🐞🐋: Elasticsearch container does not come up/constantly restarts; state always: 'Restarting': sudo docker ps -a | grep elasticsearch #461
Labels
Docker
SELKS on Docker
Comments
|
What is the output of |
|
@pevma
What do you think? Regards, |
|
Ok, tried to restart elasticsearch container; behavior is still the same: |
|
|
|
Could please verify, if you have at least 2 CPUs and 10GB RAM on the host. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Is there an existing issue for this?
Current Behavior
Module 'Elasticsearch' always greyed-out in 'https://localhost/rules/es'; pls see screen shot:
Expected Behavior
everything depends on this Elasticsearch container running; so, well, I want this ti start-up and run stable.
So, since this one is not running reliably, also Kibana does not get any useful informations.
Steps To Reproduce
1st) followed this guide to set it up: https://github.com/StamusNetworks/SELKS/wiki/Docker
2nd) after executing: 'sudo -E docker compose up -d'; watch for the Elasticsearch container and its restarts w/ 'docker ps -a | grep -i elasticsearch'
Docker version
selks-user@selks:
$ docker -v Docker version 26.0.2, build 3c863ff selks-user@selks:$Docker version
selks-user@selks:
$ docker-compose -v docker-compose version 1.29.2, build 5becea4c selks-user@selks:$OS Version
selks-user@selks:
$ lsb_release -d Description: Debian GNU/Linux 11 (bullseye) selks-user@selks:$Content of the environnement File
selks-user@selks:/opt/selksd/SELKS/docker$ cat .env
COMPOSE_PROJECT_NAME=selks
INTERFACES= -i enp0s17 -i enp0s8
ELASTIC_DATAPATH=/var/SELKS/ELKdb/
SCIRIUS_SECRET_KEY=MBoZcxs576FcYqh2HEypMSblCG7V5p4YCB0aE8Uo3_M
PWD=${PWD}
selks-user@selks:/opt/selksd/SELKS/docker$
Version of SELKS
selks-user@selks:/opt/selksd/SELKS/docker$ git log -1
commit 2fc5391 (HEAD -> master, origin/master, origin/HEAD)
Merge: a030b9a 16fc908
Author: Eric Leblond eleblond@stamus-networks.com
Date: Mon Sep 11 08:35:37 2023 +0000
selks-user@selks:/opt/selksd/SELKS/docker$
Anything else?
I am really new to docker/SIEM/SELKS, so I am sure to have done some errors on this.
But:
My assumption on this issue:
-> so may be an error/misconfig in above selected NICs?
-> which (v)NIC/vNetwork to select?
-> logs entries:
selks-user@selks:/opt/selksd/SELKS/docker/containers-data/scirius/logs$ tail elasticsearch.log
return func(*args, params=params, **kwargs)
File "/root/.local/lib/python3.9/site-packages/elasticsearch/client/cluster.py", line 59, in health
return self.transport.perform_request(
File "/root/.local/lib/python3.9/site-packages/elasticsearch/transport.py", line 402, in perform_request
status, headers_response, data = connection.perform_request(
File "/root/.local/lib/python3.9/site-packages/elasticsearch/connection/http_urllib3.py", line 245, in perform_request
raise ConnectionError("N/A", str(e), e)
elasticsearch.exceptions.ConnectionError: ConnectionError(<urllib3.connection.HTTPConnection object at 0x7f30404f5d00>: Failed to establish a new connection: [Errno -2] Name or service not known) caused by: NewConnectionError(<urllib3.connection.HTTPConnection object at 0x7f30404f5d00>: Failed to establish a new connection: [Errno -2] Name or service not known)
ES connection error: <urllib3.connection.HTTPConnection object at 0x7f30404f5d00>: Failed to establish a new connection: [Errno -2] Name or service not known
selks-user@selks:/opt/selksd/SELKS/docker/containers-data/scirius/logs$
maybe a 'too old' version of Elasticsearch (7.xx) since they are already on 8.xx?
-> how to upgrade?
-> how to create an ISO file with those new relases of elastic/kibana/logstash/...?
-> does the point above make any since here?
ELASTIC_DATAPATH is definitily acessable from selks-user to read/write into it
If you may need any further information on this, pls let me know; I will deliver as fast as possible.
Any hint on this issue is highly appreciated.
Thank you very much for your effort.
Regards,
Roger
The text was updated successfully, but these errors were encountered: