working on 8.18.x:
drwx------ 3 50017 50017 6144 Oct 8 16:52 logs
TBC this is surprising to me independent of the entitlements thing. Elasticsearch needs to be able to write logs. I’m amazed it doesn’t fail in this situation.
Anyway if you run out of other ideas (and you can get it to pass/fail with just a logs path permissions change while using EFS in both cases) then the next step is strace:
we probably need to break out
straceand compare the actual sequence of syscalls between the working and broken versions to see where the difference in behaviour is coming from.
This is all called from Elasticsearch.main pretty early in startup so there aren’t lots of interleaved threads or other stuff to worry about.