diff --git a/elasticsearch/x-pack/shield/bin/xpack/esusers b/elasticsearch/x-pack/shield/bin/xpack/esusers
index 50d7d522c34..732e9d0c8a8 100755
--- a/elasticsearch/x-pack/shield/bin/xpack/esusers
+++ b/elasticsearch/x-pack/shield/bin/xpack/esusers
@@ -125,6 +125,14 @@ export HOSTNAME=`hostname -s`
 # include shield jars in classpath
 ES_CLASSPATH="$ES_CLASSPATH:$ES_HOME/plugins/xpack/*"
 
+# don't let JAVA_TOOL_OPTIONS slip in (e.g. crazy agents in ubuntu)
+# works around https://bugs.launchpad.net/ubuntu/+source/jayatana/+bug/1441487
+if [ "x$JAVA_TOOL_OPTIONS" != "x" ]; then
+    echo "Warning: Ignoring JAVA_TOOL_OPTIONS=$JAVA_TOOL_OPTIONS"
+    echo "Please pass JVM parameters via ES_JAVA_OPTS instead"
+    unset JAVA_TOOL_OPTIONS
+fi
+
 cd "$ES_HOME" > /dev/null
 "$JAVA" $ES_JAVA_OPTS -cp "$ES_CLASSPATH" -Des.path.home="$ES_HOME" $properties org.elasticsearch.shield.authc.esusers.tool.ESUsersTool "$@"
 status=$?
diff --git a/elasticsearch/x-pack/shield/bin/xpack/syskeygen b/elasticsearch/x-pack/shield/bin/xpack/syskeygen
index 6f29cb744b8..be326789b11 100755
--- a/elasticsearch/x-pack/shield/bin/xpack/syskeygen
+++ b/elasticsearch/x-pack/shield/bin/xpack/syskeygen
@@ -125,6 +125,14 @@ export HOSTNAME=`hostname -s`
 # include shield jars in classpath
 ES_CLASSPATH="$ES_CLASSPATH:$ES_HOME/plugins/xpack/*"
 
+# don't let JAVA_TOOL_OPTIONS slip in (e.g. crazy agents in ubuntu)
+# works around https://bugs.launchpad.net/ubuntu/+source/jayatana/+bug/1441487
+if [ "x$JAVA_TOOL_OPTIONS" != "x" ]; then
+    echo "Warning: Ignoring JAVA_TOOL_OPTIONS=$JAVA_TOOL_OPTIONS"
+    echo "Please pass JVM parameters via ES_JAVA_OPTS instead"
+    unset JAVA_TOOL_OPTIONS
+fi
+
 cd "$ES_HOME" > /dev/null
 $JAVA $ES_JAVA_OPTS -cp "$ES_CLASSPATH" -Des.path.home="$ES_HOME" $properties org.elasticsearch.shield.crypto.tool.SystemKeyTool "$@"
 status=$?
diff --git a/elasticsearch/x-pack/watcher/bin/xpack/croneval b/elasticsearch/x-pack/watcher/bin/xpack/croneval
index 228f4233760..c2561b29245 100755
--- a/elasticsearch/x-pack/watcher/bin/xpack/croneval
+++ b/elasticsearch/x-pack/watcher/bin/xpack/croneval
@@ -116,8 +116,16 @@ export HOSTNAME=`hostname -s`
 # include watcher jars in classpath
 ES_CLASSPATH="$ES_CLASSPATH:$ES_HOME/plugins/xpack/*"
 
+# don't let JAVA_TOOL_OPTIONS slip in (e.g. crazy agents in ubuntu)
+# works around https://bugs.launchpad.net/ubuntu/+source/jayatana/+bug/1441487
+if [ "x$JAVA_TOOL_OPTIONS" != "x" ]; then
+    echo "Warning: Ignoring JAVA_TOOL_OPTIONS=$JAVA_TOOL_OPTIONS"
+    echo "Please pass JVM parameters via ES_JAVA_OPTS instead"
+    unset JAVA_TOOL_OPTIONS
+fi
+
 cd "$ES_HOME" > /dev/null
 $JAVA $ES_JAVA_OPTS -cp "$ES_CLASSPATH" org.elasticsearch.watcher.trigger.schedule.tool.CronEvalTool "$@" $properties
 status=$?
 cd - > /dev/null
-exit $status
\ No newline at end of file
+exit $status