SonarSource/sonarqube · error · IllegalStateException

Elasticsearch KeyStore tool exited with code:

Error message

Elasticsearch KeyStore tool exited with code: 

What it means

EsKeyStoreCli launches the Elasticsearch keystore CLI tool as a subprocess to seed credentials into the ES keystore. checkExitValue throws this IllegalStateException when the subprocess returns a non-zero exit code, meaning the keystore tool failed for its own reasons (bad command, wrong paths, JVM problems).

Source

Thrown at server/sonar-main/src/main/java/org/sonar/application/es/EsKeyStoreCli.java:110

      writer.flush();

    } catch (IOException e) {
      throw new IllegalStateException(e);
    }
  }

  private static void waitFor(Process process) {
    try {
      process.waitFor(1, TimeUnit.MINUTES);
    } catch (InterruptedException e) {
      Thread.currentThread().interrupt();
      throw new IllegalStateException("EsKeyStoreCli has been interrupted", e);
    }
  }

  private static void checkExitValue(int code) {
    if (code != 0) {
      throw new IllegalStateException("Elasticsearch KeyStore tool exited with code: " + code);
    }
  }

  public static class EsKeyStoreJvmOptions extends JvmOptions<EsKeyStoreJvmOptions> {

    public EsKeyStoreJvmOptions(EsInstallation esInstallation) {
      super(mandatoryOptions(esInstallation));
    }

    private static Map<String, String> mandatoryOptions(EsInstallation esInstallation) {
      Map<String, String> res = LinkedHashMap.newLinkedHashMap(7);
      res.put("-Xms4m", "");
      res.put("-Xmx64m", "");
      res.put("-XX:+UseSerialGC", "");
      res.put("-Dcli.name=", "");
      res.put("-Dcli.script=", "bin/elasticsearch-keystore");
      res.put("-Dcli.libs=", "lib/tools/keystore-cli");
      res.put("-Des.path.home=", esInstallation.getHomeDirectory().getAbsolutePath());

View on GitHub (pinned to 184c821202)

Solutions

1. Check the server log for the subprocess stdout/stderr immediately before this exception to see the keystore tool's own error
2. Verify the Elasticsearch distribution bundled with SonarQube is intact (reinstall/upgrade if elasticsearch-keystore is missing or corrupt)
3. Review sonar.es.javaAdditionalOpts for invalid JVM flags that make the keystore JVM fail to start
4. Ensure the process user can write to the Elasticsearch data/work directories and that no stale/corrupt keystore file exists

Example fix

// before
sonar.es.javaAdditionalOpts=-Djava.io.tmpdir=/bad-path
// after
sonar.es.javaAdditionalOpts=-Djava.io.tmpdir=/var/tmp/sonar-es

// Before starting ES, verify the keystore tool exists
File ks = new File(esInstallation.getLocation(), "bin/elasticsearch-keystore");
if (!ks.isFile()) throw new IllegalStateException("elasticsearch-keystore missing from " + esInstallation.getLocation());

try { esKeystoreCli.execute(); } catch (IllegalStateException e) { log.error("ES keystore tool failed: {}", e.getMessage(), e); throw new StartupAbortException(e); }

When it happens

Trigger: The `elasticsearch-keystore` subprocess spawned by executeWith terminates with exit code != 0; SonarQube wraps the code in this exception. Interruption is handled separately (EsKeyStoreCli has been interrupted).

Common situations: Broken or incomplete Elasticsearch installation (missing keystore binary), invalid Java options in sonar.properties (sonar.es.javaAdditionalOpts), filesystem permission problems in the ES work directory, or corrupted keystore file.

Related errors

• Failed to setup SSL context on ES client
• Failed to setup SSL context on ES client
• Fail to launch monitor of process [%s]
• Could not delete Elasticsearch temporary conf directory
• Failed to create temporary configuration directory [%s]

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/f753dbdfafd9de39. Report an issue: GitHub.