Install DataStax Enterprise (DSE) 6.8 with a binary tarball

You can use a binary tarball to install DataStax Enterprise (DSE) 6.8 on bare metal or a virtual machine (VM) running a supported Linux platform. When installed from a tarball, DSE runs as a standalone process, with or without root permissions.

For other installation options, see Choose an installation method.

When you install DSE, it creates a cassandra superuser role in the database, and DSE runs as this user. Don’t use the default cassandra role in production because it is a security risk. Instead, create a new superuser role for running DSE.

Prepare the environment

Prepare an environment where you want to install DSE, including sufficient hardware and a supported platform.
For RHEL-compatible platforms, enable Extra Packages for Enterprise Linux (EPEL).
Install a supported Java runtime: OpenJDK (recommended) or Oracle Java SE (JDK).

Java 11 can be used for core (transactional) workloads in DSE 6.8.22 and later. Java 8 is required for advanced workloads in all 6.8 patch releases.

If you install both Java 8 and Java 11, set your $JAVA_HOME environment variable to Java 11. Otherwise, set $JAVA_HOME to Java 8.
Install a supported Python version for CQL shell: Python 3.8 to 3.11.
For production installations and simulated production test environments, review the recommended settings.

Some settings can be applied before installing DSE. For settings that require a running DSE instance, plan to apply them after the installation.
Install the libaio package:
RHEL
sudo yum install libaio
Debian
sudo apt-get install libaio1
Ubuntu 24.04 or later
sudo apt-get install libaio1t64
On Ubuntu 24.04 and later, the libaio library was renamed to libaio1t64. DSE requires a symlink from the old library name to the new one to detect it properly. Without this link, DSE issues a warning about the missing library and performance is significantly degraded.
sudo ln -s /lib/x86_64-linux-gnu/libaio.so.1t64 /lib/x86_64-linux-gnu/libaio.so.1
Install GnuPG (GPG), which is used to verify the integrity and authenticity of the downloaded DSE tarball.

To check if GPG is installed, run gpg --version.

Download the DSE tarball from IBM Fix Central

Get access to download DSE from IBM Fix Central:

An IBMid account with MFA enabled is required. If you don’t have one, create an IBMid account. If your organization uses Enterprise Federation (EF) for authentication with corporate credentials, see the IBMid EF documentation.
Find DSE 6.8 on IBM Fix Central:
1. Go to Fix Central.
2. In the Product selector field, begin typing IBM DataStax Enterprise, and then select that option from the menu.
3. In the Release field, select the version that you want to install.
4. Click Continue.
5. On the Identify fixes page, click Continue to use the default Browse for fixes option.
6. On the Select fixes page, select the fix pack (DSE version) you want to install, and then click Continue.
  
  Depending on the product and version, more fix packs might be available if you set the Platform filter to All, and then click Submit.
7. If prompted, sign in with your IBMid.
  
  An IBMid account with MFA enabled is required. If you don’t have one, create an IBMid account. If your organization uses Enterprise Federation (EF) for authentication with corporate credentials, see the IBMid EF documentation.
8. On the Download options page, select Download using your browser (HTTPS), and then click Continue.
9. Review the terms and conditions, and then click I agree to activate the download links.
Find the tarball download link for your DSE 6.8 patch release.

For new deployments, DataStax recommends the latest patch release. If you are scaling an existing deployment, install the same patch release as the existing nodes. For a summary of features and changes in each release, see the DSE 6.8 release notes.
- DSE 6.8.65 or later: Fix packs are distributed as zip files that follow the naming convention dse-VERSION-tgz.zip, such as dse-6.8.65-tgz.zip. To download an installation file for version 6.8.65 or later, click the relevant dse-VERSION-tgz.zip link.
- DSE 6.8.64 or earlier: Fix packs are distributed as tarball files that follow the naming convention dse-VERSION-bin.tar.gz, such as dse-6.8.64-bin.tar.gz. To download an installation file for version 6.8.64 or earlier, click the relevant dse-VERSION-bin.tar.gz link.

Unarchive the DSE tarball

DSE 6.8.65 or later: Unzip the downloaded fix pack:

sudo unzip dse-VERSION-tgz.zip -d INSTALL_DIRECTORY

The unzipped directory contains the following files:

dse-VERSION-bin.tar.gz.cosign.sig
dse-VERSION-bin.tar.gz.asc
dse-VERSION-bin.tar.gz
cqlsh-VERSION-bin.tar.gz.cosign.sig
cqlsh-VERSION-bin.tar.gz.asc
cqlsh-VERSION-bin.tar.gz

Extract the dse-VERSION-bin.tar.gz file into the directory where you want to install DSE:
```
sudo tar -xzvf dse-VERSION-bin.tar.gz -C INSTALL_DIRECTORY
```
The files are extracted into a subdirectory named dse-VERSION with the following structure:
```
> bin
> licenses
ds_branch.txt
> javadoc
README.md
> clients
> resources
LICENSE.txt
ds_timestamp.txt
> demos
> tools
> lib
ds_version.txt
```
The installation includes the CQL shell (cqlsh) automatically; you don’t need to unpack the cqlsh-VERSION-bin.tar.gz file.

Validate tarball signatures

Your DSE tarball installation files include one DSE binary tarball, one CQL shell (cqlsh) binary tarball, two GPG signature files in ASCII armored format (.asc), and two Cosign signature files in binary format (.cosign.sig). Optionally, you can validate the signatures.

Validate the GPG signature

Extract the dse-VERSION-bin.tar.gz.asc file:
```
sudo tar -xzvf dse-VERSION-bin.tar.gz.asc
```

Use GPG to import the package signature armored public key:

gpg --import dse-package-signing.pub.asc

Make sure the output matches the expected key number (425D217E4288511D) and name (DataStax Enterprise Database psirt@us.ibm.com):

gpg: directory '/home/jenkins/.gnupg' created
gpg: keybox '/home/jenkins/.gnupg/pubring.kbx' created
gpg: /home/jenkins/.gnupg/trustdb.gpg: trustdb created
gpg: key 425D217E4288511D: public key "DataStax Enterprise Database <psirt@us.ibm.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1

Optional: Trust the imported key:
```
gpg --edit-key "DataStax Enterprise Database"
```
At the prompts enter trust, select a trust level, and then enter quit. Trust levels include 5 (ultimate trust, use with caution), 4 (full trust), and 3 (marginal trust).

Validate the packages:

gpg --verify dse-VERSION-bin.tar.gz.asc dse-VERSION-bin.tar.gz

If you trusted the imported key, then the output indicates a good signature and the trust level:

gpg: Signature made Tue Mon Day 08:19:31 2026 UTC
gpg:                using RSA key 425D217E4288511D
gpg: Good signature from "DataStax Enterprise Database <psirt@us.ibm.com>" [ultimate]

If you didn’t trust the imported key, then the output shows a warning. Make sure the key number and name are the same as the earlier output.

gpg: Signature made Day Mon Year 08:19:31 2026 UTC
gpg:                using RSA key 425D217E4288511D
gpg: Good signature from "DataStax Enterprise Database <psirt@us.ibm.com>" [ultimate]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: XXXX XXXX XXXX XXXX XXXX  XXXX XXXX XXXX XXXX XXXX

You can use gpg --edit-key to trust the key at this time if you didn’t do so before.

Validate the Cosign signature

Use OpenSSL to validate cosign signatures using the certificate. This method allows you to check the package signature against the public key inside the certificate as well as the chain of trust of the certificate.

Validate package signatures, replacing VERSION with your DSE version number, such as 6.8.65:

openssl dgst -verify <(openssl x509 -in dse-package-signing.pem.cer -pubkey -noout) \
  -keyform PEM -sha256 -signature dse-VERSION-bin.tar.gz.cosign.sig -binary dse-VERSION-bin.tar.gz

Make sure the output is similar to Verified OK.

Validate the certificate chain:

openssl verify -CAfile dse-package-signing.pem.chain dse-package-signing.pem.cer

Make sure the output is similar to dse-package-signing.pem.cer: OK.

Configure DSE data and log directories

Before starting DSE for the first time, you must create and assign ownership to the DSE data and log directories.

DSE uses the default data and log directory locations unless otherwise configured in cassandra.yaml before startup.

Use default directories

Create DSE data and log directories at the default locations:
```
sudo mkdir -p /var/lib/cassandra /var/log/cassandra
```
Assign ownership to the data and log directories.

To run DSE as a different user, replace cassandra:cassandra with that user and group.
```
sudo chown -R cassandra:cassandra /var/lib/cassandra /var/log/cassandra
```

Use custom directories

Create DSE data and log directories in your preferred locations, specifying the absolute path for each directory:

sudo mkdir -p \
  PATH_TO_CUSTOM_DIRECTORY/dse-data/commitlog \
  PATH_TO_CUSTOM_DIRECTORY/dse-data/saved_caches \
  PATH_TO_CUSTOM_DIRECTORY/dse-data/hints \
  PATH_TO_CUSTOM_DIRECTORY/dse-data/metadata \
  PATH_TO_CUSTOM_DIRECTORY/cdc_raw

Assign ownership to your data and log directories.

To run DSE as a different user, replace cassandra:cassandra with that user and group.
```
sudo chown -R cassandra:cassandra \
  PATH_TO_CUSTOM_DIRECTORY/dse-data \
  PATH_TO_CUSTOM_DIRECTORY/cdc_raw
```

In cassandra.yaml, set the following directory parameters to your custom directory paths.

For tarball installations, the default location of the cassandra.yaml file is INSTALL_DIRECTORY/resources/cassandra/conf.

data_file_directories:
  - PATH_TO_CUSTOM_DIRECTORY/dse-data
commitlog_directory: PATH_TO_CUSTOM_DIRECTORY/dse-data/commitlog
saved_caches_directory: PATH_TO_CUSTOM_DIRECTORY/dse-data/saved_caches
hints_directory: PATH_TO_CUSTOM_DIRECTORY/dse-data/hints
metadata_directory: PATH_TO_CUSTOM_DIRECTORY/dse-data/metadata
cdc_raw_directory: PATH_TO_CUSTOM_DIRECTORY/cdc_raw

In dse-env.sh, set CASSANDRA_LOG_DIR to the absolute path to your custom log directory.

For tarball installations, the default location of the dse-env.sh file is INSTALL_DIRECTORY/bin.
```
export CASSANDRA_LOG_DIR="PATH_TO_CUSTOM_DIRECTORY"
```
You can also change log locations after installation. For more information about this environment variable and configuring the log location, see Changing logging locations.

Configure DSE Analytics data and log directories

If you plan to use DSE Analytics, you must create and assign ownership to the Spark data and log directories before starting DSE.

When you enable DSE Analytics, the Spark components write temporary data and logs to the default Spark data and log directory locations unless otherwise configured in spark-env.sh or dse.yaml before startup.

Use default directories

Create Spark data and log directories at the default locations:

sudo mkdir -p \
  /var/lib/dsefs \
  /var/lib/spark \
  /var/lib/spark/rdd \
  /var/lib/spark/worker \
  /var/log/spark \
  /var/log/spark/master \
  /var/log/spark/alwayson_sql

Assign ownership to the data and log directories.

To run DSE as a different user, replace cassandra:cassandra with that user and group.
```
sudo chown -R cassandra:cassandra /var/lib/dsefs /var/lib/spark /var/log/spark
```

Use custom directories

Create Spark data and log directories in your preferred locations, specifying the absolute path for each directory:

sudo mkdir -p \
  PATH_TO_CUSTOM_DIRECTORY/dsefs \
  PATH_TO_CUSTOM_DIRECTORY/spark/rdd \
  PATH_TO_CUSTOM_DIRECTORY/spark/worker \
  PATH_TO_CUSTOM_DIRECTORY/spark/log/worker \
  PATH_TO_CUSTOM_DIRECTORY/spark/log/master \
  PATH_TO_CUSTOM_DIRECTORY/spark/log/alwayson_sql

Assign ownership to your data and log directories.

To run DSE as a different user, replace cassandra:cassandra with that user and group.
```
sudo chown -R cassandra:cassandra \
  PATH_TO_CUSTOM_DIRECTORY/dsefs \
  PATH_TO_CUSTOM_DIRECTORY/spark
```

In spark-env.sh, set the following environment variables to your custom spark directory paths.

For tarball installations, the default location of the spark-env.sh file is INSTALL_DIRECTORY/resources/spark/conf.

export SPARK_WORKER_DIR="PATH_TO_CUSTOM_DIRECTORY/spark/worker"
export SPARK_EXECUTOR_DIRS="PATH_TO_CUSTOM_DIRECTORY/spark/rdd"
export SPARK_WORKER_LOG_DIR="PATH_TO_CUSTOM_DIRECTORY/spark/log/worker"
export SPARK_MASTER_LOG_DIR="PATH_TO_CUSTOM_DIRECTORY/spark/log/master"
export ALWAYSON_SQL_LOG_DIR="PATH_TO_CUSTOM_DIRECTORY/spark/log/alwayson_sql"

In dse.yaml, set the dsefs_options.work_dir parameter to your custom dsefs directory path.

For tarball installations, the default location of the dse.yaml file is INSTALL_DIRECTORY/resources/dse/conf.
```
dsefs_options:
  work_dir: PATH_TO_CUSTOM_DIRECTORY/dsefs
```
For more information, see DSE file system (DSEFS).

Start DSE

Don’t start DSE if you are upgrading. Return to the upgrade guide to continue reconfiguring your upgraded node before starting DSE:

From the directory where you extracted the tarball files, start DSE as a standalone process:
```
INSTALL_DIRECTORY/bin/dse cassandra
```

Run nodetool status to verify that DSE is running:

INSTALL_DIRECTORY/bin/nodetool status

Make sure the node reports UN (Up/Normal) status:

Datacenter: Cassandra
=====================
Status=Up/Down
|/ State=Normal/Leaving/Joining/Moving
--  Address    Load       Tokens  Owns    Host ID                               Rack
UN  127.0.0.1  82.43 KB   128     ?       40725dc8-7843-43ae-9c98-7c532b1f517e  rack1

If you are deploying multiple nodes or datacenters, repeat the installation process on all nodes.