 1.5.0.

When I run the log-courier. I am facing the below issue. Its not fetching the file

a1\setup\iis\logs\u_ex150502.log
2015/05/28 07:06:40.442580 Started harvester at position 0 (requested 0): C:\Jav
a1\setup\iis\logs\a.log
2015/05/28 07:06:40.442580 Started harvester at position 0 (requested 0): C:\Jav
a1\setup\iis\logs\b.log
2015/05/28 07:06:40.458204 Spooler flushing 1024 events due to spool size reache
d
2015/05/28 07:06:40.472852 Spooler flushing 1024 events due to spool size reache
d
2015/05/28 07:06:55.442597 Transport init failed: TLS Handshake failure with 127
.0.0.1:10544: WSARecv tcp 127.0.0.1:62444: i/o timeout
2015/05/28 07:06:56.444486 Attempting to connect to 127.0.0.1:10544
2015/05/28 07:06:57.450281 Transport init failed: Failed to connect to 127.0.0.1
:10544: dial tcp 127.0.0.1:10544: ConnectEx tcp: No connection could be made bec
ause the target machine actively refused it.

Do I need to downgrade the gems version ?

[driskell]

What is your configuration for Log Courier "network" and for Logstash "input"?

[driskell]

Also, are any logs reported by Logstash? The timeout and refused connection looks to mean the Logstash crashed.

[driskell]

Are any logs reported by Logstash? The timeout and refused connection looks to mean the Logstash crashed.

[driskell]

Hi - Did you check Logstash logs?

[Rajeshkumar123]

This is the information I found in logcourier logs. I couldn't find logstash logs
{"C:\Java1\setup\log\logs\u_1.log":{"vol":108030804,"idxhi":196608,"idxlo":306065,"source":"C:\Java1\setup\log\logs\u_1.log"},
"C:\Java1\setup\log\logs\u_2.log":{"vol":108030804,"idxhi":196608,"idxlo":306066,"source":"C:\Java1\setup\log\logs\u_2.log"},
"C:\Java1\setup\log\logs\u_2.log":{"vol":108030804,"idxhi":196608,"idxlo":306067,"source":"C:\Java1\setup\log\logs\u_3.log"},
"C:\Java1\setup\log\logs\u_3.log":{"vol":108030804,"idxhi":196608,"idxlo":306068,"source":"C:\Java1\setup\log\logs\u_4.log"}}

[driskell]

If you run logstash on command line you should be able to see logs - they may have been buffered in memory and not written. Running from command line with bin/logstash -f config.conf should stop buffering them. It's definitely a problem on Logstash side in the input plugin somewhere

[Rajeshkumar123]

I used to see this message in logstash when I run the logcourier.

←[33mwrong number of arguments calling peeraddr (1 for 0) {:hint=>"Unknown err
or, shutting down", :level=>:warn, :exception=>ArgumentError, :backtrace=>["C:/J
ava1/logstash-1.5.0/vendor/bundle/jruby/1.9/gems/log-courier-1.6/lib/log-courier
/server_tcp.rb:37:in accept'", "C:/Java1/logstash-1.5.0/vendor/jruby/lib/ruby/s hared/jopenssl19/openssl/ssl-internal.rb:160:inaccept'", "C:/Java1/logstash-1.
5.0/vendor/bundle/jruby/1.9/gems/log-courier-1.6/lib/log-courier/server_tcp.rb:1
44:in run'", "org/jruby/RubyKernel.java:1507:inloop'", "C:/Java1/logstash-1.5
.0/vendor/bundle/jruby/1.9/gems/log-courier-1.6/lib/log-courier/server_tcp.rb:13
8:in run'", "C:/Java1/logstash-1.5.0/vendor/bundle/jruby/1.9/gems/log-courier-1 .6/lib/log-courier/server.rb:73:inrun'"], "plugin"=>"input/courier", "port"=>1
0548}←[0m
Logstash startup completed {"plugin"=>"input/courier", "port"=>10548}

[driskell]

OK, interesting, this is a bug. I'll investigate this soon and get a fix for 1.7 which is just around the corner.

Looks to be Windows specific.

[driskell]

How are you running Logstash? What command do you run?

[Rajeshkumar123]

bin/logstash agent -f sample.conf

[Rajeshkumar123]

In logcourier I can find some spooler message also.

2015/05/29 03:54:28.234708 Started harvester at position 0 (requested 0): C:\Use
rs\156687\Documents\Java\ac505.xml
2015/05/29 03:54:28.236661 Started harvester at position 0 (requested 0): C:\Use
rs\156687\Documents\Java\eb5.xml
2015/05/29 03:54:33.216811 Spooler flushing 3 events due to spool timeout exceed
ed

2015/05/29 03:54:38.239927 Stopping harvest of C:\Users\156687\Documents\Java\eb5.xml; last ch
ange was 10s ago
2015/05/29 03:54:39.233027 Stopping harvest of C:\Users\156687\Documents\Java\ac505.xml; last ch
ange was 10s ago
2015/05/29 03:54:43.223006 Transport init failed: TLS Handshake failure with 127
.0.0.1:10548: WSARecv tcp 127.0.0.1:51587: i/o timeout
2015/05/29 03:54:44.223919 Attempting to connect to 127.0.0.1:10548
2015/05/29 03:54:45.227761 Transport init failed: Failed to connect to 127.0.0.1
:10548: dial tcp 127.0.0.1:10548: ConnectEx tcp: No connection could be made bec
ause the target machine actively refused it.

[driskell]

I've confirmed this and found related to a patch Logstash does to Ruby language on Windows:
elastic/logstash#3364

I'll fix the code for 1.7 by checking for the patch and working around it. Will also raise a PR if I have time for Logstash to stop other plugin developers hitting the problem.