New installation - unable to start Elastic search on our harden RHEL8 image

Fresh install in our newly created RHEL8 vm. When we download and try to start Elasticsearch for the first time, we encounter an error.

systemctl status

● elasticsearch.service - Elasticsearch
   Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Wed 2022-01-26 16:49:21 +08; 35min ago
     Docs: https://www.elastic.co
  Process: 24064 ExecStart=/usr/share/elasticsearch/bin/systemd-entrypoint -p ${PID_DIR}/elasticsearch.pid --quiet (code=exited, status=1/FAILURE)
 Main PID: 24064 (code=exited, status=1/FAILURE)
    Tasks: 0 (limit: 49463)
   Memory: 76.9M
   CGroup: /system.slice/elasticsearch.service

Jan 26 16:49:21 ELKPOC systemd-entrypoint[24064]:         at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:157)
Jan 26 16:49:21 ELKPOC systemd-entrypoint[24064]:         at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:77)
Jan 26 16:49:21 ELKPOC systemd-entrypoint[24064]:         at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:112)
Jan 26 16:49:21 ELKPOC systemd-entrypoint[24064]:         at org.elasticsearch.cli.Command.main(Command.java:77)
Jan 26 16:49:21 ELKPOC systemd-entrypoint[24064]:         at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:122)
Jan 26 16:49:21 ELKPOC systemd-entrypoint[24064]:         at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:80)
Jan 26 16:49:21 ELKPOC systemd-entrypoint[24064]: ERROR: Elasticsearch did not exit normally - check the logs at /var/log/elasticsearch/elasticsearch.log
Jan 26 16:49:21 ELKPOC systemd[1]: elasticsearch.service: Main process exited, code=exited, status=1/FAILURE
Jan 26 16:49:21 ELKPOC systemd[1]: elasticsearch.service: Failed with result 'exit-code'.
Jan 26 16:49:21 ELKPOC systemd[1]: Failed to start Elasticsearch.
[root@ELKPOC elasticsearch]#

Elasticsearch.log

[2022-01-26T16:49:10,014][INFO ][o.e.e.NodeEnvironment    ] [ELKPOC] using [1] data paths, mounts [[/var (/dev/mapper/rhel-var)]], net usable_space [1.3gb], net total_space [1.9gb], types [xfs]
[2022-01-26T16:49:10,015][INFO ][o.e.e.NodeEnvironment    ] [ELKPOC] heap size [3.7gb], compressed ordinary object pointers [true]
[2022-01-26T16:49:10,093][INFO ][o.e.n.Node               ] [ELKPOC] node name [ELKPOC], node ID [KRcgwYrBRMCHt8-7sSIdIQ], cluster name [elasticsearch], roles [transform, data_frozen, master, remote_cluster_client, data, ml, data_content, data_hot, data_warm, data_cold, ingest]
[2022-01-26T16:49:16,232][INFO ][o.e.x.m.p.l.CppLogMessageHandler] [ELKPOC] [controller/24280] [Main.cc@122] controller (64 bit): Version 7.16.3 (Build b71e71b93f3e4d) Copyright (c) 2021 Elasticsearch BV
[2022-01-26T16:49:16,937][INFO ][o.e.x.s.a.s.FileRolesStore] [ELKPOC] parsed [0] roles from file [/etc/elasticsearch/roles.yml]
[2022-01-26T16:49:18,151][INFO ][o.e.i.g.ConfigDatabases  ] [ELKPOC] initialized default databases [[GeoLite2-Country.mmdb, GeoLite2-City.mmdb, GeoLite2-ASN.mmdb]], config databases [[]] and watching [/etc/elasticsearch/ingest-geoip] for changes
[2022-01-26T16:49:18,153][INFO ][o.e.i.g.DatabaseNodeService] [ELKPOC] initialized database registry, using geoip-databases directory [/tmp/elasticsearch-5776624951691438798/geoip-databases/KRcgwYrBRMCHt8-7sSIdIQ]
[2022-01-26T16:49:19,008][INFO ][o.e.t.NettyAllocator     ] [ELKPOC] creating NettyAllocator with the following configs: [name=elasticsearch_configured, chunk_size=1mb, suggested_max_allocation_size=1mb, factors={es.unsafe.use_netty_default_chunk_and_page_size=false, g1gc_enabled=true, g1gc_region_size=4mb}]
[2022-01-26T16:49:19,117][INFO ][o.e.d.DiscoveryModule    ] [ELKPOC] using discovery type [zen] and seed hosts providers [settings]
[2022-01-26T16:49:19,712][INFO ][o.e.g.DanglingIndicesState] [ELKPOC] gateway.auto_import_dangling_indices is disabled, dangling indices will not be automatically detected or imported and must be managed manually
[2022-01-26T16:49:20,408][INFO ][o.e.n.Node               ] [ELKPOC] initialized
[2022-01-26T16:49:20,408][INFO ][o.e.n.Node               ] [ELKPOC] starting ...
[2022-01-26T16:49:20,419][INFO ][o.e.x.s.c.f.PersistentCache] [ELKPOC] persistent cache index loaded
[2022-01-26T16:49:20,420][INFO ][o.e.x.d.l.DeprecationIndexingComponent] [ELKPOC] deprecation component started
[2022-01-26T16:49:20,549][INFO ][o.e.t.TransportService   ] [ELKPOC] publish_address {127.0.0.1:9300}, bound_addresses {[::1]:9300}, {127.0.0.1:9300}
[2022-01-26T16:49:20,702][WARN ][o.e.b.BootstrapChecks    ] [ELKPOC] system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
[2022-01-26T16:49:20,702][WARN ][o.e.b.BootstrapChecks    ] [ELKPOC] the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured
[2022-01-26T16:49:20,703][INFO ][o.e.c.c.Coordinator      ] [ELKPOC] cluster UUID [WRx3F12QR1uLWGM7ImdjcQ]
[2022-01-26T16:49:20,715][INFO ][o.e.c.c.ClusterBootstrapService] [ELKPOC] no discovery configuration found, will perform best-effort cluster bootstrapping after [3s] unless existing master is discovered
[2022-01-26T16:49:20,877][INFO ][o.e.c.s.MasterService    ] [ELKPOC] elected-as-master ([1] nodes joined)[{ELKPOC}{KRcgwYrBRMCHt8-7sSIdIQ}{_5shhGTxSCyAdRhPUwjLDg}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw} elect leader, _BECOME_MASTER_TASK_, _FINISH_ELECTION_], term: 2, version: 3, delta: master node changed {previous [], current [{ELKPOC}{KRcgwYrBRMCHt8-7sSIdIQ}{_5shhGTxSCyAdRhPUwjLDg}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}]}
[2022-01-26T16:49:20,981][INFO ][o.e.c.s.ClusterApplierService] [ELKPOC] master node changed {previous [], current [{ELKPOC}{KRcgwYrBRMCHt8-7sSIdIQ}{_5shhGTxSCyAdRhPUwjLDg}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}]}, term: 2, version: 3, reason: Publication{term=2, version=3}
[2022-01-26T16:49:21,059][INFO ][o.e.h.AbstractHttpServerTransport] [ELKPOC] publish_address {127.0.0.1:9200}, bound_addresses {[::1]:9200}, {127.0.0.1:9200}
[2022-01-26T16:49:21,060][INFO ][o.e.n.Node               ] [ELKPOC] started
[2022-01-26T16:49:21,063][ERROR][o.e.b.ElasticsearchUncaughtExceptionHandler] [ELKPOC] fatal error in thread [main], exiting
java.lang.NoClassDefFoundError: Could not initialize class com.sun.jna.Native
        at org.elasticsearch.systemd.Libsystemd.lambda$static$0(Libsystemd.java:23) ~[?:?]
        at java.security.AccessController.doPrivileged(AccessController.java:318) ~[?:?]
        at org.elasticsearch.systemd.Libsystemd.<clinit>(Libsystemd.java:22) ~[?:?]
        at org.elasticsearch.systemd.SystemdPlugin.sd_notify(SystemdPlugin.java:113) ~[?:?]
        at org.elasticsearch.systemd.SystemdPlugin.onNodeStarted(SystemdPlugin.java:124) ~[?:?]
        at java.util.ArrayList.forEach(ArrayList.java:1511) ~[?:?]
        at org.elasticsearch.node.Node.start(Node.java:1278) ~[elasticsearch-7.16.3.jar:7.16.3]
        at org.elasticsearch.bootstrap.Bootstrap.start(Bootstrap.java:335) ~[elasticsearch-7.16.3.jar:7.16.3]
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:443) ~[elasticsearch-7.16.3.jar:7.16.3]
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:166) ~[elasticsearch-7.16.3.jar:7.16.3]
        at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:157) ~[elasticsearch-7.16.3.jar:7.16.3]
        at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:77) ~[elasticsearch-7.16.3.jar:7.16.3]
        at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:112) ~[elasticsearch-cli-7.16.3.jar:7.16.3]
        at org.elasticsearch.cli.Command.main(Command.java:77) ~[elasticsearch-cli-7.16.3.jar:7.16.3]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:122) ~[elasticsearch-7.16.3.jar:7.16.3]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:80) ~[elasticsearch-7.16.3.jar:7.16.3]
[root@ELKPOC elasticsearch]#

Appreciate any feedback, thank you.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.