Elasticsearch Migration from Windows to Linux – Swap Enabled and SELinux Enforcing

Elastic Stack Elasticsearch
1

Hi Team,

We are migrating our Elasticsearch 9.1.3 cluster from Windows Server to RHEL Linux (9.8). The environment consists of 2 dedicated master nodes, 4 data nodes, nodes, and 2 Logstash nodes.

As part of the Linux pre-requisites, we requested the OS team to configure the recommended Elasticsearch settings such as vm.max_map_count=262144, vm.swappiness=1, fs.file-max=65535, ulimit (nofile=65535, nproc=4096, memlock=unlimited), memory lock, and Transparent Huge Pages (THP). Most of these configurations have been completed successfully.

However, there are two points where the OS team has raised concerns:

  1. Swap: Their standard practice is to keep swap enabled. Currently, an 8 GB swap partition is configured but not being used (0B used). They are reluctant to disable swap unless there is a strong technical requirement.
    $ swapon --show
    NAME TYPE SIZE USED PRIO
    /dev/dm-5 partition 8G 0B -2

  2. SELinux: SELinux is configured in Enforcing mode. Changing it to Permissive or Disabled requires InfoSec approval. They mentioned they can keep SELinux in Enforcing mode if the required policies are configured.
    $ getenforce
    Enforcing

$ sestatus
SELinux status: enabled
Current mode: enforcing
Mode from config file: enforcing
Policy version: <policy_version>
Policy from config file: targeted

My questions are:

  • Is it safe to proceed with a production Elasticsearch deployment if swap remains enabled but unused?
  • If bootstrap.memory_lock: true is configured, is disabling swap still strongly recommended?
  • Has anyone successfully run Elasticsearch in production with swap enabled, and were there any performance or stability issues?
  • Is Elasticsearch 9.x fully supported with SELinux in Enforcing mode when the appropriate SELinux policies are configured?
  • Are there any additional recommendations or best practices for running Elasticsearch on RHEL with SELinux Enforcing?

I'd appreciate any guidance or production experience from the community. Thanks in advance!

2

I think this will help Disable swapping

3

It's a documented recommendation by the vendor. Quoting:

Swapping is very bad for performance, for node stability, and should be avoided at all costs.

Your OS team can quibble if they wish, just let them own any risks.

For selinux, I dont see any issue here with running in enforcing mode on RHEL. IIRC it's actually default when installed from rpm from official elasticsearch repo.

[rhel10x3 ~]$ sudo sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33
[rhel10x3 ~]$ sudo systemctl status elasticsearch.service
● elasticsearch.service - Elasticsearch
     Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; disabled; preset: disabled)
     Active: active (running) since Fri 2026-07-10 14:16:36 UTC; 21s ago