# java.lang.UnsupportedOperationException on starting elasticsearch

**URL:** https://discuss.elastic.co/t/java-lang-unsupportedoperationexception-on-starting-elasticsearch/64548
**Category:** Elasticsearch
**Created:** [November 1, 2016, 11:45am UTC](https://discuss.elastic.co/t/java-lang-unsupportedoperationexception-on-starting-elasticsearch/64548 "2016-11-01T11:45:40Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [November 1, 2016, 11:45am UTC](https://discuss.elastic.co/t/java-lang-unsupportedoperationexception-on-starting-elasticsearch/64548/1 "2016-11-01T11:45:40Z")

</div>

On my Linux, when I try to start elasticsearch, I am getting the following warning;

```
[2016-11-01T17:09:28,391][WARN][o.e.b.JNANatives] unable to install syscall filter:
java.lang.UnsupportedOperationException: seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in
        at org.elasticsearch.bootstrap.Seccomp.linuxImpl(Seccomp.java:349) ~[elasticsearch-5.0.0.jar:5.0.0]
        at org.elasticsearch.bootstrap.Seccomp.init(Seccomp.java:630) ~[elasticsearch-5.0.0.jar:5.0.0]
        at org.elasticsearch.bootstrap.JNANatives.trySeccomp(JNANatives.java:215) [elasticsearch-5.0.0.jar:5.0.0]
        at org.elasticsearch.bootstrap.Natives.trySeccomp(Natives.java:99) [elasticsearch-5.0.0.jar:5.0.0]
        at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:101) [elasticsearch-5.0.0.jar:5.0.0]
        at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:155) [elasticsearch-5.0.0.jar:5.0.0]
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:286) [elasticsearch-5.0.0.jar:5.0.0]
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:112) [elasticsearch-5.0.0.jar:5.0.0]
        at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:103) [elasticsearch-5.0.0.jar:5.0.0]
        at org.elasticsearch.cli.SettingCommand.execute(SettingCommand.java:54) [elasticsearch-5.0.0.jar:5.0.0]
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:96) [elasticsearch-5.0.0.jar:5.0.0]
        at org.elasticsearch.cli.Command.main(Command.java:62) [elasticsearch-5.0.0.jar:5.0.0]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:80) [elasticsearch-5.0.0.jar:5.0.0]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:73) [elasticsearch-5.0.0.jar:5.0.0]

```

What might be the possible reason and how can I fix this?

System information:  
Elasticsearch: Version: 5.0.0, Build: 253032b/2016-10-26T04:37:51.531Z, JVM: 1.8.0\_102  
OS: CentOS release 6.6 (Final)

---

<div class="post-metadata">

### Author: ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)
#### Post date: [November 1, 2016, 12:19pm UTC](https://discuss.elastic.co/t/java-lang-unsupportedoperationexception-on-starting-elasticsearch/64548/2 "2016-11-01T12:19:18Z")

</div>

This is just a warning, ES should start fine, just with a warning about seccomp not being available.

Elasticsearch security module tries to revoke Linux process privileges to reduce so called "attack vector" for malevolent activities, but your Linux kernel is either too old or not able to offer that process privilege revoke API.  
Here's the related issue: [https://github.com/elastic/elasticsearch/pull/13753](https://github.com/elastic/elasticsearch/pull/13753)

I think you can set `bootstrap.seccomp=false` in the yml file to disable this.

---

<div class="post-metadata">

### Author: ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)
#### Post date: [November 1, 2016, 2:38pm UTC](https://discuss.elastic.co/t/java-lang-unsupportedoperationexception-on-starting-elasticsearch/64548/3 "2016-11-01T14:38:44Z")

</div>

Are we really logging the stack trace at WARN level if this is just a warning? It feels like we should log a one line warning message like "Unable to install syscall filter to prevent forks. This is not ideal but OK because we already prevent forks using the JVM's sandbox. This requires a kernel compiled with CONFIG\_SECCOMP and CONFIG\_SECCOMP\_FILTER which is available in most modern Linux distributions."

The bit about 3.5+ isn't entirely true. That is the version of the kernel where this was committed but distros backport so much stuff you can never be sure.

---

<div class="post-metadata">

### Author: ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)
#### Post date: [November 1, 2016, 2:44pm UTC](https://discuss.elastic.co/t/java-lang-unsupportedoperationexception-on-starting-elasticsearch/64548/4 "2016-11-01T14:44:22Z")

</div>

@nik agreed, the logging happens in JNANatives#trySeccomp. A warning without the full stack trace would probably be less scary.

---

<div class="post-metadata">

### Author: ![Reynold\_PJ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reynold_pj/32/15875_2.png) [@Reynold\_PJ](https://discuss.elastic.co/u/Reynold_PJ)
#### Post date: [February 27, 2017, 12:10pm UTC](https://discuss.elastic.co/t/java-lang-unsupportedoperationexception-on-starting-elasticsearch/64548/5 "2017-02-27T12:10:24Z")

</div>

Thanks it helped.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 10:02pm UTC](https://discuss.elastic.co/t/java-lang-unsupportedoperationexception-on-starting-elasticsearch/64548/6 "2017-07-05T22:02:51Z")

</div>


