Always detects Elasticsearch as a service to restart

[geor-g]

$ needrestart --version
needrestart 2.11 - Restart daemons after library updates.

$ dpkg -l | grep needrestart
ii  needrestart                          2.11-2~bpo8+1

# needrestart -r l -v
[main] eval /etc/needrestart/needrestart.conf
[main] needrestart v2.11
[main] running in root mode
[Core] Using UI 'NeedRestart::UI::stdio'...
[main] detected systemd
[Core] #668 is a NeedRestart::Interp::Ruby
[Ruby] #668: source=/usr/bin/puppet
[main] #12767 uses deleted /tmp/jna--1985354563/jna5240503643370260303.tmp
[main] #12767 is not a child
[main] #12767 exe => /usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java
[Core] #12767 is a NeedRestart::Interp::Java
[Core] #12767 source is UNKNOWN
[main] #12767 is elasticsearch-els1.prod.hetzner.lokaler.de.service
[Kernel] Linux: kernel release 3.16.0-4-amd64, kernel version #1 SMP Debian 3.16.39-1+deb8u2 (2017-03-07)
Failed to load NeedRestart::Kernel::kFreeBSD: [Kernel/kFreeBSD] Not running on GNU/kFreeBSD!
[Kernel/Linux] /boot/vmlinuz-3.16.0-4-amd64 => 3.16.0-4-amd64 (debian-kernel@lists.debian.org) #1 SMP Debian 3.16.39-1+deb8u2 (2017-03-07) [3.16.0-4-amd64]*
[Kernel/Linux] Expected linux version: 3.16.0-4-amd64
Running kernel seems to be up-to-date.
Services to be restarted:
 systemctl restart elasticsearch-els1.prod.example.com.service
No containers need to be restarted.
No user sessions are running outdated binaries.

Regarding:

[main] #12767 uses deleted /tmp/jna--1985354563/jna5240503643370260303.tmp

the filename changes after each restart, and indeed, the file gets deleted right after the start. It seems this is just a temp file, maybe this should be ignored?

# cat /proc/12767/stat
12767 (java) S 1 12767 12767 0 -1 1077944576 934324 780 0 0 267925 53924 0 0 20 0 38 0 45849836 5548965888 863816 18446744073709551615 4194304 4196684 140732091068080 140732091050720 140333989622939 0 0 0 16800975 0 0 0 17 0 0 0 0 0 0 6294912 6295616 38326272 140732091071194 140732091071968 140732091071968 140732091072490 0

• This runs inside a KVM virtual machine.
• If there is anything I'm able to do to debug this further, please let me know.

[nirgal]

I had the same issue. I added

   qr(^/tmp/jna--),

to $nrconf{blacklist_mappings} in /etc/needrestart/needrestart.conf.

[Reiner030]

Newer versions needs adopted path:

qr(^/tmp/elasticsearch-),

[zerkms]

In my case it was

qr(^/tmp/elasticsearch\.),

[litinoveweedle]

with ES 7.17 and MEMLOCK, it was also needed something like:

qr#^/tmp/[a-z,A-Z]{6}#,

It is a ugly hack, but otherwise:

[main] #25925 uses deleted /tmp/apFEtF
[main] #25925 is not a child

.....

[main] #25925 exe => /usr/share/elasticsearch/jdk/bin/java
[Core] #25925 is a NeedRestart::Interp::Java
[Core] #25925 source is UNKNOWN
[main] #25925 is elasticsearch.service

.....

Services:
- elasticsearch.service

this is not JNA neither JFFI as both exists in my config

    # Java Native Access
    qr#/tmp/jna--#,

    # Java Foreign Function Interface
    qr#^/tmp/jffi#,

[MatthiasKuehneEllerhold]

Ive had to tweak somethings to get it to work (ES 7.17):
Create file /etc/needrestart/conf.d/elasticsearch.conf with content:

push @{ $nrconf{blacklist_mappings} }, qr(^/tmp/jna--);
push @{ $nrconf{blacklist_mappings} }, qr(^/tmp/elasticsearch-);
push @{ $nrconf{blacklist_mappings} }, qr(^/tmp/elasticsearch\.);
push @{ $nrconf{blacklist_mappings} }, qr(^/tmp/[a-z,A-Z0-9]{6});

And execute needrestart -v to see if it still recommends restart elasticsearch all the time.