Cant Start Fresh Install of ES 5.0

Elastic Stack Elasticsearch
1

I spun up a new VirtualBox VM and installed ES 5.0 from yum and when I try to start it I get an error stating:

"OpenJDK Server VM Warning: If the number of processors is expected to increase from one, then you should configure the number of parallel GC threads appropriately using XX:ParallelGCThreads=N

The service then appears to start after the warning but when I enter "service elasticsearch status" to see if it is actually running, I see "elasticsearch dead but subsys locked". I then removed the lock(?) file located at /var/lock/subsys/elasticsearch , stopped the service and restarted it and now see "elasticsearch dead but pid file exists".

After all that, I checked the elasticsearch.log and see an error stating "node validation exception bootstrap checks failed max number of threads [1024] for user [elasticsearch] likely too low, increase to at least [2048]".

How do I fix these issues? I did increase the size of RAM on my VM to 3GB thinking it might be a memory issue but that did not help. Any help that anyone might be able to provide would be appreciated. Thanks.

Kevin

2

You can read more about this here and on the linked issues. Short version: it shouldn't hurt anything.

This is the reason it refused to start. This documents increasing the limit.

3

Thanks for the quick response. I will try again tomorrow and post an update.

4

Still having problems getting ES 5.0 up and running. Here is what I did:

  1. Attempted to stop ES even though it probably was not actually running even though my service start returned an OK. I could not hit 9200 on localhost using curl or see it running as a process, that is why I don't think it was even running.

  2. Ran ulimit -u 2048 to increase the number or threads.

  3. Ran service elasticsearch start to start the service which returned OK.

  4. Ran service elasticsearch status to make sure it was actually running and got a response back stating "elasticsearch dead but pid file exists".

  5. Checked the elasticsearch.log file and noted that ES was still complaining about the number of threads and therefore failed node validation and closed the node.

  6. Also noticed that I am seeing aperiodic errors stating:

" unable to install syscall filter:
java.lang.UnsupportedOperationException: seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in
at org.elasticsearch.bootstrap.Seccomp.linuxImpl(Seccomp.java:349) ~[elasticsearch-5.0.0.jar:5.0.0]"

I am attempting to start the service as root, is that why I am seeing the error in item 6? Any help in getting ES 5.0 running that any one could provide would be appreciated. Thanks.

Kevin

5

The seccomp stuff just means you aren't getting as much security as we'd like. Most modern linux installs should have it despite the 3.5+ message. A lot of distros have backported it.

About the ulimit - I expect that is a thing you have to do for the Elasticsearch user rather than for your own user.

6

I am still in the same boat and not having any luck getting ES 5.0 up and running. I did do a full yum update to update CentOS, etc and that did not change anything so I am going to uninstall and reinstall and see if that helps.

7

I believe, the administrator, has to change that ulimit setting. The package doesn't do it for you.

I think this link should help.

8

Ok, thanks. I will take another look.

9

Ok, I edited the /etc/security/limits.conf file to add the following entries to address the number of threads issue and set the max number of file handles and that appeared to address some of my previous issues:

elasticsearch - nproc 2048
elasticsearch - nofile 65336

I then tried to su to the elasticsearch user and got an error stating "This account is currently not available" so I added the bash shell to the user. I then switched to the elasticsearch user and changed dir into /usr/share/elasticsearch /bin and tried to start the service manually and got this bootstrap exception:

NoSuchFileException: /usr/share/elasticsearch/config

I then created a symbolic link between /etc/elasticsearch and /usr/share/elasticsearch/config and now see the following issues when trying to start the service manually:

" Unable to install syscall filter: java.lang.UnsupportedException: seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed"

The service does appear to start and I can hit it from localhost but not a browser even though I set the network.host to my IP, but that is a separate issue. How do I fix the error above? I updated my CentOS to 6.8 and that did not resolve the issue. Understand earlier in the chain you seemed to indicate that this was more of an info than anything, but does it actually hurt anything??? Please advise. Thanks.

Kevin

10

Hi Kevin,
Did you find a solution?. I'm in your painful track

12

Hi Ricardo,

No, I have not resolved the Unable to Install Syscall Filter issue but it does not appear to be affecting anything. I now have ES 5.0 running as a service and it starts up automatically when I fire up the VM with no issues. Or, are you having problems starting ES 5.0 in general?

Kevin

14

On my machine, it had to do with binding IP address in elasticsearch.yml file. I initially had network.host: 0.0.0.0, when I commented it out, the 'number of threads' error became a warning and Elasticsearch started up.