securityadmin.sh Troubleshooting

If securityadmin.sh can’t reach the cluster, it outputs:

By default, securityadmin.sh uses localhost. If your cluster runs on any other host, specify the hostname using the -h option.

Check the port

Check that you are running securityadmin.sh against the transport port, not the HTTP port.

By default, securityadmin.sh uses 9300. If your cluster runs on a different port, use the -p option to specify the port number.

If securityadmin.sh can reach the cluster, but can’t update the configuration, it outputs this error:

• If this works, check your cluster name as well as the hostnames in your SSL certificates. If this does not work, try running securityadmin.sh with --diagnose and see diagnose trace log file.

By default, securityadmin.sh uses opensearch as the cluster name.

If your cluster has a different name, you can either ignore the name completely using the -icl option or specify the name using the option.

Check hostname verification

By default, securityadmin.sh verifies that the hostname in your node’s certificate matches the node’s actual hostname.

By default, securityadmin.sh only executes if the cluster state is at least yellow.

If your cluster state is red, you can still execute securityadmin.sh, but you need to add the -arc option.

Check the security index name

By default, the security plugin uses .opendistro_security as the name of the configuration index. If you configured a different index name in opensearch.yml, specify it using the -i option.

If the TLS certificate used to start securityadmin.sh isn’t an admin certificate, the script outputs:

You must use an admin certificate when executing the script. To learn more, see .

The script prints the location of the generated diagnostic file.