wazuh going down after a while

672 views
Skip to first unread message

Miki Alkalay

unread,
Jan 26, 2020, 4:35:14 AM1/26/20
to Wazuh mailing list
Hi team,
my server is going down after a while and i'm getting this message:

statuscode: 429 error: too many requests


please advice

Miki

Miki Alkalay

unread,
Jan 26, 2020, 4:36:25 AM1/26/20
to Wazuh mailing list
image.png

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/1de7bd0d-82fe-4d34-9c9c-73a39919afdb%40googlegroups.com.


--

Best Regards

Miki Alkalay
Mobile: 972-54-6496293

Daniel Melgarejo

unread,
Jan 27, 2020, 2:02:40 AM1/27/20
to Wazuh mailing list
Hi Miki,

I recommend you enable debug mode to know better the problem. For that, you can follow these steps:
/var/ossec/bin/ossec-control enable debug
/var/ossec/bin/ossec-control restart

You will see more messages appearing in /var/ossec/logs/ossec.log. Can you copy the error and debug messages just when the problem appears?

Regards, 
                Daniel


On Sunday, January 26, 2020 at 10:36:25 AM UTC+1, Miki Alkalay wrote:
image.png

On Sun, Jan 26, 2020 at 11:35 AM Miki Alkalay <realnet...@gmail.com> wrote:
Hi team,
my server is going down after a while and i'm getting this message:

statuscode: 429 error: too many requests


please advice

Miki

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.

Daniel Melgarejo

unread,
Jan 28, 2020, 9:46:34 AM1/28/20
to Wazuh mailing list
Hi again Miki,

It seems the requests are saturated so it is possible your CPU is saturated (you can check it with 'top' command that displays the processor activity) or the API is overloaded. 

I would like to reproduce your case to know more about the trouble. Can you copy or send me your configuration files, OS you are using, Wazuh version,...?

Regards,
               Daniel

Miki Alkalay

unread,
Jan 28, 2020, 10:17:57 AM1/28/20
to Daniel Melgarejo, Wazuh mailing list
Hey,
i solved the problem:
1. increased the indices.breaker.request.limit to 60%
2. curl -XPUT localhost:9200/_cluster/settings -d '{
  "persistent" : {
    "indices.breaker.request.limit" : "60%" 
  }
}'
3. increased the heap size of the java to 4GB --> jason.config
tnx
Miki

On Tue, Jan 28, 2020 at 4:46 PM Daniel Melgarejo <daniel.m...@wazuh.com> wrote:
Hi again Miki,

It seems the requests are saturated so it is possible your CPU is saturated (you can check it with 'top' command that displays the processor activity) or the API is overloaded. 

I would like to reproduce your case to know more about the trouble. Can you copy or send me your configuration files, OS you are using, Wazuh version,...?

Regards,
               Daniel


On Monday, January 27, 2020 at 8:02:40 AM UTC+1, Daniel Melgarejo wrote:
Hi Miki,

I recommend you enable debug mode to know better the problem. For that, you can follow these steps:
/var/ossec/bin/ossec-control enable debug
/var/ossec/bin/ossec-control restart

You will see more messages appearing in /var/ossec/logs/ossec.log. Can you copy the error and debug messages just when the problem appears?

Regards, 
                Daniel


On Sunday, January 26, 2020 at 10:36:25 AM UTC+1, Miki Alkalay wrote:
image.png

On Sun, Jan 26, 2020 at 11:35 AM Miki Alkalay <realnet...@gmail.com> wrote:
Hi team,
my server is going down after a while and i'm getting this message:

statuscode: 429 error: too many requests


please advice

Miki

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.


--

Best Regards

Miki Alkalay
Mobile: 972-54-6496293

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/b14c25fa-3806-4232-a307-fd587febed50%40googlegroups.com.

Daniel Melgarejo

unread,
Jan 28, 2020, 10:53:11 AM1/28/20
to Wazuh mailing list
Hi Miki,

I am glad that you solved it.

Please do not hesitate to contact us to share more questions.

Regards,
              Daniel
image.png

To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.


--

Best Regards

Miki Alkalay
Mobile: 972-54-6496293

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
Reply all
Reply to author
Forward
0 new messages