Not able to start elasticsearch Default Service

Products

• VMware Smart Assurance

Issue/Introduction

You are unable to start the Elasticsearch (ES) service. The following error message appears in the ES logs (<APG>/Databases/Elasticsearch/Default/logs/apgcluster.log) or during the service startup: 

node validation exception bootstrap checks failed max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

Environment

All supported Watch4net|M&R releases

Cause

The Linux kernel parameter vm.max_map_count is set to the default value of 65530. This parameter defines the maximum number of memory map areas a single process can use. Memory-intensive applications like Elasticsearch require this limit to be at least 262144 to prevent crashes or out-of-memory errors during operation.

Resolution

You must increase the vm.max_map_count setting on the host where Elasticsearch is running, techdoc for reference.

1. Apply the change in the live session: Run the following command to apply the new configuration immediately without requiring a server reboot: 

   sysctl -w vm.max_map_count=262144

2. Make the change persistent: To ensure the setting remains after a reboot, update the /etc/sysctl.conf file:

   • • Open /etc/sysctl.conf in a text editor.
     • Add or update the following line: vm.max_map_count=262144
     • Save and close the file.

3. Restart the service: Restart the Elasticsearch service to confirm it is up and running correctly:

    ./manage-modules.sh service restart elasticsearch Default