# Graylog will not start

**URL:** <https://community.graylog.org/t/graylog-will-not-start/21297>\
**Category:** Graylog Central (peer support)\
**Created:** [September 24, 2021, 8:25pm UTC](https://community.graylog.org/t/graylog-will-not-start/21297 "2021-09-24T20:25:25Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![danmassa7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/danmassa7/32/9723_2.png) [@danmassa7](https://community.graylog.org/u/danmassa7)\
**Post date:** [September 24, 2021, 8:25pm UTC](https://community.graylog.org/t/graylog-will-not-start/21297/1 "2021-09-24T20:25:25Z")

</div>

We have Graylog and Elasticserach running in what I think is a pretty simple setup. I was making some adjustments to the iptables NAT engine and rebooted the server. Graylog will now not start. The log found at:  
/var/log/graylog-server/server.log

…is saying…

################################################################################  
ERROR: Unable to probe any host for Elasticsearch version!  
Please see the following link(s) to help you with this error:  
\*  
Need further help?

- Official documentation:
- Community support:
- Commercial support:  
Terminating. ☹  
################################################################################

This server has been running for a few months with almost no problems. I don’t know what has changed to create this new behavior.

## Description of steps you’ve taken to attempt to solve the issue

I have restarted Graylog…  
sudo systemctl restart graylog-server

And I have restarted MongoDb…  
sudo service mongod restart

And I have restarted the entire server.

Restarting Elasticsearch produces the following error:

$ sudo systemctl restart elasticsearch.service  
Job for elasticsearch.service failed because the control process exited with error code.  
See “systemctl status elasticsearch.service” and “journalctl -xe” for details.

## Environmental information

### Operating system information

centos-linux-release-8.3-1.2011.el8.noarch

### Package versions

- Graylog 4.0.7
- MongoDB v4.2.14
- Elasticsearch Unknown

Thank you.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [September 25, 2021, 12:21am UTC](https://community.graylog.org/t/graylog-will-not-start/21297/2 "2021-09-25T00:21:41Z")

</div>

Hello && Welcome

> [@danmassa7](#):
>
> ERROR: Unable to probe any host for Elasticsearch version!

the issue is that Graylog is probing for the ES version used on startup. It goes through the list of configured nodes and gives up if none of them are up. Can you make sure that ES is available before GL is starting up.

Hence…

> [@danmassa7](#):
>
> Job for elasticsearch.service failed because the control process exited with error code

Fix Elasticsearch issue and Graylog will start.

1. Elasticsearch should be the first started
2. Check your ES health.

`curl -XGET http://localhost:9200/_cluster/health?pretty=true`

If you need help with elasticsearch please post your full ES YAML file and ES log file.  
Also, if you can post the following command that would be great.

`curl -XGET http://localhost:9200`

Hope that helps

---

<div class="post-metadata">

**Author:** ![aaronsachs](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aaronsachs/32/7180_2.png) [@aaronsachs](https://community.graylog.org/u/aaronsachs)\
**Post date:** [September 25, 2021, 2:14am UTC](https://community.graylog.org/t/graylog-will-not-start/21297/3 "2021-09-25T02:14:02Z")

</div>

Hey there, you should be able to specify the elasticsearch version using `elasticsearch_version = <YOURVERSIONNUMBER>` in your server.conf file and restart graylog.

---

<div class="post-metadata">

**Author:** ![danmassa7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/danmassa7/32/9723_2.png) [@danmassa7](https://community.graylog.org/u/danmassa7)\
**Post date:** [September 25, 2021, 11:44am UTC](https://community.graylog.org/t/graylog-will-not-start/21297/4 "2021-09-25T11:44:17Z")

</div>

Thank you for your help. It was ES that was the problem. Because of recent changes by me, it did not have access to /var/lib/elasticsearch. I think I did those changes back on Wednesday, so I think it didn’t affect ES on Wednesday because it already had the files open, so the change didn’t kick it out immediatly. When I rebooted the server on Friday it tripped it up.

Fixed it with this…  
`chown elasticsearch:elasticsearch /var/lib/elasticsearch`

Looks good now! Thanks.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [September 27, 2021, 9:08pm UTC](https://community.graylog.org/t/graylog-will-not-start/21297/5 "2021-09-27T21:08:21Z")

</div>

@danmassa7  
Glad you have it resolved.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [October 11, 2021, 9:08pm UTC](https://community.graylog.org/t/graylog-will-not-start/21297/6 "2021-10-11T21:08:51Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
