# Elasticsearch warn unable to install syscall filter

**URL:** https://discuss.elastic.co/t/elasticsearch-warn-unable-to-install-syscall-filter/42819
**Category:** Elasticsearch
**Created:** [February 26, 2016, 8:11am UTC](https://discuss.elastic.co/t/elasticsearch-warn-unable-to-install-syscall-filter/42819 "2016-02-26T08:11:57Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![peppetrick](https://avatars.discourse-cdn.com/v4/letter/p/3d9bf3/32.png) [@peppetrick](https://discuss.elastic.co/u/peppetrick)
#### Post date: [February 26, 2016, 8:11am UTC](https://discuss.elastic.co/t/elasticsearch-warn-unable-to-install-syscall-filter/42819/1 "2016-02-26T08:11:57Z")

</div>

Hi

with elasticsearch ver 2.20 and jdk 1.8.74 when elasticsearch start I see the followinf warning

[2016-02-22 12:16:00,140][WARN][bootstrap] unable to install  
syscall filter: seccomp unavailable: requires kernel 3.5+ with CONFIG\_SECCOMP and CONFIG\_SECCOMP\_FILTER compiled in

I can find no help on the web for that message.

Has anyone find a similar message, do I have to worry about that?

---

<div class="post-metadata">

### Author: ![jprante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jprante/32/44941_2.png) [@jprante](https://discuss.elastic.co/u/jprante)
#### Post date: [February 26, 2016, 12:41pm UTC](https://discuss.elastic.co/t/elasticsearch-warn-unable-to-install-syscall-filter/42819/2 "2016-02-26T12:41:13Z")

</div>

You can safely ignore this message.

The meaning of the message is that Elasticsearch security module made an extra effort to revoke Linux process privileges to reduce so called "attack vector" for malevolent activities, but your Linux kernel is either too old or not able to offer that process privilege revoke API. That does not influence or harm the function of Elasticsearch.

You should only consider to run a more modern Linux.

---

<div class="post-metadata">

### Author: ![anks](https://avatars.discourse-cdn.com/v4/letter/a/f07891/32.png) [@anks](https://discuss.elastic.co/u/anks)
#### Post date: [October 12, 2016, 4:27am UTC](https://discuss.elastic.co/t/elasticsearch-warn-unable-to-install-syscall-filter/42819/3 "2016-10-12T04:27:35Z")

</div>

I am getting this message in logs and ElasticSearch unable to start.

unable to install syscall filter: seccomp unavailable: CONFIG\_SECCOMP not compiled into kernel, CONFIG\_SECCOMP and CONFIG\_SECCOMP\_FILTER are needed

---

<div class="post-metadata">

### Author: ![dan\_r](https://avatars.discourse-cdn.com/v4/letter/d/f14d63/32.png) [@dan\_r](https://discuss.elastic.co/u/dan_r)
#### Post date: [January 24, 2017, 8:23am UTC](https://discuss.elastic.co/t/elasticsearch-warn-unable-to-install-syscall-filter/42819/4 "2017-01-24T08:23:57Z")

</div>

Hi  
I have the same problem and elasticsearch won't start. This is the only log es produces on service start.  
Does anyone have a solution?

Es 2.3.5  
On rhel 6.6

Thanks

---

<div class="post-metadata">

### Author: ![ki\_ran](https://avatars.discourse-cdn.com/v4/letter/k/bc8723/32.png) [@ki\_ran](https://discuss.elastic.co/u/ki_ran)
#### Post date: [January 30, 2017, 4:30am UTC](https://discuss.elastic.co/t/elasticsearch-warn-unable-to-install-syscall-filter/42819/5 "2017-01-30T04:30:27Z")

</div>

Elasticsearch unable to start. Does anyone have a solution?

> _unable to install syscall filter: java.lang.UnsupportedOperationException: seccomp unavailable: CONFIG\_SECCOMP not compiled into kernel, CONFIG\_SECCOMP and CONFIG\_SECCOMP\_FILTER are needed._

---

<div class="post-metadata">

### Author: ![carlosvega](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carlosvega/32/28433_2.png) [@carlosvega](https://discuss.elastic.co/u/carlosvega)
#### Post date: [April 17, 2017, 1:54pm UTC](https://discuss.elastic.co/t/elasticsearch-warn-unable-to-install-syscall-filter/42819/6 "2017-04-17T13:54:21Z")

</div>

Same here with 2.3.2.

[https://discuss.elastic.co/t/cant-start-es-with-heap-size-larger-than-7g/82580](https://discuss.elastic.co/t/cant-start-es-with-heap-size-larger-than-7g/82580)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:59pm UTC](https://discuss.elastic.co/t/elasticsearch-warn-unable-to-install-syscall-filter/42819/8 "2017-07-05T21:59:40Z")

</div>


