Briefly, this error occurs when Elasticsearch detects a discrepancy between the checksum of a file on the primary shard and its replica during the recovery process. This could be due to network issues, disk errors, or bugs. To resolve this, you can try the following: 1) Restart the Elasticsearch node, which will trigger a new recovery process. 2) Delete and recreate the corrupted replica shard. 3) Check for any underlying hardware or network issues that might be causing the corruption. Always ensure you have a backup of your data to prevent data loss.
This guide will help you check for common problems that cause the log ” {} Remote file corruption on node {}; recovering {}. local checksum OK ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: recovery, indices, node.
Overview
In Elasticsearch, recovery refers to the process of recovering a shard when something goes wrong. Shard recoveries can take place in various circumstances, such as when a node fails and a replica shard needs to be recreated from a primary shard, when the cluster needs to relocate shards to different nodes due to a rebalancing or a change in shard allocation settings, or when restoring an index from an Elasticsearch snapshot. Alternatively, Elasticsearch can sometimes perform recoveries automatically, such as when a node restarts or disconnects and connects again. In summary, recovery can happen in the following scenarios:
- Node startup or failure (local store recovery)
- Replication of primary shards to replica shards
- Relocation of a shard to a different node in the same cluster
- Restoration of a snapshot
Planned node restart
If you are planning to restart a node, there are some actions that you can take to speed up the shard recoveries when the node has restarted. For optimal recovery speed, you should stop any indexing to the shards that are hosted on the node that is about to be restarted. Once you’ve stopped your indexing process, you can perform the following actions:
1. Disable shard allocation to prevent shards from being reallocated to other nodes while the node is restarting using the following command:
PUT _cluster/settings
{
"persistent": {
"cluster.routing.allocation.enable": "primaries"
}
}It is worth noting that by default the shard relocation process only starts after one minute and that delay can be configured with the `index.unassigned.node_left.delayed_timeout` index setting.
2. Once shard relocation is disabled, you need to flush the transaction logs (using the command below), which will ensure that all operations currently stored in the transactions log are safely committed to the Lucene index on disk. That will save you time during the restart since no operations will need to be replayed, meaning that the recovery of your shards will be faster.
POST /_flush
Note that prior to ES 8.0, this operation was called synced-flush, but it was deprecated in 7.6 and removed in 8.0.
3. At this point, you can restart your node.
4. When the node has properly restarted, you can re-enable shard allocation using the following command:
PUT _cluster/settings
{
"persistent": {
"cluster.routing.allocation.enable": null
}
}If you have several nodes to restart or you are performing a full cluster restart, you can use the same procedure. The key points to remember for speeding up the recovery process are to stop any indexing and to flush your transaction log.
While the recovery process is in progress, there are a few API calls that allow us to monitor the status of the shard recoveries:
# Check the recovery status of a specific index
GET /<index>/_recovery
# Check the recovery status of all indexes
GET /_recovery
# Check the recovery status of all indexes (more concise format)
GET _cat/recovery
Tweaking recovery speed
If you cannot stop your indexing process for whatever reason, you can still perform the same procedure. However, since new data will keep flowing in while the node is restarting, all the indexing operations will need to be replayed, which will slow down the recovery process. However, there are a few knobs that you can tune to speed this up provided you have sufficient hardware resources (CPU, RAM, network).
By default, the total inbound and outbound recovery traffic on each hot and warm data node is limited to 40 Mbps. For dedicated cold and frozen nodes, that limit ranges from 40 Mbps to 250 Mbps depending on the total amount of memory available on those nodes. These default values have been determined empirically based on the assumption that the hardware is composed of standard SSD disks and a network interface with 1 Gbps throughput.If you have superior hardware (e.g., 10 Gbps network and 100K IOPS disks), you can increase the recovery traffic limit to a higher value using the following command:
PUT /_cluster/settings
{
"transient": {
"indices.recovery.max_bytes_per_sec": "100mb"
}
}You should be very careful when changing this setting as it can harm your cluster performance if the value you set is too high. Also, there are a few other expert settings that you can tweak if you want to optimize the recovery process, but changing the defaults on these expert settings is strongly discouraged unless you know exactly what you’re doing.
Conclusion
In this guide, we have explained what the shard recovery process is and under which circumstances it kicks in. We have also reviewed a few techniques to speed up the recovery process and highlighted what you need to pay attention to when you start tweaking the default recovery settings values.
Overview
To put it simply, a node is a single server that is part of a cluster. Each node is assigned one or more roles, which describe the node’s responsibility and operations. Data nodes store the data, and participate in the cluster’s indexing and search capabilities, while master nodes are responsible for managing the cluster’s activities and storing the cluster state, including the metadata.
While it is possible to run several node instances of Elasticsearch on the same hardware, it’s considered a best practice to limit a server to a single running instance of Elasticsearch.
Nodes connect to each other and form a cluster by using a discovery method.
Roles
Master node
Master nodes are in charge of cluster-wide settings and changes – deleting or creating indices and fields, adding or removing nodes and allocating shards to nodes. Each cluster has a single master node that is elected from the master eligible nodes using a distributed consensus algorithm and is reelected if the current master node fails.
Coordinating (client) node
There is some confusion in the use of coordinating node terminology. Client nodes were removed from Elasticsearch after version 2.4 and became coordinating nodes.
Coordinating nodes are nodes that do not hold any configured role. They don’t hold data and are not part of the master eligible group nor execute ingest pipelines. Coordinating nodes serve incoming search requests and act as the query coordinator running query and fetch phases, sending requests to every node that holds a shard being queried. The coordinating node also distributes bulk indexing operations and route queries to shards based on the node’s responsiveness.
Log Context
Log “{} Remote file corruption on node {}; recovering {}. local checksum OK” classname is RecoverySourceHandler.java.
We extracted the following from Elasticsearch source code for those seeking an in-depth context :
throw localException;
} else { // corruption has happened on the way to replica
RemoteTransportException remoteException = new RemoteTransportException(
"File corruption occurred on recovery but checksums are ok"; null);
remoteException.addSuppressed(e);
logger.warn(() -> new ParameterizedMessage("{} Remote file corruption on node {}; recovering {}. local checksum OK";
shardId; request.targetNode(); mds); corruptIndexException);
throw remoteException;
}
}
throw e;
