2023年11月29日发(作者:)

总结—elasticsearch启动失败的⼏种情况及解决

总结—elasticsearch启动失败的⼏种情况及解决

1、使⽤root⽤户启动失败

在有⼀次搭建elasticsearch的时候,使⽤systemctl启动elasticsearch失败,然后在bin⽬录下⾯去使⽤启动脚本启动,发现报错不能⽤root⽤户启动,报“Caused by:

eException: can not run elasticsearch as root”

[root@localhost bin]# ./elasticsearch

[2017-12-20T17:01:47,922][WARN ][csearchUncaughtExceptionHandler] [node-1] uncaught exception in thread [main]

pException: eException: can not run elasticsearch as root

at (:125) ~[elasticsearch-6.1.1.jar:6.1.1]

at e(:112) ~[elasticsearch-6.1.1.jar:6.1.1]

at e(:86) ~[elasticsearch-6.1.1.jar:6.1.1]

at thoutErrorHandling(:124) ~[elasticsearch-cli-6.1.1.jar:6.1.1]

at (:90) ~[elasticsearch-cli-6.1.1.jar:6.1.1]

at (:92) ~[elasticsearch-6.1.1.jar:6.1.1]

at (:85) ~[elasticsearch-6.1.1.jar:6.1.1]

Caused by: eException: can not run elasticsearch as root

at lizeNatives(:104) ~[elasticsearch-6.1.1.jar:6.1.1]

at (:171) ~[elasticsearch-6.1.1.jar:6.1.1]

at (:322) ~[elasticsearch-6.1.1.jar:6.1.1]

at (:121) ~[elasticsearch-6.1.1.jar:6.1.1]

... 6 more

[root@localhost bin]# cd ..

解决:

创建⼀个独⽴的⽤户,⽐如elk来启动elasticsearch,不⽤root⽤户启动

2elasticsearch安装⽬录权限不对

遇到启动elasticsearch失败,使⽤的是专门的⽤户elk来启动的,启动⽇志提⽰不能加载配置⽂件:

[elk@docker bin]$ ./elasticsearch

Exception in thread "main" 2018-06-03 17:36:23,881 main ERROR No log4j2 configuration file found. Using default configuration: logging only errors to the console. Set system property '' to show Log4j2 internal initialization logging.

2018-06-03 17:36:24,113 main ERROR Could not register mbeans ControlException: access denied ("rustPermission" "register")

at ermission(:472)

at ermission(:585)

at BeanTrustPermission(:1848)

at erMBean(:322)

at erMBean(:522)

at er(:389)

at sterMBeansAfterReconfigure(:167)

at sterMBeansAfterReconfigure(:140)

at figuration(:556)

at igure(:617)

at igure(:634)

at (:229)

at text(:242)

at text(:45)

at text(:174)

at ger(:618)

at ger(:54)

at ger(:62)

at ger(:101)

at ionsHelper.(:42)

at ng(:663)

at f(:2994)

at n(:821)

at ble$n(:748)

at tackTrace(:655)

at tackTrace(:643)

at htException(:1061)

at htException(:1052)

at chUncaughtException(:1959)

SettingsException[Failed to load settings from /usr/local/elasticsearch-5.6.0/config/]; nested: AccessDeniedException[/usr/local/elasticsearch-5.6.0/config/];

at eEnvironment(:102)

at Env(:72)

at e(:67)

at thoutErrorHandling(:134)

at (:90)

at (:91)

at (:84)

Caused by: DeniedException: /usr/local/elasticsearch-5.6.0/config/

at ateToIOException(:84)

at wAsIOException(:102)

at wAsIOException(:107)

at eChannel(:214)

at eChannel(:361)

at eChannel(:407)

at utStream(:384)

at utStream(:152)

at gs$omPath(:1032)

at eEnvironment(:100)

... 6 more

[elk@docker bin]$

解决:

看到“Caused by: DeniedException: /usr/local/elasticsearch-5.6.0/config/”的提⽰,就去检查⽬录的权限,果然是root:root权限,使⽤elk⽤户

去启动,就报错了。

将⽬录的权限改成elk:elk就好了。

[root@docker ~]# ll /usr/local/

drwxr-xr-x 7 root root 123 9 7 2017 elasticsearch-5.6.0

[root@docker local]# chown -R elk:elk elasticsearch-5.6.0

[root@docker local]# ll

drwxr-xr-x 7 elk elk 123 9 7 2017 elasticsearch-5.6.0

3、使⽤yum安装⽅式,赋权错误,启动失败

在⼀次使⽤yum安装elasticsearch的时候,执⾏完yum -y install elasticsearch 命令后,进⾏了下⾯的操作:

1、修改⽂件

2、创建elk⽤户

3、创建/opt/elk/data⽬录,并且赋权为elk:elk

4、修改/var/log/elasticsearch权限为elk:elk

5、启动服务,但是报下⾯的错(截取了部分):

[root@test101 init.d]# ./elasticsearch start

Starting elasticsearch: 2018-06-12 15:13:50,287 main ERROR Unable to create file /var/log/elasticsearch/ ption: 权限不够

at FileExclusively(Native Method)

at NewFile(:1012)

at gFileManager$Manager(:628)

at gFileManager$Manager(:608)

at ager(:113)

at ager(:115)

at eManager(:188)

at gFileAppender$(:144)

at gFileAppender$(:60)

at (:122)

at PluginObject(:958)

at Configuration(:898)

at Configuration(:890)

at igure(:513)

at lize(:237)

at (:249)

at figuration(:545)

at (:261)

at ure(:166)

at ure(:122)

at (:307)

at (:132)

at e(:123)

at e(:70)

at thoutErrorHandling(:134)

at (:90)

at (:91)

at (:84)

2018-06-12 15:13:50,296 main ERROR Could not create plugin of type class gFileAppender for element RollingFile: lStateException: ManagerFactory [

at ager(:115)

at ager(:115)

at eManager(:188)

at gFileAppender$(:144)

at gFileAppender$(:60)

at (:122)

at PluginObject(:958)

at Configuration(:898)

at Configuration(:890)

at igure(:513)

at lize(:237)

at (:249)

at figuration(:545)

at (:261)

at ure(:166)

at ure(:122)

at (:307)

at (:132)

at e(:123)

at e(:70)

at thoutErrorHandling(:134)

at (:90)

at (:91)

at (:84)

2018-06-12 15:13:50,311 main ERROR Unable to invoke factory method in class gFileAppender for element RollingFile: lStateException: No factory method found for class

at ctoryMethod(:229)

at (:134)

at PluginObject(:958)

at Configuration(:898)

at Configuration(:890)

at igure(:513)

at lize(:237)

at (:249)

at figuration(:545)

at (:261)

at ure(:166)

at ure(:122)

at (:307)

at (:132)

at e(:123)

at e(:70)

at thoutErrorHandling(:134)

at (:90)

at (:91)

at (:84)

解决:

原来在执⾏yum -y install elasticsearch的时候,就已经⾃动创建了⼀个单独的管理⽤户elasticsearch,但是我⼜⾃⼰创建了⼀个elk⽤户,并且把datalog⽬录授权给elk,所以

就会出现“Starting elasticsearch: 2018-06-12 15:13:50,287 main ERROR Unable to create file /var/log/elasticsearch/ ption: 权限不够的报错。

因此只需要将/opt/elk/data/var/log/elasticsearch⽬录权限改为elasticsearch:elasticsearch就好了:

然后重启服务成功:

[root@test101 init.d]# ./elasticsearch start

Starting elasticsearch: [ 确定 ]

[root@test101 init.d]# ps -ef|grep elasticsearch

elastic+ 5157 1 80 15:49 ? 00:00:08 /usr/local/jdk1.8.0_151/bin/java -Xms512m -Xmx512m -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+AlwaysPreTouch -server

root 5177 921 0 15:50 pts/0 00:00:00 grep --color=auto elasticsearch

[root@test101 init.d]# netstat -tlunp|grep 9200

tcp6 0 0 :::9200 :::* LISTEN 5157/java

[root@test101 init.d]#

4、⽇志和数据⽬录权限异常,启动失败

[elk@docker bin]$ ./elasticsearch

2018-06-04 01:15:07,609 main ERROR Unable to create file /home/elk/logs/ ption: 权限不够

at FileExclusively(Native Method)

at NewFile(:1012)

后⾯还有⼀段:

Caused by: lStateException: Failed to create node environment

at .(:268) ~[elasticsearch-5.6.0.jar:5.6.0]

at .(:245) ~[elasticsearch-5.6.0.jar:5.6.0]

at rap$5.(:233) ~[elasticsearch-5.6.0.jar:5.6.0]

at (:233) ~[elasticsearch-5.6.0.jar:5.6.0]

at (:342) ~[elasticsearch-5.6.0.jar:5.6.0]

at (:132) ~[elasticsearch-5.6.0.jar:5.6.0]

... 6 more

Caused by: DeniedException: /home/elk/data/nodes

at ateToIOException(:84) ~[?:?]

⽇志报的“/home/elk/data/”“/home/elk/logs/”⽬录都是在配置⽂件⾥⾯配置的两个⽬录,查看权限果然不对,权限是elk的⽬录权限是elk,但是下⾯的data⽬录和logs⽬录权限还是root,因此引起了启动失败:

[root@docker home]# ll

drwx------ 5 elk elk 125 6 3 17:35 elk #elk⽬录权限正常

[root@docker home]# cd elk/

在⼀次启动elasticsearch的时候启动失败,⽇志有提⽰“main ERROR Unable to create file /home/elk/logs/my-application_index_indexing_ ption: 权限不够“Caused by: DeniedException: /home/elk/da

[root@docker elk]# ll

总⽤量 0

drwxr-xr-x 2 root root 6 6 3 17:34 data #下⾯的datalogs⽬录还是root

drwxr-xr-x 2 root root 6 6 3 17:34 logs

解决:

将⽬录权限修改成elk之后,启动就OK

[root@docker elk]# chown elk:elk -R ./*

[root@docker elk]# ll

总⽤量 0

drwxr-xr-x 2 elk elk 6 6 3 17:34 data

drwxr-xr-x 2 elk elk 6 6 3 17:34 logs

[root@docker elk]#

5、内存不够,启动失败

在⼀次使⽤虚拟机做实验的过程中启动elasticsearch遇到了这样的报错:

[elk@docker bin]$ ./elasticsearch

Java HotSpot(TM) 64-Bit Server VM warning: INFO: os::commit_memory(0x0000, 2060255232, 0) failed; error='Cannot allocate memory' (errno=12)

#

# There is insufficient memory for the Java Runtime Environment to continue.

# Native memory allocation (mmap) failed to map 2060255232 bytes for committing reserved memory.

# An error report file with more information is saved as:

# /usr/local/elasticsearch-5.6.0/bin/hs_err_

解决:

原因:

查看了 /usr/local/elasticsearch-5.6.0/bin/hs_err_⽇志⽂件,出现这样的报错,有两种可能:

1、系统进程数达到上限了,部署服务的时候/etc/security/⽂件修改没有⽣效。

2、确实物理内存不够

解决:

通过命令查看系统限制:ulimit -a查看open files不够⼤,如果不够⼤,就尝试通过设⼤该值:

[root@docker ~]# ulimit -n

1024

果然是部属的时候修改的/etc/security/⽂件没有⽣效。于是将机器reboot了⼀下,在查看就⽣效了:)

ulimit 值添加到/etc/profile⽂件中(适⽤于有root权限登录的系统)

为了每次系统重新启动时,都可以获取更⼤的ulimit值,将ulimit 加⼊到/etc/profile ⽂件底部。

echo ulimit -n 65535 >>/etc/profile

source /etc/profile #加载修改后的profile

ulimit -n #显⽰65535,修改完毕!

[root@docker ~]# ulimit -n

65536

但是在启动的时候还是报同样的错,查看了⼀下内存,这个虚拟机的内存只有1G,那应该就是物理内存不够了。⽬前还剩下这么多:

[root@docker ~]# free -h

total used free shared buff/cache available

Mem: 974M 119M 79M 7.7M 775M 680M

Swap: 819M 0B 819M

⼿动清理了⼀下内存:

[root@docker ~]# echo 3 > /proc/sys/vm/drop_caches

[root@docker ~]# free -h

total used free shared buff/cache available

Mem: 974M 114M 789M 7.7M 69M 739M

Swap: 819M 0B 819M

[root@docker ~]#

但是在启动报错依旧。

于是增加物理内存到2G

[root@docker elk]# free -h

total used free shared buff/cache available

Mem: 1.8G 1.6G 77M 4K 72M 29M

Swap: 819M 691M 128M

然后切换到elk⽤户去启动服务,就OK了:

[elk@docker bin]$ ./elasticsearch #为了看启动⽇志就前台启动的,ctrl+c 进程就会over

检查端⼝,起来了

[root@docker elk]# netstat -tlunp|grep 9200

tcp6 0 0 10.0.0.16:9200 :::* LISTEN 9628/java

[root@docker elk]#

然后关掉进程重新后台启动:

[elk@docker bin]$ nohup ./elasticsearch >/dev/null 2>&1 & #后台启动

[2] 9808

[elk@docker bin]$ ps -ef|grep elasticsearch #检查进程

elk 9808 4115 10 01:29 pts/0 00:00:23 /usr/local/jdk1.8.0_151/bin/java -Xms2g -Xmx2g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:+AlwaysPreTouch -server -Xss

elk 9890 4115 0 01:32 pts/0 00:00:00 grep --color=auto elasticsearch

[elk@docker bin]$

[root@docker elk]# netstat -tlunp|grep 9200 #root⽤户检查端⼝

tcp6 0 0 10.0.0.16:9200 :::* LISTEN 9808/java

[root@docker elk]#

6 bindIP写错,服务起不来

在⼀次安装 elasticsearc的时候,服务起不来,提⽰“Failed to bind to [9300-9400]”。启动服务报下⾯的错误:

[elk@host1 bin]$ ./elasticsearch

[2018-06-15T09:56:53,019][INFO ][ ] [node1] initializing ...

[2018-06-15T09:56:53,141][INFO ][vironment ] [node1] using [1] data paths, mounts [[/data (/dev/mapper/data-data)]], net usable_space [179.8gb], net total_space [179.9gb], spins? [possibly], types [xfs]

[2018-06-15T09:56:53,142][INFO ][vironment ] [node1] heap size [1.9gb], compressed ordinary object pointers [true]

[2018-06-15T09:56:53,143][INFO ][ ] [node1] node name [node1], node ID [F0PzQ9qSRPWq8YNcwjj0vg]

[2018-06-15T09:56:53,144][INFO ][ ] [node1] version[5.6.0], pid[27627], build[781a835/2017-09-07T03:09:58.087Z], OS[Linux/3.10.0-514.el7.x86_64/amd64], JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/1.8

[2018-06-15T09:56:53,144][INFO ][ ] [node1] JVM arguments [-Xms2g, -Xmx2g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -XX:+AlwaysPreTouch, -Xss

[2018-06-15T09:56:54,161][INFO ][sService ] [node1] loaded module [aggs-matrix-stats]

[2018-06-15T09:56:54,162][INFO ][sService ] [node1] loaded module [ingest-common]

[2018-06-15T09:56:54,162][INFO ][sService ] [node1] loaded module [lang-expression]

[2018-06-15T09:56:54,162][INFO ][sService ] [node1] loaded module [lang-groovy]

[2018-06-15T09:56:54,162][INFO ][sService ] [node1] loaded module [lang-mustache]

[2018-06-15T09:56:54,162][INFO ][sService ] [node1] loaded module [lang-painless]

[2018-06-15T09:56:54,163][INFO ][sService ] [node1] loaded module [parent-join]

[2018-06-15T09:56:54,163][INFO ][sService ] [node1] loaded module [percolator]

[2018-06-15T09:56:54,163][INFO ][sService ] [node1] loaded module [reindex]

[2018-06-15T09:56:54,163][INFO ][sService ] [node1] loaded module [transport-netty3]

[2018-06-15T09:56:54,163][INFO ][sService ] [node1] loaded module [transport-netty4]

[2018-06-15T09:56:54,164][INFO ][sService ] [node1] no plugins loaded

[2018-06-15T09:56:55,941][INFO ][eryModule ] [node1] using discovery type [zen]

[2018-06-15T09:56:56,770][INFO ][ ] [node1] initialized

[2018-06-15T09:56:56,770][INFO ][ ] [node1] starting ...

[2018-06-15T09:56:57,059][WARN ][csearchUncaughtExceptionHandler] [node1] uncaught exception in thread [main]

pException: BindTransportException[Failed to bind to [9300-9400]]; nested: BindException[Cannot assign requested address];

at (:136) ~[elasticsearch-5.6.0.jar:5.6.0]

at e(:123) ~[elasticsearch-5.6.0.jar:5.6.0]

at e(:67) ~[elasticsearch-5.6.0.jar:5.6.0]

at thoutErrorHandling(:134) ~[elasticsearch-5.6.0.jar:5.6.0]

at (:90) ~[elasticsearch-5.6.0.jar:5.6.0]

at (:91) ~[elasticsearch-5.6.0.jar:5.6.0]

at (:84) ~[elasticsearch-5.6.0.jar:5.6.0]

Caused by: ansportException: Failed to bind to [9300-9400]

at Port(:771) ~[elasticsearch-5.6.0.jar:5.6.0]

at rver(:736) ~[elasticsearch-5.6.0.jar:5.6.0]

at t(:173) ~[?:?]

at (:69) ~[elasticsearch-5.6.0.jar:5.6.0]

at t(:209) ~[elasticsearch-5.6.0.jar:5.6.0]

at (:69) ~[elasticsearch-5.6.0.jar:5.6.0]

at (:694) ~[elasticsearch-5.6.0.jar:5.6.0]

at (:278) ~[elasticsearch-5.6.0.jar:5.6.0]

at (:351) ~[elasticsearch-5.6.0.jar:5.6.0]

at (:132) ~[elasticsearch-5.6.0.jar:5.6.0]

... 6 more

Caused by: ception: Cannot assign requested address

at 0(Native Method) ~[?:?]

at (:433) ~[?:?]

at (:425) ~[?:?]

at (:223) ~[?:?]

at (:128) ~[?:?]

at ctChannel$(:554) ~[?:?]

at tChannelPipeline$(:1258) ~[?:?]

at Bind(:501) ~[?:?]

at (:486) ~[?:?]

at (:980) ~[?:?]

at (:250) ~[?:?]

at ctBootstrap$2.run(:365) ~[?:?]

at ecute(:163) ~[?:?]

at Tasks(:403) ~[?:?]

at (:462) ~[?:?]

at ThreadEventExecutor$5.run(:858) ~[?:?]

at (:745) [?:1.8.0_102]

[2018-06-15T09:56:57,822][INFO ][ ] [node1] stopping ...

[2018-06-15T09:56:57,826][INFO ][ ] [node1] stopped

[2018-06-15T09:56:57,826][INFO ][ ] [node1] closing ...

[2018-06-15T09:56:57,839][INFO ][ ] [node1] closed

[elk@host1 bin]$

[elk@host1 bin]$

[root@host1 bin]# netstat -tlunp|grep 9300

[root@host1 bin]# netstat -tlunp|grep 9200

[root@host1 bin]#

解决:

开始以为是端⼝被占⽤了,检查端⼝,发现并没有被占⽤:

[root@host1 bin]# netstat -tlunp|grep 9300

[root@host1 bin]# netstat -tlunp|grep 9200

[root@host1 bin]#

然后检查配置,发现 ⽂件⾥⾯有⼀⾏的IP写错了:

: 10.0.0.10 #这⼀⾏的IP地址写错了,不是本机IP

修改⽂件,将IP改正确,重新启动服务,就OK

7、配置⽂件的权限异常,导致启动失败

有⼀次在安装elasticsearch的时候,因为⽂件改得有问题,就从原来备份的⽂件cp重新⽣成了⼀份,改好之后启动报错

不能加载配置⽂件:

[elk@es bin]$ ./elasticsearch

Exception in thread "main" 2018-09-14 09:04:49,470 main ERROR No log4j2 configuration file found. Using default configuration: logging only errors to the console. Set system property '' to show Log4j2 internal initialization logging.

SettingsException[Failed to load settings from /usr/local/elasticsearch-5.6.0/config/]; nested: AccessDeniedException[/usr/local/elasticsearch-5.6.0/config/];

at eEnvironment(:102)

at Env(:72)

at e(:67)

at thoutErrorHandling(:134)

at (:90)

at (:91)

at (:84)

Caused by: DeniedException: /usr/local/elasticsearch-5.6.0/config/

at ateToIOException(:84)

at wAsIOException(:102)

at wAsIOException(:107)

at eChannel(:214)

at eChannel(:361)

at eChannel(:407)

at utStream(:384)

at utStream(:152)

at gs$omPath(:1032)

at eEnvironment(:100)

原来新⽣成的配置⽂件还是root权限,⽤elk⽤户去启动,当然加载不了:

[root@es config]# ll

total 20

-rw-r----- 1 root root 2961 Sep 14 09:04

-rw-r----- 1 elk elk 2854 Sep 14 08:49

-rw-rw---- 1 elk elk 3064 Sep 7 2017 s

-rw-rw---- 1 elk elk 4456 Sep 7 2017 ties

[root@es config]#

解决:

修改配置⽂件的权限,再重新启动就好了:

[root@es config]# chown elk:elk

[root@es config]# ll

total 20

-rw-r----- 1 elk elk 2961 Sep 14 09:04

-rw-r----- 1 elk elk 2854 Sep 14 08:49

-rw-rw---- 1 elk elk 3064 Sep 7 2017 s

-rw-rw---- 1 elk elk 4456 Sep 7 2017 ties

[root@es config]#

8yum安装的elasticsearch,找不到java路径,启动失败

今天使⽤yum安装elasticsearch的过程中,发现elasticsearch起不来,messages⽇志有如下的报错:

May 31 14:00:19 test103 systemd: Started Elasticsearch.

May 31 14:00:19 test103 systemd:

May 31 14:00:19 test103 elasticsearch: which: no java in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin) #elasticsearch在这个路径下⾯去找java,没有找到

May 31 14:00:19 test103 systemd: e: main process exited, code=exited, status=1/FAILURE

May 31 14:00:19 test103 elasticsearch: warning: Falling back to java on path. This behavior is deprecated. Specify JAVA_HOME

May 31 14:00:19 test103 elasticsearch: could not find java; set JAVA_HOME

May 31 14:00:19 test103 systemd: Unit e entered failed state.

May 31 14:00:19 test103 systemd: e failed.

报错说找不到java,但是实际上我是安装过jdk了,查看当前java路径为:

[root@test103 ~]# whereis java

java: /usr/local/jdk1.8.0_151/bin/java

[root@test103 ~]#

然后查看/usr/local/sbin/⽬录下没有java,所以elasticsearch在启动的时候找不到java路径。

解决:

/usr/local/jdk1.8.0_151/bin/java做了个软连接到 /usr/local/sbin下⾯:

[root@test103 sbin]# ln -s /usr/local/jdk1.8.0_151/bin/java /usr/local/sbin/java

[root@test103 sbin]# ll

总⽤量 0

lrwxrwxrwx 1 root root 32 5 31 14:01 java -> /usr/local/jdk1.8.0_151/bin/java

现在查看java路径,就有/usr/local/sbin/java了:

[root@test103 sbin]# whereis java

java: /usr/local/sbin/java /usr/local/jdk1.8.0_151/bin/java

[root@test103 sbin]#

然后重新启动elasticsearch,发现就可以正常启动了:

[root@test103 sbin]# systemctl start elasticsearch

[root@test103 sbin]# ps -ef|grep elasticsearch

elastic+ 13635 1 70 14:02 ? 00:00:12 /usr/local/sbin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -=60 -ka

elastic+ 13692 13635 0 14:02 ? 00:00:00 /usr/share/elasticsearch/modules/x-pack-ml/platform/linux-x86_64/bin/controller

root 13698 10140 0 14:02 pts/0 00:00:00 grep --color=auto elasticsearch

[root@test103 sbin]# netstat -tlunp|grep 9300

tcp6 0 0 10.0.0.103:9300 :::* LISTEN 13635/java

[root@test103 sbin]# netstat -tlunp|grep 9200

tcp6 0 0 10.0.0.103:9200 :::* LISTEN 13635/java