Elasticsearch fails to start: CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed

Question

I've tried to start Elasticsearch and failed.I've checked the logs and got the following error:

[...][WARN ][o.e.b.JNANatives         ] unable to install syscall filter:
java.lang.UnsupportedOperationException: seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed
at org.elasticsearch.bootstrap.SystemCallFilter.linuxImpl(SystemCallFilter.java:342) ~[elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.bootstrap.SystemCallFilter.init(SystemCallFilter.java:617) ~[elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.bootstrap.JNANatives.tryInstallSystemCallFilter(JNANatives.java:258) [elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.bootstrap.Natives.tryInstallSystemCallFilter(Natives.java:113) [elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:111) [elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:195) [elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:342) [elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:132) [elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:123) [elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:70) [elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:134) [elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:91) [elasticsearch-5.6.9.jar:5.6.9]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:84) [elasticsearch-5.6.9.jar:5.6.9]

Why is this happening?

What can I do to handle it?

Answer 1

The reason why this error occur is because you did not set the following parameter in the elasticsearch.yml

bootstrap.system_call_filter: false

It means that you know that the seccomp security feature is offline.

This is leading to another question...

If the SecComp feature is offline, can I use the Elasticsearch security features? or not?

I've searched for an answer until I got one from Elasticsearch itself:

Disabling the bootstrap.system_call_filter does not have an effect in the rest of the stack. This check were meant to prevent scenarios when SecComp is silently not initialized yet configured to be initialized - i.e, to prevent that we start Elasticsearch under conditions not wanted by the OS admins.

Which means that all you need to do is set the configuration in elasticsearch.yml:

bootstrap.system_call_filter: false

And let your DevOps know that Elasticsearch works with a disabled SecComp.