What's the cause and the solution of this error

[morad_della3]

ubuntu 22.04 VM
elasticsearch,kibana,filebeat8.4.1 ,elastalert,suricata
i have this error in the log of elasticsearch when i try to start elasticsearch it failed to start

Failed to get the temporary directory; falling back to: /tmp
[2022-09-23T20:38:58,847][ERROR][o.e.b.Elasticsearch      ] [elastic] fatal exception while booting Elasticsearch
java.security.AccessControlException: access denied ("java.io.FilePermission" "/tmp" "read")

[stephenb (Stephen Brown)]

According to the error the user you are running elasticsearch as can not read (and probably write) to the /tmp directly.

Elasticsearch like mini programs need to be able to read and write from the /tmp directory.

You need to fix the permissions on that directory

[morad_della3]

You need to fix the permissions on that directory
How can I?

[stephenb (Stephen Brown)]

Google is your friend

$ sudo chmod 1777 /tmp

[morad_della3]

Oh yea i google it now and i find it thanks @stephenb for help

[morad_della3]

@stephenb hello stephen the error The error was repeated today and when i try to do this cmd

@stephenb

sudo chmod 1777 /tmp

it still the same not solved

[Akhtar_Zaman]

May be you need to check what user is being used for Elasticsearch. Try find the user from the Elasticsearch service unit file. and then run the command provided by stephenb from that user. you can simply do
sudo -u {USER} chmod 1777 /tmp

[morad_della3]

@Akhtar_Zaman thanks for the response
how to check the user used by elastic what cmd?
I think you mean the user that i used to access elastic from kibana is "elastic"
i try to do what you told but this is the result

elastic@elastic:~$ sudo -u elastic chmod 1777 /tmp
chmod: changing permissions of '/tmp': Operation not permitted

[wangphun (Hoang Nguyen)]

Hi @morad_della3, did you fixed your problem? i face the same issue.

[morad_della3]

No but i used a solution last month it worked with me but now when I used it it did not work see if it work for you
the solution is to decrease the the amount of the ram here , you will find 4g change it to 1g or 512m
to enter to this file of configyou can use : sudo nano /etc/elasticsearch/jvm.options
then save the config and restart elasticsearch