The error

I installed Elasticsearch on CentOS using rpm and am encountering this error when I try to start it via systemctl start elasticsearch:

Feb 20 21:08:34 server.cberdata.org systemd[1]: Started Elasticsearch.
Feb 20 21:08:34 server.cberdata.org elasticsearch[4226]: OpenJDK 64-Bit Server VM warning: Cannot open file /var/log/elasticsearch/gc.log due to Permission denied
Feb 20 21:08:51 server.cberdata.org systemd[1]: elasticsearch.service: main process exited, code=exited, status=78/n/a
Feb 20 21:08:51 server.cberdata.org systemd[1]: Unit elasticsearch.service entered failed state.
Feb 20 21:08:51 server.cberdata.org systemd[1]: elasticsearch.service failed.

Notably: Cannot open file /var/log/elasticsearch/gc.log due to Permission denied


Permissions for /var:

drwxr-xr-x  21 root root  4096 Feb 11 19:10 var

Permissions for /var/log:

drwxrwxr--  12 root  root   4096 Feb 20 21:00 log

Permissions for /var/log/elasticsearch:

drwxrwxrwx  2 elasticsearch elasticsearch        4096 Feb 20 20:56 elasticsearch

Permissions for /var/log/elasticsearch/gc.log
(which I manually created to see if that would help, but doing so had no effect on the error):

-rwxrwxrwx  1 elasticsearch elasticsearch      0 Feb 20 20:56 gc.log

Setting /var/log permissions to drwxrwxrwx appears to fix the problem, but I'm hesitant to do that because it seems insecure and it results in these new errors:

error: skipping "/var/log/exim_mainlog" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.

Am I correct that systemctl / systemd is running this service as the elasticsearch user? If it's doing that, how can the owner of the file and its directory, with apparent read/write/execute permissions, not have permission to open that file?


The directory /var/log has 774 permissions. As the execute bit isn't set, the elasticsearch user can't traverse the directory to get the elasticsearch directory and the gc.log file contained therein.

Normally, the /var/log directory has 755 permissions or else no services or applications running as anyone other than root would be able to write to it.

You can fix it by using:

chmod 755 /var/log

You also don't need to have 777 permissions on the elasticsearch directory and the log file. The can use a variation of the above command to set the permissions:

chmod -R 755 /var/log/elasticsearch
  • That worked! I forgot that execute is needed for directory traversal. Thanks, Nasir! – Phantom Watson Feb 20 at 22:11
  • @PhantomWatson You are welcome. – Nasir Riley Feb 20 at 22:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.