This SAS Note pertains to SAS® Visual Investigator 10.7. For SAS® Visual Investigator 10.8, see SAS Note 69756, "Updating the Java Development Kit (JDK) instructions for Elasticsearch with SAS® Visual Investigator 10.8."
Red Hat introduced a new change in their openjdk packages (starting from 1.8.0-345.b01-5.el8_7) for rhel 8.7, which can cause Elasticsearch start-up failures. In this scenario, errors similar to the following occur in the /opt/sas/viya/config/var/log/svi-elasticsearch/sas-elasticsearch.log files:
[2022-12-26T04:49:50,867][ERROR][c.f.s.s.DefaultSearchGuardKeyStore] [mgiuHzm] Unable to determine supported ciphers due to java.lang.ExceptionInInitializerError
java.lang.ExceptionInInitializerError: null
at sun.security.ssl.TrustStoreManager.getTrustedCerts(TrustStoreManager.java:56) ~[?:?]
at sun.security.ssl.TrustManagerFactoryImpl.engineInit(TrustManagerFactoryImpl.java:49) ~[?:?]
at javax.net.ssl.TrustManagerFactory.init(TrustManagerFactory.java:250) ~[?:1.8.0_352]
To circumvent this issue, complete these steps.
1.Install an earlier version of the Red Hat JDK (1.8.0-322 or earlier) or the latest version from another source.
The following command can be used to obtain the installation path for the next step:
sudo update-alternatives --config java
2. Modify the /opt/sas/viya/config/etc/sysconfig/sas-svi-elasticsearch/default/sas-svi-elasticsearch file on all of the nodes in the Elasticsearch cluster to reference it by adding the following to the bottom of the file:
export ES_JAVA_HOME=’<Path to alternative JDK 8>’
3. Edit the elasticsearch-env file in the /opt/sas/viya/home/libexec/elasticsearch-secure/bin directory so that the IF statement under the # now set the path to java section matches the following:
if [ ! -z "$ES_JAVA_HOME" ]; then
JAVA="$ES_JAVA_HOME/bin/java"
elif [ ! -z "$JAVA_HOME" ]; then
# fallback to JAVA_HOME
JAVA="$JAVA_HOME/bin/java"
else
set +e
JAVA=`which java`
echo "warning: Falling back to java on path. This behavior is deprecated. Specify JAVA_HOME"
set -e
fi
4. Restart the Elasticsearch service on all the nodes in the cluster, if applicable.
5. Monitor the /opt/sas/viya/config/var/log/svi-elasticsearch/sas-elasticsearch.log files on each node in the cluster for errors.
6. Also, check the log files for a line near the top that should contain text that identifies which openjdk package is being used. It looks similar to the following:
[2023-01-04T09:09:42,633][INFO ][o.e.n.Node ] [3tB_6E9] version[6.8.6], pid[15699], build[oss/zip/3d9f765/2019-12-13T17:11:52.013738Z], OS[Linux/3.10.0-1160.2.2.el7.x86_64/amd64], JVM[Red Hat, Inc./OpenJDK 64-Bit Server VM/1.8.0_272/25.272-b10]
In this example, VM/1.8.0_272/25.272-b10 is the JDK that is being used.
Click the Hot Fix tab in this note for a link to instructions about accessing and applying the software update.
After you install the hot fix, Elasticsearch for SAS Visual Investigator 10.7 will support JDK 11 as well as JDK 1.8.0-322 or earlier. For existing deployments, if JDK 11 is being used, use the instructions above but substitute '<Path to alternative JDK 11>’ in this line:
export ES_JAVA_HOME=’<Path to alternative JDK 8>’
For new deployments, complete these steps:
1. Create a file called sas-viya-svi-elasticsearch-default.service.conf within the /etc/systemd/system/sas-viya-svi-elasticsearch-default.service.d directory.
2. Populate the file with the following:
[Service]
Environment="ES_JAVA_HOME=<Path to JDK 11 installation>"
3. Run this command to apply the changes:
$ systemctl daemon-reload
Then continue with step 3 in the instructions above.
Operating System and Release Information
SAS System | SAS Visual Investigator | Linux for x64 | 10.7 | | Viya | |
*
For software releases that are not yet generally available, the Fixed
Release is the software release in which the problem is planned to be
fixed.