# Elasticsearch Migration from Windows to Linux – Swap Enabled and SELinux Enforcing **URL:** \ **Category:** Elasticsearch\ **Created:** [July 10, 2026, 10:14am UTC](https://discuss.elastic.co/t/elasticsearch-migration-from-windows-to-linux-swap-enabled-and-selinux-enforcing/388113 "2026-07-10T10:14:37Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Shubham\_Khodpe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shubham_khodpe/32/147372_2.png) [@Shubham\_Khodpe](https://discuss.elastic.co/u/Shubham_Khodpe)\ **Post date:** [July 10, 2026, 10:14am UTC](https://discuss.elastic.co/t/elasticsearch-migration-from-windows-to-linux-swap-enabled-and-selinux-enforcing/388113/1 "2026-07-10T10:14:37Z")
Hi Team, We are migrating our Elasticsearch 9.1.3 cluster from Windows Server to RHEL Linux (9.8). The environment consists of 2 dedicated master nodes, 4 data nodes, nodes, and 2 Logstash nodes. As part of the Linux pre-requisites, we requested the OS team to configure the recommended Elasticsearch settings such as `vm.max_map_count=262144`, `vm.swappiness=1`, `fs.file-max=65535`, `ulimit` (`nofile=65535`, `nproc=4096`, `memlock=unlimited`), memory lock, and Transparent Huge Pages (THP). Most of these configurations have been completed successfully. However, there are two points where the OS team has raised concerns: 1. **Swap:** Their standard practice is to keep swap enabled. Currently, an 8 GB swap partition is configured but not being used (`0B used`). They are reluctant to disable swap unless there is a strong technical requirement. $ swapon --show NAME TYPE SIZE USED PRIO /dev/dm-5 partition 8G 0B -2 2. **SELinux:** SELinux is configured in **Enforcing** mode. Changing it to **Permissive** or **Disabled** requires InfoSec approval. They mentioned they can keep SELinux in Enforcing mode if the required policies are configured. $ getenforce Enforcing $ sestatus SELinux status: enabled Current mode: enforcing Mode from config file: enforcing Policy version: \ Policy from config file: targeted My questions are: - Is it safe to proceed with a production Elasticsearch deployment if swap remains enabled but unused? - If `bootstrap.memory_lock: true` is configured, is disabling swap still strongly recommended? - Has anyone successfully run Elasticsearch in production with swap enabled, and were there any performance or stability issues? - Is Elasticsearch 9.x fully supported with SELinux in **Enforcing** mode when the appropriate SELinux policies are configured? - Are there any additional recommendations or best practices for running Elasticsearch on RHEL with SELinux Enforcing? I'd appreciate any guidance or production experience from the community. Thanks in advance! ---
**Author:** ![kkumar123](https://avatars.discourse-cdn.com/v4/letter/k/e9c0ed/32.png) [@kkumar123](https://discuss.elastic.co/u/kkumar123)\ **Post date:** [July 10, 2026, 11:57am UTC](https://discuss.elastic.co/t/elasticsearch-migration-from-windows-to-linux-swap-enabled-and-selinux-enforcing/388113/2 "2026-07-10T11:57:18Z")
> [@Shubham\_Khodpe](#): > > - If `bootstrap.memory_lock: true` is configured, is disabling swap still strongly recommended? I think this will help [Disable swapping](https://www.elastic.co/docs/deploy-manage/deploy/self-managed/setup-configuration-memory) ---
**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\ **Post date:** [July 10, 2026, 2:17pm UTC](https://discuss.elastic.co/t/elasticsearch-migration-from-windows-to-linux-swap-enabled-and-selinux-enforcing/388113/3 "2026-07-10T14:17:43Z")
> [@Shubham\_Khodpe](#): > > They are reluctant to disable swap unless there is a strong technical requirement. It's a documented recommendation by the vendor. Quoting: > Swapping is very bad for performance, for node stability, and should be avoided at all costs. Your OS team can quibble if they wish, just let them own any risks. For selinux, I dont see any issue here with running in enforcing mode on RHEL. IIRC it's actually default when installed from rpm from official elasticsearch repo. ```auto [rhel10x3 ~]$ sudo sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 33 [rhel10x3 ~]$ sudo systemctl status elasticsearch.service ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; disabled; preset: disabled) Active: active (running) since Fri 2026-07-10 14:16:36 UTC; 21s ago ``` ---
**Author:** ![Keith\_Massey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/keith_massey/32/83666_2.png) [@Keith\_Massey](https://discuss.elastic.co/u/Keith_Massey)\ **Post date:** [July 10, 2026, 2:54pm UTC](https://discuss.elastic.co/t/elasticsearch-migration-from-windows-to-linux-swap-enabled-and-selinux-enforcing/388113/4 "2026-07-10T14:54:04Z")
> [@Shubham\_Khodpe](#): > > 2 dedicated master nodes It's not the main point of your post, but you don't want 2 dedicated master nodes -- that is no better than 1 (actually worse). If 1 goes down, you can't get a quorum to elect a new one. ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [July 13, 2026, 12:01pm UTC](https://discuss.elastic.co/t/elasticsearch-migration-from-windows-to-linux-swap-enabled-and-selinux-enforcing/388113/5 "2026-07-13T12:01:49Z")
> [@Keith\_Massey](#): > > you don't want 2 dedicated master nodes -- that is no better than 1 (actually worse) ++ you probably don't want dedicated master nodes at all for such a tiny cluster. Make your data nodes master-eligible. It'll be simpler _and_ more robust, what's not to like? 🙂 ---
**Author:** ![davidwarner44](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidwarner44/32/147872_2.png) [@davidwarner44](https://discuss.elastic.co/u/davidwarner44)\ **Post date:** [July 15, 2026, 9:58am UTC](https://discuss.elastic.co/t/elasticsearch-migration-from-windows-to-linux-swap-enabled-and-selinux-enforcing/388113/6 "2026-07-15T09:58:57Z")
Keeping swap enabled but unused is generally fine if `bootstrap.memory_lock: true` is working and the JVM never swaps. SELinux in Enforcing mode is also supported with the proper policies, and many production RHEL deployments run this way. I'd validate memory locking and check for SELinux AVC denials during testing before going live.