I have been trying to install Elastic Search, I have downloaded the the elasticsearch-2.3.4.deb file. When I try to use the command:

sudo dpkg -i elasticsearch-1.7.2.deb

It outputs this error:

dpkg: unrecoverable fatal error, aborting: unknown user 'elasticsearch' in statoverride file

How can I fix this?


In my case, following these steps worked:

  • Begin by completely uninstalling any Elasticsearch instances on your machine:

    apt remove --purge elasticsearch
    apt autoremove
  • Then, open the /var/lib/dpkg/statoverride file in your editor and remove lines mentioning the elasticsearch user.

It's not an ideal solution because it involves manually editing files which are normally modified only by dpkg itself, but running dpkg-reconfigure and apt --reinstall install didn't work for me; this was a last resort.

  • 2
    'apt autoremove' was not necessary, editing statoverride did the trick – user1007727 Nov 11 '16 at 11:37
  • @user1007727 Thanks! Good to have an extra datapoint. I'm leaving in the autoremove invocation anyway because it was required for me (IIRC), and it helps unclutter the system worst case. – Jules Nov 11 '16 at 17:02

open the file


you should see something like:

root elasticsearch 755 /var/log/elasticsearch


root elasticsearch 755 /var/lib/elasticsearch

if so, run dpkg-statoverride --remove:

dpkg-statoverride --remove /var/log/elasticsearch
dpkg-statoverride --remove /var/lib/elasticsearch

I just need

sudo dpkg-statoverride --remove /var/lib/elasticsearch
sudo dpkg-statoverride --remove /var/log/elasticsearch

The issue for me was that I renamed the default user to fall in line with my naming scheme on my server.

I resolved this issue by editing the


file and replacing the old name with the new. No need to uninstall the application.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.