ELK-5.4.1搭建日志管理系统(二)ES安装时遇到的一些问题

安装配置Elasticsearch5.4.1的时候遇到的一些问题,通过查找资料解决。整理记录一下,便于以后遇到同样的问题能够快速解决。

Elasticsearch安装好后,默认只允许通过127.0.0.1访问,如果我们希望在另外一台机器上访问Elasticsearch的话,需要修改主机配置:

#network.host: 192.168.0.1 
networ.host: 192.168.5.82 <--修改为本机iP,或者0.0.0.0

保存退出后,重新启动Elasticsearch的话会报错,无法启动。报错如下:

[WARN ][o.e.b.JNANatives         ] unable to install syscall filter: 
java.lang.UnsupportedOperationException: seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in
ERROR: [4] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
[2]: max number of threads [1024] for user [elsearch] is too low, increase to at least [2048]
[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[4]: system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk  

WARN:只是一个警告,使用新版本的linux就没事了。

错误一:max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

修改/etc/security/limits.conf配置文件,添加如下内容:

# vim /etc/security/limits.conf 
* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096

错误二:max number of threads [1024] for user [elsearch] is too low, increase to at least [2048]

修改/etc/security/limits.d/90-nproc.conf配置文件,修改内容如下: 

# vim /etc/security/limits.d/90-nproc.conf
* soft nproc 1024
#修改为
* soft nproc 2048

错误三:max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

修改配置文件/etc/sysctl.conf,修改内容如下:

# vim /etc/sysctl.conf
添加下面配置:
vm.max_map_count = 655360

错误四:system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk原因:

这是在因为操作系统不支持SecComp,而ES5.4.1默认bootstrap.system_call_filter为true进行检测,所以导致检测失败,失败后直接导致ES不能启动。
解决:
在elasticsearch.yml中配置bootstrap.system_call_filter为false,注意要在Memory下面:

bootstrap.memory_lock: false
bootstrap.system_call_filter: false

修改好后重启ES,能够正常启动。

原文地址:https://www.cnblogs.com/ebay/p/6955639.html