elk报错记录

报错信息一：can not run elasticsearch as root

[root@localhost bin]# ./elasticsearch [2018-06-22T18:06:16,313][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main] org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:125) ~[elasticsearch-6.2.4.jar:6.2.4] at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:112) ~[elasticsearch-6.2.4.jar:6.2.4] at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-6.2.4.jar:6.2.4] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-6.2.4.jar:6.2.4] at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-6.2.4.jar:6.2.4] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-6.2.4.jar:6.2.4] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:85) ~[elasticsearch-6.2.4.jar:6.2.4] Caused by: java.lang.RuntimeException: can not run elasticsearch as root at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:105) ~[elasticsearch-6.2.4.jar:6.2.4] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:172) ~[elasticsearch-6.2.4.jar:6.2.4] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:323) ~[elasticsearch-6.2.4.jar:6.2.4] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) ~[elasticsearch-6.2.4.jar:6.2.4] ... 6 more

解决办法：

主要看报错第二行：can not run elasticsearch as root ：意思是不能用root用户运行elasticesearch

新建用户elasearch 专用于操作elk
groupadd elasearch
useradd elasearch -g elasearch
chown -R elasearch:elasearch /usr/local/elasticsearch-6.2.4/

切换到elasticsearch用户启动es。

报错问题二： increase to at least [65536]

ERROR: [3] bootstrap checks failed [1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

上边的描述: [2018-07-05T19:24:50,764][WARN ][o.e.b.JNANatives ] Unable to lock JVM Memory: error=12, reason=Cannot allocate memory [2018-07-05T19:24:50,766][WARN ][o.e.b.JNANatives ] This can result in part of the JVM being swapped out. [2018-07-05T19:24:50,766][WARN ][o.e.b.JNANatives ] Increase RLIMIT_MEMLOCK, soft limit: 65536, hard limit: 65536 [2018-07-05T19:24:50,766][WARN ][o.e.b.JNANatives ] These can be adjusted by modifying /etc/security/limits.conf, for example: allow user 'elasticsearch' mlockall elasticsearch soft memlock unlimited elasticsearch hard memlock unlimited

解决办法：

echo '* soft nofile 65536' >> /etc/security/limits.conf
echo '* hard nofile 65536' >> /etc/security/limits.conf

报错信息三：memory is not locked

[2]: memory locking requested for elasticsearch process but memory is not locked

解决办法：报错的信息也有显示这个解决办法

elasticsearch soft memlock unlimited
elasticsearch hard memlock unlimited

报错信息四：AccessDeniedException

Likely root cause: java.nio.file.AccessDeniedException: /usr/local/elasticsearch-6.2.4/config/elasticsearch.keystore

原因：当前用户没有接入权限

解决办法：

chown -R elasearch:elasearch /usr/local/elasticsearch-6.2.4/

报错信息五： vm.max_map_count [65530] is too low

[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

解决办法：

echo 'vm.max_map_count=262144' >> /etc/sysctl.conf
sysctl -p

报错信息六：

[ERROR][i.n.u.ResourceLeakDetector] LEAK: ByteBuf.release() was not called before it's garbage-collected. Enable advanced leak reporting to find out where the leak occurred. To enable advanced leak reporting, specify the JVM option '-Dio.netty.leakDetection.level=advanced' or call ResourceLeakDetector.setLevel() See http://netty.io/wiki/reference-counted-objects.html for more information.

解决办法：

修改jvm配置，添加以下配置：

-Dio.netty.leakDetection.level=advanced