Re: Wazuh Server error,

[Alex Deo]

Hi Wazuh,

I've deployed a containerized cluster of manager, indexer running on production, it was running fine for few months, however when i try accessing the dashboard it gives me this error. 

{"message":"[parent] Data too large, data for [indices:data/read/get[s]] would be [1044521804/996.1mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1044521656/996.1mb], new bytes reserved: [148/148b], usages [request=0/0b, fielddata=1796295/1.7mb, in_flight_requests=148/148b]: circuit_breaking_exception: [circuit_breaking_exception] Reason: [parent] Data too large, data for [indices:data/read/get[s]] would be [1044521804/996.1mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1044521656/996.1mb], new bytes reserved: [148/148b], usages [request=0/0b, fielddata=1796295/1.7mb, in_flight_requests=148/148b]","statusCode":429,"error":"Too Many Requests"}

Please can you direct me on how to go about troubleshooting this and fixing this error? 

Your help and direction would be very much appreciated.

Thanks

Kind Regards

[hasitha.u...@wazuh.com]

Hi Alex,

As you can see from the logs, you have reached a circuit breakage exception, and you'll need to increase the Wazuh indexer heap size to improve the performance of your Wazuh indexer. The circuit_breaking_exception is a mechanism used to prevent operations from causing an OutOfMemoryError. It seems like the wash-indexer was using most of the JVM heap configured, and the total memory required for all operations was superior to the memory available. Edit the /etc/wazuh-indexer/jvm.options to increase the JVM heap size. The recommended value is half of the system RAM. For example, set the size as follows for a system with 8 GB of RAM (reference):

-Xms4g

-Xmx4g

Where the total heap space:

-Xms4g - initial size is set to 4Gb of RAM.

-Xmx4g - maximum size is to 4Gb of RAM

Restart the Wazuh indexer and dashboard service:

• systemctl daemon-reload

• systemctl restart wazuh-indexer

• systemctl restart wazuh-dashboard

If the issue persists, kindly assist with the below information for further troubleshooting:

Wazuh dashboard & Indexer logs:

• journalctl -u wazuh-dashboard | grep -i -E "error|warn"
• cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn"

Let me know the update on this. So we can check further.

[hasitha.u...@wazuh.com]

Hi Alex,

So glad to hear your issue has been resolved! Just a small heads up, when you reply could you please make sure to hit Reply All so that everyone on the thread can also see the steps and benefit from the solution!

[Alex Deo]

Hi Hasitha,

The issue with was fixed by increasing heap size to 2gb given i have 4gb system.

However, another issue came up when loading the dashboard, no data is showing on the dashboard, and i got this error.

I'm thinking it might be an indexer issue not having enough ram, but i only have 3 agent so this might not be the case.

Please if you could help me or direct me how to troubleshoot this issue, let me know if you need me to provide any logs.

Thanks

 

--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/4263a173-6367-406e-8aa9-16470c8d2334n%40googlegroups.com.