freedomofpress / ansible-role-elk

Installs a turnkey ELK stack for log aggregation and analysis, with optional Riemann support for alerting
18 stars 13 forks source link

Set memlock unlimited for real #42

Closed conorsch closed 8 years ago

conorsch commented 8 years ago

Elasticsearch wants a lot of memory. The role already handles much of the config necessary, but still seeing memlock limit denials:

denied resource overstep by requesting 3364950016 for RLIMIT_MEMLOCK against limit 65536 for /usr/lib/jvm/java-7-openjdk-amd64/jre/bin/java[java:833] uid/euid:109/109 gid/egid:114/114, parent /lib/systemd/systemd[systemd:1] uid/euid:0/0 gid/egid:0/0

Turns out that under systemd there's more that's necessary to permit elasticsearch to lock memory. See discussion. Therefore we'll need to:

Note that the systemd service file changes will require a daemon-reload (the role already has a handler for this), and additionally will not persist through upgrades. There are strategies for overriding systemd configs carefully via /etc/systemd``rather than/usr/lib/systemd/`, so consider that as a stable approach.