I have java process which does not die neither with SIGTERM nor SIGKILL.

logstash  2591     1 99 13:22 ?        00:01:46 /usr/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+DisableExplicitGC -Djava.awt.headless=true -Dfile.encoding=UTF-8 -XX:+HeapDumpOnOutOfMemoryError -Xmx1g -Xms256m -Xss2048k -Djffi.boot.library.path=/usr/share/logstash/vendor/jruby/lib/jni -Xbootclasspath/a:/usr/share/logstash/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/usr/share/logstash/vendor/jruby -Djruby.lib=/usr/share/logstash/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main --1.9 /usr/share/logstash/lib/bootstrap/environment.rb logstash/runner.rb --path.settings /etc/logstash

It respawns everytime signal is received.

Sep 15 13:22:17 test init: logstash main process (2546) killed by KILL signal
Sep 15 13:22:17 test init: logstash main process ended, respawning

It sounds strange but even I reboot the server, it still does not die.

Process was executed through init script with below command:


runuser -s /bin/sh -c "exec $DAEMON ${LS_OPTS}" ${LS_USER} &>${LS_STDERR} &

Is there any way to force this process to kill other than reinstalling the OS?


Process :

logstash 5.0.0~alpha5

OS :

Red Hat Enterprise Linux Server release 6.7 (Santiago)

Java version :

openjdk version "1.8.0_101"
OpenJDK Runtime Environment (build 1.8.0_101-b13)
OpenJDK 64-Bit Server VM (build 25.101-b13, mixed mode)

Server is deployed on Microsoft Azure.

  • Renaming one of the required files for th eprocess before killing it should prevent it from successfully restarting. Sep 15, 2016 at 20:19
  • 6
    You got to behead it! That process clearly is an Highlander.
    – beppe9000
    Sep 15, 2016 at 22:55
  • 4
    @beppe9000 And while we're in that mood, we might as well execute its parents. Sep 16, 2016 at 7:40
  • 2
    As soon as I saw the title, I knew this would be Logstash Sep 16, 2016 at 11:00
  • 1
    Shoot it with an adamantium bullet in the head. Sep 17, 2016 at 0:46

2 Answers 2


init: logstash main process (2546) killed by KILL signal

Actually your process does stop here.

init: logstash main process ended, respawning

A new logstash process is started by init to replace it.

That is also shows which control process is responsible for restarting logstash: init. (On RHEL 6 and CentOS that is Upstart) Your process most likely gets started from either/etc/inittab or a drop-in file in /etc/init/logstash.conf (or similar) and should be controlled with the apropiate tool, initctl and not with kill.

Try initctl list to see if logstash is there.

Then initctl stop logstash will stop it.

Editing or removing the conf file in /etc/init will allow you to disable it persistently.

You might even be able to control the job with the service and chkconfig commands.

  • 4
    +1 for using the right tool for the job.
    – Mast
    Sep 16, 2016 at 19:52

It is probably because logstash-relay is running ... You should try to stop logstash-relay

after this check if the ps is there then initctl list | sort

I hope this will help you! It fixed the problem for me !



  • The information in the question clearly indicates that it was init which was responsible for respawning the process.
    – kasperd
    Jul 5, 2017 at 20:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.