{"record":{"id":"f753dbdfafd9de39","repo":"SonarSource/sonarqube","slug":"elasticsearch-keystore-tool-exited-with-code","errorCode":null,"errorMessage":"Elasticsearch KeyStore tool exited with code: ","messagePattern":"Elasticsearch KeyStore tool exited with code: ","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"server/sonar-main/src/main/java/org/sonar/application/es/EsKeyStoreCli.java","lineNumber":110,"sourceCode":"      writer.flush();\n\n    } catch (IOException e) {\n      throw new IllegalStateException(e);\n    }\n  }\n\n  private static void waitFor(Process process) {\n    try {\n      process.waitFor(1, TimeUnit.MINUTES);\n    } catch (InterruptedException e) {\n      Thread.currentThread().interrupt();\n      throw new IllegalStateException(\"EsKeyStoreCli has been interrupted\", e);\n    }\n  }\n\n  private static void checkExitValue(int code) {\n    if (code != 0) {\n      throw new IllegalStateException(\"Elasticsearch KeyStore tool exited with code: \" + code);\n    }\n  }\n\n  public static class EsKeyStoreJvmOptions extends JvmOptions<EsKeyStoreJvmOptions> {\n\n    public EsKeyStoreJvmOptions(EsInstallation esInstallation) {\n      super(mandatoryOptions(esInstallation));\n    }\n\n    private static Map<String, String> mandatoryOptions(EsInstallation esInstallation) {\n      Map<String, String> res = LinkedHashMap.newLinkedHashMap(7);\n      res.put(\"-Xms4m\", \"\");\n      res.put(\"-Xmx64m\", \"\");\n      res.put(\"-XX:+UseSerialGC\", \"\");\n      res.put(\"-Dcli.name=\", \"\");\n      res.put(\"-Dcli.script=\", \"bin/elasticsearch-keystore\");\n      res.put(\"-Dcli.libs=\", \"lib/tools/keystore-cli\");\n      res.put(\"-Des.path.home=\", esInstallation.getHomeDirectory().getAbsolutePath());","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-main/src/main/java/org/sonar/application/es/EsKeyStoreCli.java#L92-L128","documentation":"EsKeyStoreCli launches the Elasticsearch keystore CLI tool as a subprocess to seed credentials into the ES keystore. checkExitValue throws this IllegalStateException when the subprocess returns a non-zero exit code, meaning the keystore tool failed for its own reasons (bad command, wrong paths, JVM problems).","triggerScenarios":"The `elasticsearch-keystore` subprocess spawned by executeWith terminates with exit code != 0; SonarQube wraps the code in this exception. Interruption is handled separately (EsKeyStoreCli has been interrupted).","commonSituations":"Broken or incomplete Elasticsearch installation (missing keystore binary), invalid Java options in sonar.properties (sonar.es.javaAdditionalOpts), filesystem permission problems in the ES work directory, or corrupted keystore file.","solutions":["Check the server log for the subprocess stdout/stderr immediately before this exception to see the keystore tool's own error","Verify the Elasticsearch distribution bundled with SonarQube is intact (reinstall/upgrade if elasticsearch-keystore is missing or corrupt)","Review sonar.es.javaAdditionalOpts for invalid JVM flags that make the keystore JVM fail to start","Ensure the process user can write to the Elasticsearch data/work directories and that no stale/corrupt keystore file exists"],"exampleFix":"// before\nsonar.es.javaAdditionalOpts=-Djava.io.tmpdir=/bad-path\n// after\nsonar.es.javaAdditionalOpts=-Djava.io.tmpdir=/var/tmp/sonar-es","handlingStrategy":"try-catch","validationCode":"// Before starting ES, verify the keystore tool exists\nFile ks = new File(esInstallation.getLocation(), \"bin/elasticsearch-keystore\");\nif (!ks.isFile()) throw new IllegalStateException(\"elasticsearch-keystore missing from \" + esInstallation.getLocation());","typeGuard":null,"tryCatchPattern":"try { esKeystoreCli.execute(); } catch (IllegalStateException e) { log.error(\"ES keystore tool failed: {}\", e.getMessage(), e); throw new StartupAbortException(e); }","preventionTips":["Keep the bundled Elasticsearch distribution intact; avoid editing/deleting files under it","Validate custom sonar.es.javaAdditionalOpts JVM flags before upgrading","Run SonarQube as a user with write access to the ES work directory","Read the subprocess output in the log; it precedes this exception"],"tags":["elasticsearch","subprocess","exit-code","keystore"],"backgroundTag":"command-not-found","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}