(Conditional – Intelligence) If Pods are in CrashLoopBackOff State

When preparing the NFS server for deploying Intelligence in Azure, even after setting the permissions in the arcsight-volume folder to 1999:1999, the Elasticsearch and Logstash pods enter into a CrashLoopBackOff state from a Running state. This procedure enables you to workaround the problem of the pods being in the CrashLoopBackOff state.

1. (Conditional) If the NFS server is not the Azure NetApp Files server, complete the following steps:

2. From your jump host, SSH to the NFS VM using its private IP address.

3. Log in to the NFS VM.

4. Become root.

5. Navigate to the following directory and set the permissions to 1999:1999 again:

   cd /nfs
   sudo chown -R 1999:1999 arcsight-volume		

6. (Conditional) If the NFS server is the Azure NetApp Files server, complete the following steps:

   1. From your jump host, become root.

   2. Execute the following command to retrieve the directory on which the Azure NetApp Files server is mounted:

      df -h

      The directory corresponding to <IP address of the NetApp Files server>/volume is the directory on which the Azure NetApp Files server is mounted.

   3. Navigate to the directory retrieved in the previous step and set the permissions to 1999:1999 again:

      cd /<Azure NetApp Files server directory>
      chown -R 1999:1999 arcsight-volume				

7. Wait for the Elasticsearch and Logstash pods to come up.

8. If the pods enter into a Running state and then into a CrashLoopBackOff state, keep repeating steps 5 and 7 until the pods are stable. That is, they don't switch from the Running state to the CrashLoopBackOff state anymore.