wazuh-documentation
wazuh-documentation copied to clipboard
Missing /dev/shm permission fix in Migration guide
If you are migrating to the Wazuh indexer you have to run
chown wazuh-indexer:wazuh-indexer -R /dev/shm/performanceanalyzer/
otherwise you will get
java.nio.file.AccessDeniedException: /dev/shm/performanceanalyzer/1698832635000.tmp
at sun.nio.fs.UnixException.translateToIOException(UnixException.java:90) ~[?:?]
at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:106) ~[?:?]
at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111) ~[?:?]
at sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:218) ~[?:?]
at java.nio.file.spi.FileSystemProvider.newOutputStream(FileSystemProvider.java:484) ~[?:?]
at java.nio.file.Files.newOutputStream(Files.java:228) ~[?:?]
at org.opensearch.performanceanalyzer.commons.event_process.EventLogFileHandler.writeTmpFileWithPrivilege(EventLogFileHandler.java:80) [performance-analyzer-commons-1.0.0.jar:?]
at org.opensearch.performanceanalyzer.commons.event_process.EventLogFileHandler.lambda$writeTmpFile$0(EventLogFileHandler.java:47) [performance-analyzer-commons-1.0.0.jar:?]
at org.opensearch.performanceanalyzer.commons.util.Util.lambda$invokePrivileged$1(Util.java:57) [performance-analyzer-commons-1.0.0.jar:?]
at java.security.AccessController.doPrivileged(AccessController.java:318) [?:?]
at org.opensearch.performanceanalyzer.commons.util.Util.invokePrivileged(Util.java:53) [performance-analyzer-commons-1.0.0.jar:?]
at org.opensearch.performanceanalyzer.commons.event_process.EventLogFileHandler.writeTmpFile(EventLogFileHandler.java:47) [performance-analyzer-commons-1.0.0.jar:?]
at org.opensearch.performanceanalyzer.writer.EventLogQueueProcessor.purgeQueueAndPersist(EventLogQueueProcessor.java:152) [opensearch-performance-analyzer-2.8.0.0.jar:2.8.0.0]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) [?:?]
at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:305) [?:?]
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:305) [?:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) [?:?]
at java.lang.Thread.run(Thread.java:833) [?:?]
as the the directory is owned by elasticsearch user too.