# Upgrade to Elasticsearch 6.1 on CentOS 7 fails: cannot create elasticsearch.keystore.tmp
**URL:** https://discuss.elastic.co/t/upgrade-to-elasticsearch-6-1-on-centos-7-fails-cannot-create-elasticsearch-keystore-tmp/117258
**Category:** Elasticsearch
**Created:** [January 26, 2018, 7:28pm UTC](https://discuss.elastic.co/t/upgrade-to-elasticsearch-6-1-on-centos-7-fails-cannot-create-elasticsearch-keystore-tmp/117258 "2018-01-26T19:28:33Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@trimegistus](https://discuss.elastic.co/u/trimegistus)
#### Post date: [January 26, 2018, 7:28pm UTC](https://discuss.elastic.co/t/upgrade-to-elasticsearch-6-1-on-centos-7-fails-cannot-create-elasticsearch-keystore-tmp/117258/1 "2018-01-26T19:28:34Z")
I installed the s3 snapshot plugin on my ES 5.6 cluster. Those nodes are CentOS 7.4. I installed ES using yum. I needed to upgrade to v6, so I wanted to make a backup.
I installed the **repository-s3**. I read the documentation for it (inadvertently, I read v6's docs).
I installed the keystore ( **elasticsearch-keystore create** ) and added the s3.client.default.access\_key and s3.client.default.secret\_key values to it.
I know now that on 5.x, those values should have been on the .yml config, but I made that mistake by not paying attention to the docs version.
Anyway. I left that there, didn't make the backup and tried to do a rolling upgrade to 6.x.
When I restarted the node, it failed to start giving out an error reading like: "could not create /etc/elasticsearch/elasticsearch.keystore.tmp. Check permissions". I do not have the exact text for the error, but that was the gist of it.
I had to rollback to a snapshot of that VM, to get everything to the safe side and forgot to copy the error message. I panicked. Sorry.
Is there a way I can delete the keystore from that install (after removing repository-s3, of course), so I can retry the upgrade to 6?
---
### Author:  [@rjernst](https://discuss.elastic.co/u/rjernst)
#### Post date: [February 2, 2018, 7:59pm UTC](https://discuss.elastic.co/t/upgrade-to-elasticsearch-6-1-on-centos-7-fails-cannot-create-elasticsearch-keystore-tmp/117258/2 "2018-02-02T19:59:44Z")
You can just delete the keystore file at /etc/elasticsearch/elasticsearch.keystore and recreate once upgraded. I will see if I can reproduce this upgrade issue.
---
### Author:  [@trimegistus](https://discuss.elastic.co/u/trimegistus)
#### Post date: [February 2, 2018, 11:14pm UTC](https://discuss.elastic.co/t/upgrade-to-elasticsearch-6-1-on-centos-7-fails-cannot-create-elasticsearch-keystore-tmp/117258/3 "2018-02-02T23:14:20Z")
I didn't exactly delete it, but I renamed it to **/etc/elasticsearch/elasticsearch.keystore.BAK** , after deleting the 2 key/value pairs in it, and restarted the server, to no avail. It still gave the same error. That is my recollection anyway, as I haven't tried the upgrade again.
---
### Author:  [@rjernst](https://discuss.elastic.co/u/rjernst)
#### Post date: [February 5, 2018, 6:33pm UTC](https://discuss.elastic.co/t/upgrade-to-elasticsearch-6-1-on-centos-7-fails-cannot-create-elasticsearch-keystore-tmp/117258/4 "2018-02-05T18:33:00Z")
Can you do an `ls -l` on `/etc/elasticsearch`? You are running the keystore tool as the `elasticsearch` user right?
---
### Author:  [@trimegistus](https://discuss.elastic.co/u/trimegistus)
#### Post date: [February 6, 2018, 3:27am UTC](https://discuss.elastic.co/t/upgrade-to-elasticsearch-6-1-on-centos-7-fails-cannot-create-elasticsearch-keystore-tmp/117258/5 "2018-02-06T03:27:55Z")
> # ls -lah /etc/elasticsearch/
>
> total 44K
> drwxr-s---. 4 root elasticsearch 4.0K Dec 28 06:58 .
> drwxr-xr-x. 86 root root 8.0K Jan 14 06:00 ..
> -rw-rw----. 1 root elasticsearch 763 Dec 28 04:41 elasticsearch.keystore
> -rw-rw----. 1 root elasticsearch 3.3K Feb 20 2017 elasticsearch.yml
> -rwxr-x---. 1 root elasticsearch 3.3K Sep 29 2016
> elasticsearch.yml.OLD\_V\_2\_4
> -rw-rw----. 1 root elasticsearch 2.8K Jan 24 2017
> elasticsearch.yml.rpmnew
> -rw-rw----. 1 root elasticsearch 3.0K Dec 4 07:51 jvm.options
> -rw-rw----. 1 root elasticsearch 4.4K Dec 4 07:51 log4j2.properties
> drwxr-x---. 2 root elasticsearch 30 Dec 28 04:34 repository-s3
> drwxr-x---. 2 root elasticsearch 6 Dec 4 07:51 scripts
I did not run the elasticsearch-keystore tool as the elasticsearch user.
Anyway, I don't see how that could be relevant, if what I want is to be
able to delete elasticsearch.keystore.
---
### Author:  [@trimegistus](https://discuss.elastic.co/u/trimegistus)
#### Post date: [February 17, 2018, 3:31am UTC](https://discuss.elastic.co/t/upgrade-to-elasticsearch-6-1-on-centos-7-fails-cannot-create-elasticsearch-keystore-tmp/117258/6 "2018-02-17T03:31:28Z")
@rjernst: So... Do you have any suggestions after the `ls -l` on `/etc/elasticsearh`?
---
### Author:  [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)
#### Post date: [February 19, 2018, 7:36am UTC](https://discuss.elastic.co/t/upgrade-to-elasticsearch-6-1-on-centos-7-fails-cannot-create-elasticsearch-keystore-tmp/117258/7 "2018-02-19T07:36:04Z")
> [@trimegistus](#):
>
> could not create /etc/elasticsearch/elasticsearch.keystore.tmp. Check permissions".
HI,
Check below links:
>
>
> When creating the keystore explicitly (from executing elasticsearch-keystore cre…ate) or implicitly (for plugins that require the keystore to be created on install) on an Elasticsearch package installation, we are running as the root user. This leaves /etc/elasticsearch/elasticsearch.keystore having the wrong ownership (root:root) so that the elasticsearch user can not read the keystore on startup. This commit adds setgid to /etc/elasticsearch on package installation so that when executing this directory (as we would when creating the keystore), we will end up with the correct ownership (root:elasticsearch). Additionally, we set the permissions on the keystore to be 660 so that the elasticsearch user via its group can read this file on startup.
>
> Closes #26410
>
>
> I just did an initial test install with this role. I configured three nodes and …ran the play. When I tried checking the health of the cluster, it became apparent that elasticsearch was not started.
>
> So I tried starting it manually, and I got this:
>
> \`\`\`
> root@node1:~# /usr/share/elasticsearch/bin/elasticsearch
> Failed to configure logging...
> ElasticsearchException\[Failed to load logging configuration\]; nested: NoSuchFileException\[/usr/share/elasticsearch/config\];
> at org.elasticsearch.common.logging.log4j.LogConfigurator.resolveConfig(LogConfigurator.java:158)
> at org.elasticsearch.common.logging.log4j.LogConfigurator.configure(LogConfigurator.java:103)
> at org.elasticsearch.bootstrap.Bootstrap.setupLogging(Bootstrap.java:204)
> at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:258)
> at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:35)
> Caused by: java.nio.file.NoSuchFileException: /usr/share/elasticsearch/config
> at sun.nio.fs.UnixException.translateToIOException(UnixException.java:86)
> at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)
> at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)
> at sun.nio.fs.UnixFileAttributeViews$Basic.readAttributes(UnixFileAttributeViews.java:55)
> at sun.nio.fs.UnixFileSystemProvider.readAttributes(UnixFileSystemProvider.java:144)
> at sun.nio.fs.LinuxFileSystemProvider.readAttributes(LinuxFileSystemProvider.java:97)
> at java.nio.file.Files.readAttributes(Files.java:1686)
> at java.nio.file.FileTreeWalker.walk(FileTreeWalker.java:109)
> at java.nio.file.FileTreeWalker.walk(FileTreeWalker.java:69)
> at java.nio.file.Files.walkFileTree(Files.java:2602)
> at org.elasticsearch.common.logging.log4j.LogConfigurator.resolveConfig(LogConfigurator.java:142)
> ... 4 more
> log4j:WARN No appenders could be found for logger (bootstrap).
> log4j:WARN Please initialize the log4j system properly.
> log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.
> Exception in thread "main" java.lang.RuntimeException: don't run elasticsearch as root.
> at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:93)
> at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:144)
> at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:285)
> at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:35)
> Refer to the log for complete error details.
> root@node1:~# ls /etc/elasticsearch/
> elasticsearch.yml node1 logging.yml scripts
> \`\`\`
>
> Here are the ansible vars, just replace node1 with node2 or node3 to get the other nodes config:
>
> \`\`\`
> es\_version: 2.1.1
> es\_log\_dir: "/opt/elasticsearch/logs"
> es\_work\_dir: "/opt/elasticsearch/temp"
> es\_heap\_size: "3072m"
> es\_config:
> cluster.name: "asdfqwerty"
> discovery.zen.ping.unicast.hosts: "http://node1:9301"
> http.port: 9200
> transport.tcp.port: 9301
> bootstrap.mlockall: True
> discovery.zen.ping.multicast.enabled: False
> path.repo: "/path/to/repo/path"
> discovery.zen.minimum\_master\_nodes: 2
> action.destructive\_requires\_name: True
>
> es\_instance\_name: "node1"
>
> es\_config:
> node.name: "node1"
> node.data: True
> node.master: True
>
> es\_data\_dir: "/mounts/node1"
> \`\`\`
>
> Did I miss some required var?
>
> I did try \`/etc/init.d/node1\_elasticsearch start\` and it did not work, nor did it output any errors. Just \`Starting ... \[OK\]\`. \`/var/logs/elasticsearch\` is empty so I can't figure anything out from there.
>
> So, what obvious step am I missing?
>
> Should this kind of question be posted on discuss.elastic.co somewhere instead of here? If so, what forum?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 19, 2018, 7:36am UTC](https://discuss.elastic.co/t/upgrade-to-elasticsearch-6-1-on-centos-7-fails-cannot-create-elasticsearch-keystore-tmp/117258/8 "2018-03-19T07:36:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.