Elasticsearch 7.1未运行及7.2生产模式启动失败问题求助

Hey Sarah, let's work through those two bootstrap errors stopping your Elasticsearch 7.2 node from launching in production mode. I'll break down each issue and walk you through the fixes, including why your initial limits.conf change might not have taken effect.

错误1：进程最大文件描述符过低 #

Your log clearly points out:

You tried updating /etc/security/limits.conf but it didn't work—here's how to make sure the setting sticks:

1. Correctly update limits.conf
   Make sure you add both soft and hard limits for the elasticsearch user (replace with your actual ES service user if different):

   elasticsearch soft nofile 65535
   elasticsearch hard nofile 65535
   elasticsearch soft nproc 4096
   elasticsearch hard nproc 4096
   

   The nproc lines add extra protection against related process limit issues.

2. Check for overriding configs
   Many systems use files in /etc/security/limits.d/ that can override limits.conf. Look for files like 90-nproc.conf and either update them to include the same nofile limits for the elasticsearch user, or comment out conflicting lines.

3. Verify PAM configuration
   Ensure your PAM session configs load the limits module. Check /etc/pam.d/common-session and /etc/pam.d/common-session-noninteractive for this line (add it if missing):

   session required pam_limits.so
   

4. Validate the setting
   Log out and back in as the elasticsearch user, then run:

   ulimit -n
   

   This should return 65535 if the setting is applied correctly. If not, a full system restart might be needed to fully apply the changes.

5. System-wide file descriptor limit (recommended)
   Update the system-wide maximum file descriptors in /etc/sysctl.conf:

   fs.file-max = 655350
   

   Apply the change immediately with:

   sysctl -p
   

错误2：最大虚拟内存区域过低 #

Your log shows:

Fix this with these quick steps:

1. Temporary fix (immediate effect)
   Run this as root to apply the change without restarting:

   sysctl -w vm.max_map_count=262144
   

2. Permanent fix (survives reboot)
   Add this line to /etc/sysctl.conf:

   vm.max_map_count=262144
   

   Apply the change with:

   sysctl -p
   

Final Steps #

After applying both fixes, start your Elasticsearch service again. It should pass all bootstrap checks and launch successfully in production mode. If you still hit issues, double-check that all config changes were saved correctly and that you're running Elasticsearch as the user you applied the limits to.

内容的提问来源于stack exchange，提问作者sarah w