elk报错记录
报错信息一：can not run elasticsearch as root# ./elasticsearch
[] uncaught exception in thread
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:125) ~
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:112) ~
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~
at org.elasticsearch.cli.Command.main(Command.java:90) ~
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:85) ~
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:105) ~
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:172) ~
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:323) ~
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) ~
... 6 more
解决办法：
主要看报错第二行：can not run elasticsearch as root ：意思是不能用root用户运行elasticesearch
新建用户elasearch 专用于操作elk
groupadd elasearch
useradd elasearch -g elasearch
chown -R elasearch:elasearch /usr/local/elasticsearch-6.2.4/
切换到elasticsearch用户启动es。
报错问题二： increase to at least
ERROR: bootstrap checks failed
: max file descriptors for elasticsearch process is too low, increase to at least
上边的描述:
Unable to lock JVM Memory: error=12, reason=Cannot allocate memory
This can result in part of the JVM being swapped out.
Increase RLIMIT_MEMLOCK, soft limit: 65536, hard limit: 65536
These can be adjusted by modifying /etc/security/limits.conf, for example:
allow user 'elasticsearch' mlockall
elasticsearch soft memlock unlimited
elasticsearch hard memlock unlimited
解决办法：
echo '* soft nofile 65536' >> /etc/security/limits.conf
echo '* hard nofile 65536' >> /etc/security/limits.conf
报错信息三：memory is not locked
: memory locking requested for elasticsearch process but memory is not locked
解决办法：报错的信息也有显示这个解决办法
elasticsearch soft memlock unlimited
elasticsearch hard memlock unlimited
报错信息四：AccessDeniedException
Likely root cause: java.nio.file.AccessDeniedException: /usr/local/elasticsearch-6.2.4/config/elasticsearch.keystore
原因：当前用户没有接入权限
解决办法：
chown -R elasearch:elasearch /usr/local/elasticsearch-6.2.4/
报错信息五： vm.max_map_count is too low
: max virtual memory areas vm.max_map_count is too low, increase to at least
解决办法：
echo 'vm.max_map_count=262144' >> /etc/sysctl.conf
sysctl -p
报错信息六：
LEAK: ByteBuf.release() was not called before it's garbage-collected. Enable advanced leak reporting to find out where the leak occurred. To enable advanced leak reporting, specify the JVM option '-Dio.netty.leakDetection.level=advanced' or call ResourceLeakDetector.setLevel() See http://netty.io/wiki/reference-counted-objects.html for more information.
解决办法：
修改jvm配置，添加以下配置：
-Dio.netty.leakDetection.level=advanced
页:
[1]