Elasticsearch crashes (SIGILL in libvec.so) on kNN search when the VM/hypervisor hides AVX flags

TL;DR

For "library whenever a kNN search ran on a densevector field. The hserr log showed the crash inside": check that AVX2/AVX-512 is actually exposed at every layer: bare metal, hypervisor/VM, and container (lscpu flags inside the container must show avx/avx2/avx512).

library whenever a kNN search ran on a dense_vector field. The hs_err log showed the crash inside

Steps

1. Check that AVX2/AVX-512 is actually exposed at every layer: bare metal, hypervisor/VM, and container (lscpu flags inside the container must show avx/avx2/avx512). If your hypervisor hides those flags, either enable them in the hypervisor/VM config or start Elasticsearch with the native vector library disabled: -Dorg.elasticsearch.nativeaccess.enableVectorLibrary=false. An Elastic maintainer confirmed the fix direction is to make Elasticsearch fall back gracefully with a warning instead of crashing when the OS-level flags are missing.

Expected: An Elastic maintainer confirmed the fix direction is to make Elasticsearch fall back gracefully with a warning instead of crashing when the OS-level flags are missing.

When to use

You are seeing this: Elasticsearch 8.17.4 in Docker (OpenJDK 23, Ubuntu 20.04 container on rocky-linux host) crashed with a SIGILL in the native libvec.so library whenever a kNN search ran on a dense_vector field. Use this skill when you run into "Elasticsearch crashes (SIGILL in libvec.so) on kNN search when the VM/hypervisor hides AVX flags".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: Elasticsearch 8.17.4. If you are on something much newer or older, the details may have shifted.

Why this happens

Elasticsearch 8.17.4 in Docker (OpenJDK 23, Ubuntu 20.04 container on rocky-linux host) crashed with a SIGILL in the native libvec.so library whenever a kNN search ran on a dense_vector field.

In the thread Elasticsearch crashes (SIGILL in libvec.so) on kNN search when the VM/hypervisor hides AVX flags, the question was: Elasticsearch 8.17.4 in Docker (OpenJDK 23, Ubuntu 20.04 container on rocky-linux host) crashed with a SIGILL in the native libvec.so library whenever a kNN search ran on a densevector field. The hserr log showed the crash inside sqr7u_2, and startup logs reported vec_caps=2 (AVX-512 capable CPU). Elastic engineers traced it to virtualization: the CPU (Intel Xeon Gold 6226) supports AVX2/AVX-512, but the hypervisor/VM did not expose those flags to the container OS, so the vector library issued instructions the environment could not execute. The verified resolution: Check that AVX2/AVX-512 is actually exposed at every layer: bare metal, hypervisor/VM, and container (lscpu flags inside the container must show avx/avx2/avx512). If your hypervisor hides those flags, either enable them in the hypervisor/VM config or start Elasticsearch with the native vector library disabled: -Dorg.elasticsearch.nativeaccess.enableVectorLibrary=false. An Elastic maintainer confirmed the fix direction is to make Elasticsearch fall back gracefully with a warning instead of crashing when the OS-level flags are missing. Original discussion: https://vectle.com/threads/thr_Hbr1HBHAFD8K9qXf6kYU9Q