(Conditional – Intelligence) If Pods are in CrashLoopBackOff State

When preparing the EFS for deploying Intelligence in AWS, even after setting the permissions in the arcsight-volume folder to 1999:1999, the Elasticsearch and Logstash pods enter into a CrashLoopBackOff state from a Running state. This procedure enables you to workaround the problem of the pods being in the CrashLoopBackOff state.

  1. Log in to the bastion host.

  2. Navigate to the following directory and set the permissions to 1999:1999 again:

    cd /mnt/efs/<parent_folder_name>
    sudo chown -R 1999:1999 arcsight-volume		
  3. Wait for the Elasticsearch and Logstash pods to come up.

  4. If the pods enter into a Running state and then into a CrashLoopBackOff state, keep repeating steps 2 and 3 until the pods are stable. That is, they don't switch from the Running state to the CrashLoopBackOff state anymore.