Error Generating and Downloading Report

[Musakkarul Lambatjing]

Hi,

I tried create report using visualize, and then i want to download the report, with pdf type.

but it keep getting error like below.

could you please help?

thanks.

Musakkarul

[Federico Rodriguez]

Hi, thanks for using Wazuh!
Could you please share what version of Wazuh plugin for Kibana / Wazuh Dashboard are you using? You can see it in Settings/About or see the package.json of Wazuh plugin in /usr/share/kibana/plugins/wazuh/package.json



Also, it would be useful to share Kibana / Wazuh Dashboard output, please run the following commands and share the output:

journalctl -r -u wazuh-dashboard | grep -i -E "error|critical|warning|fatal"
journalctl -r -u wazuh-indexer | grep -i -E "error|critical|warning|fatal"


In case you are using Kibana - Elasticsearch:

journalctl -r -u kibana | grep -i -E "error|critical|warning|fatal"
journalctl -r -u elasticsearch | grep -i -E "error|critical|warning|fatal"


Best regards

[Musakkarul Lambatjing]

Hi Federico,

i'm using wazuh 4.3.5 version. and it seems doesn't shows the about section like you have.

i've tried your journactl command here's it shows.

journalctl -r -u wazuh-dashboard | grep -i -E "error|critical|warning|fatal"

i think this is only error of SSL certificates, which i acknowledged it.

journalctl -r -u wazuh-indexer | grep -i -E "error|critical|warning|fatal"

Jul 07 11:23:07 siem.lippoinsurance.com systemd-entrypoint[22062]: WARNING: All illegal access operations will be denied in a future release
Jul 07 11:23:07 siem.lippoinsurance.com systemd-entrypoint[22062]: WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
Jul 07 11:23:07 siem.lippoinsurance.com systemd-entrypoint[22062]: WARNING: Please consider reporting this to the maintainers of io.protostuff.runtime.PolymorphicThrowableSchema
Jul 07 11:23:07 siem.lippoinsurance.com systemd-entrypoint[22062]: WARNING: Illegal reflective access by io.protostuff.runtime.PolymorphicThrowableSchema (file:/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/protostuff-runtime-1.7.4.jar) to field java.lang.Throwable.cause
Jul 07 11:23:07 siem.lippoinsurance.com systemd-entrypoint[22062]: WARNING: An illegal reflective access operation has occurred
Jul 07 08:24:50 siem.lippoinsurance.com systemd-entrypoint[15082]: WARNING: All illegal access operations will be denied in a future release
Jul 07 08:24:50 siem.lippoinsurance.com systemd-entrypoint[15082]: WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
Jul 07 08:24:50 siem.lippoinsurance.com systemd-entrypoint[15082]: WARNING: Please consider reporting this to the maintainers of io.protostuff.runtime.PolymorphicThrowableSchema
Jul 07 08:24:50 siem.lippoinsurance.com systemd-entrypoint[15082]: WARNING: Illegal reflective access by io.protostuff.runtime.PolymorphicThrowableSchema (file:/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/protostuff-runtime-1.7.4.jar) to field java.lang.Throwable.cause
Jul 07 08:24:50 siem.lippoinsurance.com systemd-entrypoint[15082]: WARNING: An illegal reflective access operation has occurred
Jul 06 11:40:07 siem.lippoinsurance.com systemd-entrypoint[3607]: WARNING: All illegal access operations will be denied in a future release
Jul 06 11:40:07 siem.lippoinsurance.com systemd-entrypoint[3607]: WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
Jul 06 11:40:07 siem.lippoinsurance.com systemd-entrypoint[3607]: WARNING: Please consider reporting this to the maintainers of io.protostuff.runtime.PolymorphicThrowableSchema
Jul 06 11:40:07 siem.lippoinsurance.com systemd-entrypoint[3607]: WARNING: Illegal reflective access by io.protostuff.runtime.PolymorphicThrowableSchema (file:/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/protostuff-runtime-1.7.4.jar) to field java.lang.Throwable.cause
Jul 06 11:40:07 siem.lippoinsurance.com systemd-entrypoint[3607]: WARNING: An illegal reflective access operation has occurred

Best Regards,

[Federico Rodriguez]

Hi Musakkarul, thanks for your patience. Unfortunately in the logs print screen I'm not able to see if there are more logs related to this issue. 
It is probable that you need to install a few required dependencies to make it work. We are working on a documentation article to explain this matter.
In the meantime, please take a look at this guide: 
https://github.com/opensearch-project/dashboards-reports/blob/main/dashboards-reports/rendering-engine/headless-chrome/README.md#additional-libaries

Hope it helps, don't hesitate to ask again if you need further assistance.

Regards

[Musakkarul Lambatjing]

Hi Federico,

sorry for late reply, i've just found the issue.

that i need to install the chromium first so report can generated without error.

but i just wondering, is there any way to custom wazuh report such as logo header, name and etc?

looking forward hearing from you soon.

Thanks.

[Juan Carlos Tello]

Hi Musakkarul,

I'm glad you were able to resolve the initial issue.

You may change the reports' logo by going into the Wazuh Dashboard application and selecting Wazuh → Settings → Configuration and scrolling to the bottom of where you'll find a field to specify the new logo file.

The paths are relative to your filesystem's /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/ folder

In order to change other options such as the report's header and footer text you can directly edit the /usr/share/wazuh-dashboard/plugins/wazuh/common/constants.js file.

This file may be overwritten with each update so you may have to redo the changes after every upgrade.

Let us know if there's anything else we can help with,

Best Regards,

Juan C. Tello

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/0aff6294-0c2c-4980-9ef4-9446348a2c03n%40googlegroups.com.

[swapnils]

Hello..

Even I am facing the same issue. Sorry if I am hijacking this thread; but I am completely new to Wazuh and this community.

Reports work well when fetched from Wazuh module itself but using opensearch visualize/dashboard, it fails. When I click 'pdf' icon, logs I get under wazuh-dashboard:/var/log/wazuh-dashboard/opensearch.log are -

---

{"type":"log","@timestamp":"2022-09-22T12:46:00Z","tags":["error","plugins","reportsDashboards"],"pid":101223,"message":"Failed to generate report by id: Error: Protocol error (Target.setDiscoverTargets): Target closed."}

{"type":"log","@timestamp":"2022-09-22T12:46:00Z","tags":["error","plugins","reportsDashboards"],"pid":101223,"message":"{ Error: Protocol error (Target.setDiscoverTargets): Target closed.\n    at Promise (/usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/puppeteer-core/lib/Connection.js:74:56)\n    at new Promise (<anonymous>)\n    at Connection.send (/usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/puppeteer-core/lib/Connection.js:73:12)\n    at Function.create (/usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/puppeteer-core/lib/Browser.js:34:22)\n    at Launcher.launch (/usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/puppeteer-core/lib/Launcher.js:183:37)\n    at process._tickCallback (internal/process/next_tick.js:68:7)\n  message: 'Protocol error (Target.setDiscoverTargets): Target closed.' }"}

{"type":"error","@timestamp":"2022-09-22T12:46:00Z","tags":[],"pid":101223,"level":"error","error":{"message":"Internal Server Error","name":"Error","stack":"Error: Internal Server Error\n    at HapiResponseAdapter.toError (/usr/share/wazuh-dashboard/src/core/server/http/router/response_adapter.js:145:19)\n    at HapiResponseAdapter.toHapiResponse (/usr/share/wazuh-dashboard/src/core/server/http/router/response_adapter.js:99:19)\n    at HapiResponseAdapter.handle (/usr/share/wazuh-dashboard/src/core/server/http/router/response_adapter.js:94:17)\n    at Router.handle (/usr/share/wazuh-dashboard/src/core/server/http/router/router.js:164:34)"},"url":{"protocol":null,"slashes":null,"auth":null,"host":null,"port":null,"hostname":null,"hash":null,"search":"?timezone=Asia%2FKolkata&dateFormat=MMM%20D%2C%20YYYY%20%40%20HH%3Amm%3Ass.SSS&csvSeparator=%2C","query":{"timezone":"Asia/Kolkata","dateFormat":"MMM D, YYYY @ HH:mm:ss.SSS","csvSeparator":","},"pathname":"/api/reporting/generateReport/8Cl9ZIMBiyEdh9iqzhJT","path":"/api/reporting/generateReport/8Cl9ZIMBiyEdh9iqzhJT?timezone=Asia%2FKolkata&dateFormat=MMM%20D%2C%20YYYY%20%40%20HH%3Amm%3Ass.SSS&csvSeparator=%2C","href":"/api/reporting/generateReport/8Cl9ZIMBiyEdh9iqzhJT?timezone=Asia%2FKolkata&dateFormat=MMM%20D%2C%20YYYY%20%40%20HH%3Amm%3Ass.SSS&csvSeparator=%2C"},"message":"Internal Server Error"}

{"type":"response","@timestamp":"2022-09-22T12:46:00Z","tags":[],"pid":101223,"method":"get","statusCode":500,"req":{"url":"/api/reporting/generateReport/8Cl9ZIMBiyEdh9iqzhJT?timezone=Asia%2FKolkata&dateFormat=MMM%20D%2C%20YYYY%20%40%20HH%3Amm%3Ass.SSS&csvSeparator=%2C","method":"get","headers":{"host":"172.30.58.37","user-agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0","accept":"*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate, br","referer":"https://172.30.58.37/app/reports-dashboards","content-type":"application/json","osd-version":"1.2.0","connection":"keep-alive","sec-fetch-dest":"empty","sec-fetch-mode":"cors","sec-fetch-site":"same-origin"},"remoteAddress":"172.27.12.13","userAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0","referer":"https://172.30.58.37/app/reports-dashboards"},"res":{"statusCode":500,"responseTime":118,"contentLength":9},"message":"GET /api/reporting/generateReport/8Cl9ZIMBiyEdh9iqzhJT?timezone=Asia%2FKolkata&dateFormat=MMM%20D%2C%20YYYY%20%40%20HH%3Amm%3Ass.SSS&csvSeparator=%2C 500 118ms - 9.0B"}

---

Appreciate your help on this. Also I have noticed that above "@timestamp" is different than what I have on by dashboard box. My current setup is distributed where there are 2 wazuh-server, 2 wazuh-indexer & 1 wazuh-dashboard.

Reports generated with Wazuh module are residing under /usr/share/wazuh-dashboard/data/wazuh/downloads/reports/admin but visualization reports are nowhere seen.

Thanks!