Elasticsearch fails to start on ubuntu 20.04

[josephthejoe]

There seems to be a lot of these types of posts ive gone through a ton of them and havent been able to find one spitting out similar errors to what I have. No logs just the output from systemctl status.

lab@siem:~$ systemctl status elasticsearch.service
● elasticsearch.service - Elasticsearch
     Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Fri 2021-01-29 20:13:56 UTC; 8s ago
       Docs: https://www.elastic.co
    Process: 2734 ExecStart=/usr/share/elasticsearch/bin/systemd-entrypoint -p ${PID_DIR}/elasticsearch.pid --quiet (code=exited, status=1/FAILURE)
   Main PID: 2734 (code=exited, status=1/FAILURE)

Jan 29 20:13:56 siem systemd-entrypoint[2788]:         at java.base/sun.nio.fs.UnixFileSystemProvider.createDirectory(UnixFileSystemProvider.java:388)
Jan 29 20:13:56 siem systemd-entrypoint[2788]:         at java.base/java.nio.file.Files.createDirectory(Files.java:694)
Jan 29 20:13:56 siem systemd-entrypoint[2788]:         at java.base/java.nio.file.TempFileHelper.create(TempFileHelper.java:135)
Jan 29 20:13:56 siem systemd-entrypoint[2788]:         at java.base/java.nio.file.TempFileHelper.createTempDirectory(TempFileHelper.java:172)
Jan 29 20:13:56 siem systemd-entrypoint[2788]:         at java.base/java.nio.file.Files.createTempDirectory(Files.java:1011)
Jan 29 20:13:56 siem systemd-entrypoint[2788]:         at org.elasticsearch.tools.launchers.Launchers.createTempDirectory(Launchers.java:66)
Jan 29 20:13:56 siem systemd-entrypoint[2788]:         at org.elasticsearch.tools.launchers.TempDirectory.main(TempDirectory.java:54)
Jan 29 20:13:56 siem systemd[1]: elasticsearch.service: Main process exited, code=exited, status=1/FAILURE
Jan 29 20:13:56 siem systemd[1]: elasticsearch.service: Failed with result 'exit-code'.
Jan 29 20:13:56 siem systemd[1]: Failed to start Elasticsearch.

Has anyone seen a similar problem? This was working before but after a reboot it stopped working. Logs are saved to a NFS share which I thought was the problem at first but its connected and working now.

[pjanzen (Paul Janzen)]

There should be a lot more information in de Elasticsearch logs. Checkout /var/log/elasticsearch
From the snippet it shows there seems to be a problem with permission on a toplevel directory. ES wants to create a sub dir and is not allowed to..

[josephthejoe]

Unfortunately there is nothing in the log file

lab@siem:~$ sudo tail -100 /var/log/elasticsearch/elasticsearch.log
lab@siem:~$

[pjanzen (Paul Janzen)]

Try starting ES in the forground, that might tell you whats wrong..

[josephthejoe]

Im not sure I know what you mean by in the forground?

[pjanzen (Paul Janzen)]

Check this run ES

[HKN_MZ]

systemctl status elasticsearch.service hasnt said exactly error reason

Can you use this code ?
Journalctl -xe