IBM Support

OpenSearch fails to start in IBM Security SOAR 51.0.9.x due to noexec /tmp mount

Troubleshooting


Problem

When upgrading IBM Security SOAR from version 51.0.8.x to v51.0.9.x, the upgrade fails because the OpenSearch service does not start. 

OpenSearch attempts to extract and execute Java Native Access (JNA) libraries in the system temporary directory. If /tmp is mounted with the noexec flag, these native libraries cannot be executed, causing OpenSearch to fail during startup. 

Symptom

During or after the upgrade:

  • The OpenSearch service fails to start.
  • The resilient.service fails due to dependency on OpenSearch.
  • The upgrade process does not complete successfully.
# systemctl status opensearch

● opensearch.service - OpenSearch
   Loaded: loaded (/usr/lib/systemd/system/opensearch.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Mon 2026-03-09 14:59:02 EDT; 2min 7s ago
     Docs: https://opensearch.org/
  Process: 1462606 ExecStart=/usr/share/opensearch/bin/systemd-entrypoint -p ${PID_DIR}/opensearch.pid --quiet (code=exited, status=1/FAILURE)
 Main PID: 1462606 (code=exited, status=1/FAILURE)

 

# journalctl -xe

java.lang.NoClassDefFoundError: Could not initialize class com.sun.jna.Native
Caused by: java.lang.UnsatisfiedLinkError:
/tmp/opensearch-xxxxxx/jnaXXXX.tmp: failed to map segment from shared object

Cause

The /tmp filesystem is mounted with the noexec flag.

This configuration prevents OpenSearch from executing the JNA native libraries that are temporarily extracted during the startup. 

Diagnosing The Problem

  • Run the follwing command to verify mount options
# mount | grep /tmp

/dev/mapper/rootvg-tmplv on /tmp type xfs (rw,nosuid,nodev,noexec,relatime)
  • Verify whether noexec is configured persistently: 
# grep /tmp /etc/fstab

/dev/mapper/rootvg-tmplv /tmp xfs defaults,noexec,nodev,nosuid 0 0

Resolving The Problem

Configure OpenSearch to use an alternative temporary directory that allows executable files. 

1. Log in as root.

2. Edit the OpenSearch configuration file:

/etc/sysconfig/opensearch

3. Remove existing OPENSEARCH_TMPDIR entries:

OPENSEARCH_ENV_FILE="/etc/sysconfig/opensearch"

sed -i '/^OPENSEARCH_TMPDIR=/d' "${OPENSEARCH_ENV_FILE}"
sed -i '/^export OPENSEARCH_TMPDIR=/d' "${OPENSEARCH_ENV_FILE}"
4. Add new executable temporary directory configuration:
 
cat >> "${OPENSEARCH_ENV_FILE}" << EOF
# Custom temporary directory for OpenSearch (persistent across upgrades)
OPENSEARCH_TMPDIR="/var/lib/opensearch/tmp"
export OPENSEARCH_TMPDIR
EOF
5. Create the directory and set the permissions:
 
mkdir -p /var/lib/opensearch/tmp
chown opensearch:opensearch /var/lib/opensearch/tmp
chmod 755 /var/lib/opensearch/tmp
6. Restart OpenSearch:
 
systemctl restart opensearch
systemctl status opensearch
7. Confirm OpenSearch is using the new temporary directory:
 
ps -ef | grep opensearch | grep tmp
8. Verify successful startup in the logs:
 
tail -f /var/log/opensearch/opensearch.log
 
 
Results
 
After configuring OPENSEARCH_TMPDIR, Opensearch starts successfully, dependent services recover, and the SOAR upgrade to v51.0.9.x completes without errors. 

Document Location

Worldwide

 
 

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSA230","label":"IBM Security QRadar SOAR"},"Component":["Installation \/ Upgrade"],"ARM Category":[{"code":"a8m0z000000cwJlAAI","label":"Installation \/ Upgrade"}],"ARM Case Number":"TS021592358","Line of Business":{"code":"LOB77","label":"Automation Platform"}}]

Document Information

Modified date:
03 April 2026

UID

ibm17268415

Page Feedback