System requirements

[SteveClement]

Description

When running the docker container, under low memory circumstances, elasticsearch never comes up.

Environment

1. Ubuntu 18.04
2. OpenCTI version: https://releases.opencti.io/opencti-20190627.tar.gz
3. OpenCTI client: n/a
4. Other environment details: 2GB RAM (cloud VM)

Endless loop: opencti_1 | Waiting ElasticSearch to launch...

Additionally, as per Elastic docker docs, perhaps mention:

Important

The vm.max_map_count kernel setting needs to be set to at least 262144 for production use. Depending on your platform

[swedishmike]

I had the same issue on Ubuntu 18.04

By executing sysctl -w vm.max_map_count=262144 and trying again I got it all to start. Should that possibly be added to the documentation?

Alternatively, a link to this information could be added to the documentation? https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html#docker-cli-run-prod-mode

[SteveClement]

I also had the issue that some containers exited with error 137, but that was before the sysctl. Let's see if that fixed it too.

[SamuelHassine]

Hello @SteveClement, @swedishmike,

Thank you for your bug report. The documentation has been updated to take into account the need to use sysctl -w vm.max_map_count=262144 before running the docker-compose.

Cheers,
Sam