...
Alternatively and better long-term is to reduce the scroll argument of any squirro_client.scan() usage from the default 5m to something like 1m. We also filed a official improvement request to auto close contexts in a future release. Reference: SQ-13364
Elasticsearch fails to start with “Unable to load JNA native support library, native methods will be disabled” error message in the log
This happens when Elasticsearch tries to use the /tmp/ folder, but that folder is mounted with the noexec flag. Or alternatively if another temporary folder is used, the Elasticsearch service user has no execution rights in that folder.
The main reason why the noexec flag would be set on tmp is OS hardening. The tmp folder can be leveraged by bad actors to store and execute things. In a highly hardened system this is not desirable and hence the noexec flag is often set.
The workaround for this is to edit /etc/sysconfig/elasticsearch and to add this line:
| Code Block |
|---|
ES_TMPDIR=/usr/share/elasticsearch/tmp |
This would be a sensible default. But any location will do, as long as the folder is owned by the elasticsearch uid and gid.
Memory setting
You can set Elasticsearch memory in the file /etc/elasticsearch/jvm.options.d/squirro.options. Minimum heap size (Xms) and maximum heap size (Xmx) must be equal to each other, for example:
...