本文共 13282 字，大约阅读时间需要 44 分钟。
[2018-03-12T11:56:52,328][WARN ][o.e.b.JNANatives ] unable to install syscall filter:java.lang.UnsupportedOperationException: seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in at org.elasticsearch.bootstrap.SystemCallFilter.linuxImpl(SystemCallFilter.java:328) ~[elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.SystemCallFilter.init(SystemCallFilter.java:616) ~[elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.JNANatives.tryInstallSystemCallFilter(JNANatives.java:258) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Natives.tryInstallSystemCallFilter(Natives.java:113) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:110) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:172) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:323) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:112) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) [elasticsearch-cli-6.2.2.jar:6.2.2] at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-cli-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:85) [elasticsearch-6.2.2.jar:6.2.2]
解决办法：
修改elasticsearch.yaml文件，设置禁用seccomp；bootstrap.system_call_filter: false
[2018-03-12T11:56:52,328][WARN ][o.e.b.JNANatives ] unable to install syscall filter:java.lang.UnsupportedOperationException: seccomp unavailable: requires kernel 3.5+ with CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER compiled in at org.elasticsearch.bootstrap.SystemCallFilter.linuxImpl(SystemCallFilter.java:328) ~[elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.SystemCallFilter.init(SystemCallFilter.java:616) ~[elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.JNANatives.tryInstallSystemCallFilter(JNANatives.java:258) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Natives.tryInstallSystemCallFilter(Natives.java:113) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:110) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:172) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:323) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:112) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) [elasticsearch-cli-6.2.2.jar:6.2.2] at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-cli-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:85) [elasticsearch-6.2.2.jar:6.2.2][2018-03-12T11:56:52,359][WARN ][o.e.b.JNANatives ] Unable to lock JVM Memory: error=12, reason=Cannot allocate memory[2018-03-12T11:56:52,359][WARN ][o.e.b.JNANatives ] This can result in part of the JVM being swapped out.[2018-03-12T11:56:52,359][WARN ][o.e.b.JNANatives ] Increase RLIMIT_MEMLOCK, soft limit: 65536, hard limit: 65536[2018-03-12T11:56:52,359][WARN ][o.e.b.JNANatives ] These can be adjusted by modifying /etc/security/limits.conf, for example: # allow user 'work' mlockall work soft memlock unlimited work hard memlock unlimited[2018-03-12T11:56:52,359][WARN ][o.e.b.JNANatives ] If you are logged in interactively, you will have to re-login for the new limits to take effect.
解决办法：
使用root用户修改/etc/security/limits.conf文件：work soft memlock unlimitedwork hard memlock unlimited
解决办法：
使用root用户修改/etc/security/limits.conf文件：work soft nofile 65536work hard nofile 65536
解决办法：
使用root用户修改/etc/security/limits.conf文件：work soft nproc 4096work hard nproc 4096
[2018-03-12T14:25:44,413][WARN ][o.e.b.BootstrapChecks ] [yf-beidou-dmp00.yf01.baidu.com] max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
解决办法：
1）执行如下命令，实时生效：sysctl -w vm.max_map_count=262144
2）修改/etc/sysctl.conf，重启后生效：
vm.max_map_count = 262144
注：要使 limits.conf 文件配置生效，必须要确保 pam_limits.so 文件被加入到启动文件中。查看 /etc/pam.d/login 文件中有：session required /lib/security/pam_limits.so这一行配置；
org.elasticsearch.ElasticsearchException: Failed to create native process factories for Machine Learning at org.elasticsearch.xpack.ml.MachineLearning.createComponents(MachineLearning.java:422) ~[?:?] at org.elasticsearch.xpack.ml.MachineLearning.createComponents(MachineLearning.java:373) ~[?:?] at org.elasticsearch.node.Node.lambda$new$7(Node.java:397) ~[elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.node.Node$$Lambda$1374/1560391896.apply(Unknown Source) ~[?:?] at java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:267) ~[?:1.8.0_45] at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1374) ~[?:1.8.0_45] at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:512) ~[?:1.8.0_45] at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:502) ~[?:1.8.0_45] at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708) ~[?:1.8.0_45] at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:1.8.0_45] at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:499) ~[?:1.8.0_45] at org.elasticsearch.node.Node.(Node.java:400) ~[elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.node.Node. (Node.java:246) ~[elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Bootstrap$5. (Bootstrap.java:213) ~[elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:213) ~[elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:323) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:112) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) [elasticsearch-cli-6.2.2.jar:6.2.2] at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-cli-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) [elasticsearch-6.2.2.jar:6.2.2] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:85) [elasticsearch-6.2.2.jar:6.2.2]
这是由于x-pack中的machine learning功能依赖于2.9以上版本GLIBC，环境中缺乏glibc库所致。可通过如下命令定位问题：
${ES_HOME}/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/controller --version 输出缺少依赖的日志如下：
./controller: /lib64/tls/libc.so.6: version `GLIBC_2.4' not found (required by ./controller)./controller: /lib64/tls/libc.so.6: version `GLIBC_2.4' not found (required by /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/libMlCore.so)./controller: /lib64/tls/libc.so.6: version `GLIBC_2.7' not found (required by /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/libMlCore.so)./controller: /lib64/tls/libpthread.so.0: version `GLIBC_2.4' not found (required by /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/./libapr-1.so.0)./controller: /lib64/tls/libc.so.6: version `GLIBC_2.9' not found (required by /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/./libapr-1.so.0)./controller: /lib64/tls/libc.so.6: version `GLIBC_2.7' not found (required by /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/./libxml2.so.2)
或者通过ldd命令查看controller的依赖：
ldd ${ES_HOME}/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/controller 输出日志如下：
./controller: /lib64/tls/libc.so.6: version `GLIBC_2.4' not found (required by ./controller)./controller: /lib64/tls/libc.so.6: version `GLIBC_2.4' not found (required by /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/libMlCore.so)./controller: /lib64/tls/libc.so.6: version `GLIBC_2.7' not found (required by /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/libMlCore.so)./controller: /lib64/tls/libpthread.so.0: version `GLIBC_2.4' not found (required by /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/./libapr-1.so.0)./controller: /lib64/tls/libc.so.6: version `GLIBC_2.9' not found (required by /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/./libapr-1.so.0)./controller: /lib64/tls/libc.so.6: version `GLIBC_2.7' not found (required by /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/./libxml2.so.2) libpthread.so.0 => /lib64/tls/libpthread.so.0 (0x00007fb285c82000) libdl.so.2 => /lib64/libdl.so.2 (0x00007fb285b7f000) librt.so.1 => /lib64/tls/librt.so.1 (0x00007fb285a65000) liblog4cxx.so.10 => /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/liblog4cxx.so.10 (0x00007fb28567e000) libboost_program_options-gcc62-mt-1_65_1.so.1.65.1 => /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/libboost_program_options-gcc62-mt-1_65_1.so.1.65.1 (0x00007fb2853fd000) libMlCore.so => /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/libMlCore.so (0x00007fb2850d1000) libstdc++.so.6 => /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/libstdc++.so.6 (0x00007fb284d27000) libm.so.6 => /lib64/tls/libm.so.6 (0x00007fb284ba1000) libgcc_s.so.1 => /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/libgcc_s.so.1 (0x00007fb28498a000) libc.so.6 => /lib64/tls/libc.so.6 (0x00007fb284756000) /lib64/ld-linux-x86-64.so.2 (0x00007fb285d97000) libaprutil-1.so.0 => /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/./libaprutil-1.so.0 (0x00007fb28452f000) libexpat.so.0 => /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/./libexpat.so.0 (0x00007fb284304000) libapr-1.so.0 => /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/./libapr-1.so.0 (0x00007fb2840ce000) libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007fb283f9a000) libxml2.so.2 => /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/./libxml2.so.2 (0x00007fb283c20000) libz.so.1 => /usr/lib64/libz.so.1 (0x00007fb283b0d000) libboost_regex-gcc62-mt-1_65_1.so.1.65.1 => /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/./libboost_regex-gcc62-mt-1_65_1.so.1.65.1 (0x00007fb283815000) libboost_iostreams-gcc62-mt-1_65_1.so.1.65.1 => /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/./libboost_iostreams-gcc62-mt-1_65_1.so.1.65.1 (0x00007fb283600000) libboost_filesystem-gcc62-mt-1_65_1.so.1.65.1 => /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/./libboost_filesystem-gcc62-mt-1_65_1.so.1.65.1 (0x00007fb2833e5000) libboost_system-gcc62-mt-1_65_1.so.1.65.1 => /home/work/elasticsearch-6.2.2/plugins/x-pack/x-pack-ml/platform/linux-x86_64/bin/../lib/./libboost_system-gcc62-mt-1_65_1.so.1.65.1 (0x00007fb2831e1000)
解决办法1：如果不需要使用machine learning功能，则可以在elasticsearch.yml中设置禁用：
xpack.ml.enabled: false
解决办法2：安装或者升级glibc；如果使用centos4.3版本，则果断升级操作系统；
elasticsearch以及x-pack插件的运行，依赖于ES_TMPDIR环境变量的值作为临时文件目录；如果未设置，则默认为/tmp/elasticsearch;可通过在.bashrc或者.bash_profile文件中添加环境变量显式设置临时文件目录：
export ES_HOME=/home/work/elasticsearch-6.2.2export ES_TMPDIR="${ES_HOME}/tmp" 转载地址：http://xiwql.baihongyu.com/