elk報錯記錄

報錯信息一：can not run elasticsearch as root

[root@localhost bin]# ./elasticsearch
[2018-06-22T18:06:16,313][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:125) ~[elasticsearch-6.2.4.jar:6.2.4]
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:112) ~[elasticsearch-6.2.4.jar:6.2.4]
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-6.2.4.jar:6.2.4]
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-6.2.4.jar:6.2.4]
at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-6.2.4.jar:6.2.4]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-6.2.4.jar:6.2.4]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:85) ~[elasticsearch-6.2.4.jar:6.2.4]
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:105) ~[elasticsearch-6.2.4.jar:6.2.4]
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:172) ~[elasticsearch-6.2.4.jar:6.2.4]
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:323) ~[elasticsearch-6.2.4.jar:6.2.4]
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) ~[elasticsearch-6.2.4.jar:6.2.4]
... 6 more

解決辦法：

主要看報錯第二行：can not run elasticsearch as root ：意思是不能用root用戶運行elasticesearch

新建用戶elasearch 專用於操做elk
groupadd elasearch
useradd elasearch -g elasearch
chown -R elasearch:elasearch /usr/local/elasticsearch-6.2.4/

切換到elasticsearch用戶啓動es。

報錯問題二： increase to at least [65536]

ERROR: [3] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

上邊的描述:
[2018-07-05T19:24:50,764][WARN ][o.e.b.JNANatives ] Unable to lock JVM Memory: error=12, reason=Cannot allocate memory
[2018-07-05T19:24:50,766][WARN ][o.e.b.JNANatives ] This can result in part of the JVM being swapped out.
[2018-07-05T19:24:50,766][WARN ][o.e.b.JNANatives ] Increase RLIMIT_MEMLOCK, soft limit: 65536, hard limit: 65536
[2018-07-05T19:24:50,766][WARN ][o.e.b.JNANatives ] These can be adjusted by modifying /etc/security/limits.conf, for example:
allow user 'elasticsearch' mlockall
elasticsearch soft memlock unlimited
elasticsearch hard memlock unlimited

解決辦法：

echo '* soft nofile 65536' >> /etc/security/limits.conf
echo '* hard nofile 65536' >> /etc/security/limits.conf

報錯信息三：memory is not locked

[2]: memory locking requested for elasticsearch process but memory is not locked

解決辦法：報錯的信息也有顯示這個解決辦法

elasticsearch soft memlock unlimited
elasticsearch hard memlock unlimited

報錯信息四：AccessDeniedException

Likely root cause: java.nio.file.AccessDeniedException: /usr/local/elasticsearch-6.2.4/config/elasticsearch.keystore

緣由：當前用戶沒有接入權限

解決辦法：

chown -R elasearch:elasearch /usr/local/elasticsearch-6.2.4/

報錯信息五： vm.max_map_count [65530] is too low

[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

解決辦法：

echo 'vm.max_map_count=262144' >> /etc/sysctl.conf 
sysctl -p

報錯信息六：

[ERROR][i.n.u.ResourceLeakDetector] LEAK: ByteBuf.release() was not called before it's garbage-collected. Enable advanced leak reporting to find out where the leak occurred. To enable advanced leak reporting, specify the JVM option '-Dio.netty.leakDetection.level=advanced' or call ResourceLeakDetector.setLevel() See http://netty.io/wiki/reference-counted-objects.html for more information.

解決辦法：

修改jvm配置，添加如下配置：

-Dio.netty.leakDetection.level=advanced