Health Check. 3002 - connect WAZUHMANGERMASTERIP:55000 (/api/check-stored-api)

[Chengding Pan]

Hi there,

I encountered the problem in the title upon entering Kibana. It worked all fine before, however, the problem suddenly occurred after the server been restarted. Do you have any idea of it?

Thanks, Cheney.

[Juan Carlos Rodríguez]

Hi Chengding,

For some reason, the stored API you used to use is no longer available. This may be due to several things. First of all, try to open Kibana in an incognito tab (in order to not yo use the stored current API cookie).
If this is how it works, delete all your cookies relating to the Kibana app.

Another reason could be that you’ve changed the API credentials, or that you’ve securitized your API (You must use https instead http). If this is the case, click on the button Go to app, and once inside, delete the configured API from the settings section.

Finally, check that your API service is active.

systemctl status wazuh-api

I hope this helps and let us know the results.

Regards,
Juan Carlos

​

[Chengding Pan]

Hi, there

Thanks for your quick response, I deleted the configured API from the settings section and error "Settings. 3005 - Wrong URL being used to connect to the Wazuh API (/api/check-api)" occurred when I tried to save a new API configuration. 

The service wazuh-api works all fine on my three manager nodes(1 master & 2 workers), however, I get "curl: (52) Empty reply from server" when I "curl -u cheney:cheney "http://192.168.1.17:55000?pretty" " on 192.168.1.17(wazuh master node IP).

What's wrong with that?

Thanks, Cheney.

Juan Carlos Rodríguez <juancarlos...@wazuh.com> 于2019年10月11日周五 下午2:25写道：

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/5b9e655a-cace-4c55-a02d-c63fa729ed5b%40googlegroups.com.

[Juan Carlos Rodríguez]

Hi Chengding,

I'll bet it's because you're trying to establish a connection with a securitized API host.

For example, if your API is secured and you try to do a curl with the HTTP protocol, you will obtain this response:

curl -u foo:bar http://localhost:55000?pretty

curl: (52) Empty reply from server

But if you try to connect using HTTPS protocol (because API is secured) you will obtain this successful response:

curl -u foo:bar -k https://localhost:55000?pretty
{
   "error": 0,
   "data": {
      "msg": "Welcome to Wazuh HIDS API",
      "api_version": "v3.10.0",
      "hostname": "master",
      "timestamp": "Fri Oct 11 2019 08:18:37 GMT+0000 (Coordinated Universal Time)"
   }
}

So what you have to do is, when you add a new host, is set the URL param with the HTTPS protocol. In your case https://192.168.1.17

I hope this helps.

Regards,
Juan Carlos

[Chengding Pan]

Hi, Juan

I followed your guide and "curl -u foo:bar -k https://localhost:55000?pretty" returns the correct response. But when I tried  to add a new API configuration with URL "https://192.168.1.17:55000", it still showed "Settings. 3005 - Wrong URL being used to connect to the Wazuh API (/api/check-api)". And the URL " https://192.168.1.17:55000 " was unreachable via web browser, either. 

Looking forward to your further advice.

Thanks, Cheney.

Juan Carlos Rodríguez <juancarlos...@wazuh.com> 于2019年10月11日周五 下午4:28写道：

--

You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/61ce95df-0847-4362-9f4d-750639dcc62f%40googlegroups.com.