elk中elasticsearch安装启动报错
elasticsearch安装之后。启动报错。elasticsearch版本为5.4.1
下载安装：
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.4.1.tar.gz
tar zxf elasticsearch-5.4.1.tar.gz
mv elasticsearch-5.4.1 /usr/local/elasticsearch
cd /usr/local/elasticsearch/
./bin/elasticsearch uncaught exception in thread
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:127) ~
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:114) ~
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:67) ~
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:122) ~
at org.elasticsearch.cli.Command.main(Command.java:88) ~
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:91) ~
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:84) ~
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:106) ~
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:194) ~
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:350) ~
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:123) ~
... 6 more
https://s5.运维网.com/wyfs02/M02/99/7F/wKioL1lI5kHxE9rDAAELFa1jFDs442.png
原因：elasticsearch自5版本之后，处于安全考虑，不允许使用root用户运行。
解决：创建一个普通用户，将elasticsearch 安装目录权限修改一下，切换至普通用户运行elasticsearch就可以了
useraddelk
chown -R elk.elk /usr/local/elasticsearch/
su -elk
cd /usr/local/elasticsearch/
$ ./bin/elasticsearch
initializing ...
using data paths, mounts [[/ (rootfs)]], net usable_space [12
.7gb], net total_space , spins? , types heap size , compressed ordinary object pointers
node name , node ID
version, pid, build[2cfe0df/2017-05-29T16:05:51.443Z
], OS, JVM JVM arguments [-Xms2g, -Xmx2g, -XX:+UseConcMarkSweepGC, -XX:CMSIn
itiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -XX:+DisableExplicitGC, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -Djdk.io.permissionsUseCanonicalPath=true, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Dlog4j.skipJansi=true, -XX:+HeapDumpOnOutOfMemoryError, -Des.path.home=/usr/local/elasticsearch] loaded module
loaded module
loaded module
loaded module
loaded module
loaded module
loaded module
loaded module
loaded module
loaded module
no plugins loaded
using discovery type
initialized
starting ...
publish_address {192.168.199.17:9300}, bound_addresses {192.168.1
99.17:9300} bound or publishing to a non-loopback or non-link-local address,
enforcing bootstrap checksERROR: bootstrap checks failed
: max file descriptors for elasticsearch process is too low, increase to at least
: max virtual memory areas vm.max_map_count is too low, increase to at least
stopping ...
stopped
closing ...
closed
跟系统优化参数有关。修改sysctl内核参数
sysctl -w vm.max_map_count=262144
# echo "vm.max_map_count=262144" >> /etc/sysctl.conf
# sysctl -p
vm.max_map_count = 262144
# vi /etc/security/limits.conf
* soft nofile65536
* hard nofile65536 重新启动：
$ ./bin/elasticsearch initializing ...
using data paths, mounts [[/ (rootfs)]], net usable_space [12
.7gb], net total_space , spins? , types heap size , compressed ordinary object pointers
node name , node ID
version, pid, build[2cfe0df/2017-05-29T16:05:51.443Z
], OS, JVM JVM arguments [-Xms2g, -Xmx2g, -XX:+UseConcMarkSweepGC, -XX:CMSIn
itiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -XX:+DisableExplicitGC, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -Djdk.io.permissionsUseCanonicalPath=true, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Dlog4j.skipJansi=true, -XX:+HeapDumpOnOutOfMemoryError, -Des.path.home=/usr/local/elasticsearch] loaded module
loaded module
loaded module
loaded module
loaded module
loaded module
loaded module
loaded module
loaded module
loaded module
no plugins loaded
using discovery type
initialized
starting ...
publish_address {192.168.199.17:9300}, bound_addresses {192.168.1
99.17:9300} bound or publishing to a non-loopback or non-link-local address,
enforcing bootstrap checks new_master {node-1}{3XuI5pfIRN6MUEuRkq6ZHw}{8FjudtquQS-SkPWx0B7d5
A}{192.168.199.17}{192.168.199.17:9300}, reason: zen-disco-elected-as-master ( nodes joined) publish_address {192.168.199.17:9200}, bound_addresses {1
92.168.199.17:9200} started
recovered indices into cluster_state
启动成功。按ctrl+C退出。使用-d参数让服务在后台运行
$ ./elasticsearch/bin/elasticsearch -dhttps://s5.运维网.com/wyfs02/M00/99/7F/wKiom1lI5kGiqp4xAABFj6xKCq0383.png
这样就启动成功了。
注意：普通用户不能修改打开文件句柄数，切换到root用户，修改之后需要重启。
页:
[1]