# Elasticsearch dead recently without modify anything

**URL:** <https://discuss.elastic.co/t/elasticsearch-dead-recently-without-modify-anything/116839>\
**Category:** Elasticsearch\
**Created:** [January 24, 2018, 10:02am UTC](https://discuss.elastic.co/t/elasticsearch-dead-recently-without-modify-anything/116839 "2018-01-24T10:02:31Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![kiwi0217](https://avatars.discourse-cdn.com/v4/letter/k/b19c9b/32.png) [@kiwi0217](https://discuss.elastic.co/u/kiwi0217)\
**Post date:** [January 24, 2018, 10:02am UTC](https://discuss.elastic.co/t/elasticsearch-dead-recently-without-modify-anything/116839/1 "2018-01-24T10:02:31Z")

</div>

i use kibana in Ubuntu16.04 and it shows：  
Elasticsearch plugin is red  
Unable to connect to Elasticsearch at [http://127.0.0.1:9200](http://127.0.0.1:9200)

and i check about service and elasticsearch already dead. If I use command  
" **service elasticsearch restart**".  
It will be run for a while and dead with message shows by fellowing：  
""  
Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: enabled)  
Active: inactive (dead) since 三 2018-01-24 17:28:29 CST; 19min ago  
Docs: [http://www.elastic.co](http://www.elastic.co)  
Process: 1321 ExecStart=/usr/share/elasticsearch/bin/elasticsearch -p ${PID\_DIR}/elasticsearch.pid --quiet -Edefault.path.logs=${LOG\_DIR} -Edefault.path.data=${DATA\_DIR} -Edefault.path.co  
Process: 1318 ExecStartPre=/usr/share/elasticsearch/bin/elasticsearch-systemd-pre-exec (code=exited, status=0/SUCCESS)  
Main PID: 1321 (code=exited, status=0/SUCCESS)  
一 24 17:28:27 jupyter elasticsearch[1321]: [2018-01-24T17:28:27,535][WARN][o.e.c.l.LogConfigurator] ignoring unsupported logging configuration file [/etc/elasticsearch/logging.yml], l  
""

and the ES log shows：  
""  
[2018-01-24T17:28:27,535][WARN][o.e.c.l.LogConfigurator] ignoring unsupported logging configuration file [/etc/elasticsearch/logging.yml], logging is configured via [/etc/elasticsearch/log4j2.properties]  
""

So, can anyone help me what is wrong in my computer? Is there somewhere capacity leak? Or something else. THX

---

<div class="post-metadata">

**Author:** ![tomcgn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomcgn/32/26983_2.png) [@tomcgn](https://discuss.elastic.co/u/tomcgn)\
**Post date:** [January 25, 2018, 9:15pm UTC](https://discuss.elastic.co/t/elasticsearch-dead-recently-without-modify-anything/116839/2 "2018-01-25T21:15:43Z")

</div>

Same here. Did you update to Java 8 161 recently?

---

<div class="post-metadata">

**Author:** ![tomcgn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomcgn/32/26983_2.png) [@tomcgn](https://discuss.elastic.co/u/tomcgn)\
**Post date:** [January 25, 2018, 10:39pm UTC](https://discuss.elastic.co/t/elasticsearch-dead-recently-without-modify-anything/116839/3 "2018-01-25T22:39:22Z")

</div>

Inspecting with  
`sudo journalctl -xe`  
showed  
`Kernel tried to execute NX-protected page - exploit attempt?`

I reverted to the 4.13.0-25-generic linux kernel and now the service starts properly.

---

<div class="post-metadata">

**Author:** ![Jeff\_Soloshy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeff_soloshy/32/42738_2.png) [@Jeff\_Soloshy](https://discuss.elastic.co/u/Jeff_Soloshy)\
**Post date:** [January 26, 2018, 6:07pm UTC](https://discuss.elastic.co/t/elasticsearch-dead-recently-without-modify-anything/116839/4 "2018-01-26T18:07:41Z")

</div>

@tomcgn confirmed similar behaviour.

Logs showed `Kernel tried to execute NX-protected page - exploit attempt?` with kernel version `4.13.0-31-generic` but rolling back to `4.13.0.26-generic` fixed the issue.

Issue only arose after the first reboot. Re-installing after issue arose would not fix.

---

<div class="post-metadata">

**Author:** ![kiwi0217](https://avatars.discourse-cdn.com/v4/letter/k/b19c9b/32.png) [@kiwi0217](https://discuss.elastic.co/u/kiwi0217)\
**Post date:** [February 6, 2018, 6:21am UTC](https://discuss.elastic.co/t/elasticsearch-dead-recently-without-modify-anything/116839/5 "2018-02-06T06:21:39Z")

</div>

I use sudo journalctl -xe.  
And it shows ：  
二 06 14:10:04 jupyter kibana[1014]: {"type":"log","@timestamp":"2018-02-06T06:10:04Z","tags":["warning","elasticsearch","admin"],"pid":1014,"message":"Unable to revive connection: http:/  
二 06 14:10:04 jupyter kibana[1014]: {"type":"log","@timestamp":"2018-02-06T06:10:04Z","tags":["warning","elasticsearch","admin"],"pid":1014,"message":"No living connections"}  
And my java version is 1.8.0 and i am sure i do not update

---

<div class="post-metadata">

**Author:** ![kiwi0217](https://avatars.discourse-cdn.com/v4/letter/k/b19c9b/32.png) [@kiwi0217](https://discuss.elastic.co/u/kiwi0217)\
**Post date:** [February 6, 2018, 7:00am UTC](https://discuss.elastic.co/t/elasticsearch-dead-recently-without-modify-anything/116839/6 "2018-02-06T07:00:07Z")

</div>

and I also check my another ELK service.  
Java version is 1.8.0 and the elasticsearch can work

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2018, 7:00am UTC](https://discuss.elastic.co/t/elasticsearch-dead-recently-without-modify-anything/116839/7 "2018-03-06T07:00:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
