# Elasticsearch specification of new log area failures **URL:** \ **Category:** Elasticsearch\ **Created:** [March 4, 2019, 9:33pm UTC](https://discuss.elastic.co/t/elasticsearch-specification-of-new-log-area-failures/170797 "2019-03-04T21:33:15Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![jbellinger](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jbellinger](https://discuss.elastic.co/u/jbellinger)\ **Post date:** [March 4, 2019, 9:33pm UTC](https://discuss.elastic.co/t/elasticsearch-specification-of-new-log-area-failures/170797/1 "2019-03-04T21:33:16Z")
elasticsearch is failing to start, and /var/log/messages contains complaints about opening or creating files. I excerpt from that below. One thing that perplexes me is that despite the path.logs directive it persists in first attempting to write to /var/log/elasticsearch. ........................... On CentOS Linux release 7.6.1810 (Core) with java-1.8.0-openjdk-1.8.0.191.b12-1.el7\_6.x86\_64 and elasticsearch-6.6.1-1 ............................. From /etc/elasticsearch/elasticsearch.yml: # Path to directory where to store the data (separate multiple locations by comma): # path.data: "/mnt/data/elasticdata" # # Path to log files: # path.logs: "/mnt/data/elasticlogs" .............................. drwxr-x--- 2 elasticsearch elasticsearch 4096 Mar 1 14:45 elasticdata drwxr-x--- 2 elasticsearch elasticsearch 4096 Mar 1 14:45 elasticlogs But I find this, despite the path specifications. -rw-r--r-- 1 elasticsearch elasticsearch 3531 Mar 4 15:25 /var/log/elasticsearch/gc.log.0.current ............................. I split the first three lines from /var/log/messages containing the word ERROR, to make them more readable. Recall that /mnt/data/elasticlogs exists and is owned by elasticsearch Mar 4 15:25:55 elk-1 elasticsearch: 2019-03-04 15:25:55 703 main ERROR Unable to create file /mnt/data/elasticlogs/elastic-1.log java.io.IOException: Could not create directory /mnt/data/elasticlogs Mar 4 15:25:55 elk-1 elasticsearch: 2019-03-04 15:25:55 708 main ERROR Could not create plugin of type class org.apache.logging.log4j.core.appender.RollingFileAppender for element RollingFile: java.lang.IllegalStateException: ManagerFactory [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory@6a2f6f80] unable to create manager for [/mnt/data/elasticlogs/elastic-1.log] with data [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$FactoryData@45b4c3a9[pattern=/mnt/data/elasticlogs/elastic-1-%d{yyyy-MM-dd}-%i.log.gz append=true bufferedIO=true bufferSize=8192 policy=CompositeTriggeringPolicy(policies=[TimeBasedTriggeringPolicy(nextRolloverMillis=0 interval=1 modulate=true) SizeBasedTriggeringPolicy(size=134217728)]) strategy=DefaultRolloverStrategy(min=-2147483648 max=2147483647 useMax=false) advertiseURI=null layout=[%d{ISO8601}][%-5p][%-25c{1.}] [%node\_name]%marker %.-10000m%n filePermissions=null fileOwner=null]] java.lang.IllegalStateException: ManagerFactory [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory@6a2f6f80] unable to create manager for [/mnt/data/elasticlogs/elastic-1.log] with data [org.apache.logging.log4j.core.appender.rolling.RollingFileManager$FactoryData@45b4c3a9[pattern=/mnt/data/elasticlogs/elastic-1-%d{yyyy-MM-dd}-%i.log.gz append=true bufferedIO=true bufferSize=8192 policy=CompositeTriggeringPolicy(policies=[TimeBasedTriggeringPolicy(nextRolloverMillis=0 interval=1 modulate=true) SizeBasedTriggeringPolicy(size=134217728)]) strategy=DefaultRolloverStrategy(min=-2147483648 max=2147483647 useMax=false) advertiseURI=null layout=[%d{ISO8601}][%-5p][%-25c{1.}] [%node\_name]%marker %.-10000m%n filePermissions=null fileOwner=null]] Mar 4 15:25:55 elk-1 elasticsearch: 2019-03-04 15:25:55 710 main ERROR Unable to invoke factory method in class org.apache.logging.log4j.core.appender.RollingFileAppender for element RollingFile: java.lang.IllegalStateException: No factory method found for class org.apache.logging.log4j.core.appender.RollingFileAppender java.lang.IllegalStateException: No factory method found for class org.apache.logging.log4j.core.appender.RollingFileAppender ---
**Author:** ![jbellinger](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jbellinger](https://discuss.elastic.co/u/jbellinger)\ **Post date:** [March 6, 2019, 10:09pm UTC](https://discuss.elastic.co/t/elasticsearch-specification-of-new-log-area-failures/170797/2 "2019-03-06T22:09:03Z")
I still have no idea why it attempts to write to /var/log/elasticsearch first. However, I discovered that elasticsearch wants to own the directories ABOVE the specified ones as well. /mnt/data/elasticlogs AND /mnt/data Once I set ownership of /mnt/data as well, this problem went away. ---
**Author:** ![ariemenschneider](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ariemenschneider/32/33564_2.png) [@ariemenschneider](https://discuss.elastic.co/u/ariemenschneider)\ **Post date:** [March 7, 2019, 11:04am UTC](https://discuss.elastic.co/t/elasticsearch-specification-of-new-log-area-failures/170797/3 "2019-03-07T11:04:09Z")
The path for the GC log is defined in /etc/elasticsearch/jvm.options (as this is a command line argument for the Java-VM). Regards, Alex ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 4, 2019, 11:04am UTC](https://discuss.elastic.co/t/elasticsearch-specification-of-new-log-area-failures/170797/4 "2019-04-04T11:04:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.