# Error starting Elastic Search **URL:** \ **Category:** Elasticsearch\ **Created:** [October 14, 2022, 4:08pm UTC](https://discuss.elastic.co/t/error-starting-elastic-search/316659 "2022-10-14T16:08:42Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![ArrakisMiner](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@ArrakisMiner](https://discuss.elastic.co/u/ArrakisMiner)\ **Post date:** [October 14, 2022, 4:08pm UTC](https://discuss.elastic.co/t/error-starting-elastic-search/316659/1 "2022-10-14T16:08:42Z")
I'm having issues trying to start Elastic Search after installation, and I'm not sure how to get around it, nor can I find any similar topics with solutions online. When I run `systemctl start elasticsearch`, I get the error that the service cannot be started, when running `journalctl -xe`, this is the error that is outputted: ```auto Oct 14 15:59:09 audit[1515329]: USER_AUTH pid=1515329 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication grantors=? acct="root" exe="/usr/sbin/sshd" hostname=61.177.173.47 addr=61.17> Oct 14 15:59:10 sshd[1515329]: Failed password for root from 61.177.173.47 port 53823 ssh2 Oct 14 15:59:10 audit[1515329]: USER_LOGIN pid=1515329 uid=0 auid=4294967295 ses=4294967295 msg='op=login acct="root" exe="/usr/sbin/sshd" hostname=? addr=61.177.173.47 terminal=sshd res=failed' Oct 14 15:59:11 sshd[1515329]: Received disconnect from 61.177.173.47 port 53823:11: [preauth] Oct 14 15:59:11 sshd[1515329]: Disconnected from authenticating user root 61.177.173.47 port 53823 [preauth] Oct 14 15:59:11 sshd[1515329]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.177.173.47 user=root Oct 14 15:59:12 sshd[1515419]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.177.173.47 user=root ``` Seems like a permission issue, but I'm not sure how to get around it, does anyone have any ideas? I'm using Ubuntu 20.04. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 14, 2022, 6:56pm UTC](https://discuss.elastic.co/t/error-starting-elastic-search/316659/2 "2022-10-14T18:56:37Z")
Hi @ArrakisMiner Welcome to the community > [@ArrakisMiner](#): > > systemctl start elasticsearch That should be `sudo systemctl start elasticsearch` ---
**Author:** ![ArrakisMiner](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@ArrakisMiner](https://discuss.elastic.co/u/ArrakisMiner)\ **Post date:** [October 14, 2022, 7:14pm UTC](https://discuss.elastic.co/t/error-starting-elastic-search/316659/3 "2022-10-14T19:14:41Z")
I tried that too, it makes little difference and I still get thrown the same error. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 14, 2022, 7:38pm UTC](https://discuss.elastic.co/t/error-starting-elastic-search/316659/4 "2022-10-14T19:38:55Z")
Then we're back to exactly....How did you install elasticsearch and Kibana? What version? What documentation did you follow? What method of install? Were there any errors during install? Did you install a package and make sure you use `sudo` when you installed the package? Oh, I noticed you didn't really run the log command correctly so we're not really seeing the log from elasticsearch `sudo journalctl --unit elasticsearch` ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [October 14, 2022, 7:44pm UTC](https://discuss.elastic.co/t/error-starting-elastic-search/316659/5 "2022-10-14T19:44:57Z")
If there is nothing in `journalctl` you will need to check the system log file. Since you are in ubuntu check `/var/log/syslog` for any hint of why your elasticsearch didn't start or even better, tail this file and in another terminal run `sudo systemctl start elasticsearch` again. You will get a fresh error of why the service could not start. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 11, 2022, 7:45pm UTC](https://discuss.elastic.co/t/error-starting-elastic-search/316659/6 "2022-11-11T19:45:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.