Wazuh app issues on kibana 6 setting up api

[ramzey...@gmail.com]

i have elasticsearch setup in a distributed environment and currently setup kibana so that the dashboard fires up using the ip:port combination. the wazuh-alerts index shows data but my problem is the with the wazuh app. 

when i configure the app to add an api here is the error i get on the api log 

WazuhAPI 2017-12-13 20:07:46: [::ffff:172.16.99.55] GET /cluster/status? - 404 - error: '603'.

and here is what google developer tools shows me for request headers and such notice cluster info is blank?

1. {user: "ramesh", password: "mypasswordhere", url: "http://172.16.99.9", port: "55000", cluster_info: {},…}
1. active:"true"
2. cluster_info:{}
3. id:0
4. insecure:"true"
5. password:"mypasswordhere"
6. port:"55000"
7. url:"http://172.16.99.9"
8. user:"ramesh"

POST http://172.16.99.55:5601/api/wazuh-api/checkAPI 500 (Internal Server Error)

(anonymous) @ VM1467:1

(anonymous) @ commons.bundle.js?v=16070:38

sendReq @ commons.bundle.js?v=16070:38

serverRequest @ commons.bundle.js?v=16070:38

processQueue @ commons.bundle.js?v=16070:39

(anonymous) @ commons.bundle.js?v=16070:39

$digest @ commons.bundle.js?v=16070:39

$apply @ commons.bundle.js?v=16070:39

(anonymous) @ commons.bundle.js?v=16070:43

dispatch @ commons.bundle.js?v=16070:28

elemData.handle @ commons.bundle.js?v=16070:28

the resonse header is this 

{"statusCode":500,"error":5,"message":"Error occurred"}

[ramzey...@gmail.com]

Please ignore this, this was resolved. 

thanks 

[Juan Ezquerro LLanes]

I have installed the latest version of Wazuh and I have this problem.

The API configuration is unable to save the data:

POST http://52.208.12.52:5601/api/wazuh-api/checkAPI 500 (Internal Server Error)

[jua...@wazuh.com]

Hi Juan,

When you insert the API credentials on the form and press the "Save" button, is any kind of error message showing on the Wazuh App interface? Check near the "Save" button or in the top of the screen.

Also, please check if the API is running with the following command:

curl -u <api_user>:<api_password> -XGET "localhost:55000/?pretty"

And finally, please open the developer console of your Internet browser and send me the output of the message next to the name of the function (colored in red). You can see an example screenshot of how to do this on Google Chrome:

I hope we'll get a solution for your problem.

Best regards and Happy New Year!

Juanjo

[Juan Ezquerro LLanes]

More data:

{statusCode: 500, error: 5, message: "The requested URL was not found on this server"}

kbn-version:6.1.1

El miércoles, 3 de enero de 2018, 15:07:59 (UTC+1), Juan Ezquerro LLanes escribió:

[Juan Ezquerro LLanes]

# curl -u XXX:XXX -XGET "localhost:55000/?pretty"

{

   "error": 0,

   "data": "Welcome to Wazuh HIDS API"

[jua...@wazuh.com]

Hi again Juan,

Could yo please paste the exact URL that gives you the "The requested URL was not found on this server" POST error?

Also, please paste the content of the Headers, Response and Preview sub-tabs from the Network/XHR (Network traffic) tab on the developer console from your Internet browser (in the case of Google Chrome).

Best regards,

Juanjo

[Juan Ezquerro LLanes]

Hi Juanjo,

URL: http://52.208.12.52:5601/api/wazuh-api/checkAPI

[jua...@wazuh.com]

Hi again Juan, sorry for the late response.

According to the error message you're having, it looks like the Wazuh App cannot communicate correctly with the Wazuh API.

1. First, we need to know if you're using a single-host architecture or a distributed one. Wazuh needs to use some TCP/UDP ports and they need to be allowed if you're using a firewall system. The Wazuh App uses the 55000 port, Elasticsearch the 9200 port, and Kibana de 5601 port (all of them by default). Even on a single-host architecture is important to open the necessary ports.

2. Then, please execute the following command to see the status of Elasticsearch and Kibana and see if there's some kind of log or error messages:

  systemctl status elasticsearch -l

  systemctl status kibana -l

3. Please make ping and curl to the exact IP of the Wazuh API:

  ping <wazuh_api_ip>:55000

  curl -u <api_user>:<api_password> -XGET <api_ip>:55000?pretty

4. Now we're gonna delete all the Kibana and Wazuh App configuration files. Keep in mind this operation will delete all your custom Dashboards and Kibana visualizations, and also will delete the Wazuh App configuration.

    1. First, stop Kibana and Logstash:

    systemctl stop kibana

    systemctl stop logstash

    2. Delete the Kibana and Wazuh App files:

    curl -XDELETE localhost:9200/.kibana

    curl -XDELETE localhost:9200/.wazuh

    curl -XDELETE localhost:9200/.wazuh-version

    3. Delete the Kibana optimization files. Don't worry about this, they will be re-generated when you restart Kibana:

        rm -rf /usr/share/kibana/optimize/bundles

    4. Restart Logstash and Kibana (Kibana will take longer to restart due to the regeneration of the optimizing bundles):

    systemctl restart logstash

    systemctl restart kibana

    5. Now open an incognito window of your Internet browser (to avoid possible issues related to cookies or cache memory) and open again the Kibana interface. On the API credentials form, make sure to put the exact IP of the machine where you have installed the Wazuh API, and press the "Save button". Everything should be working correctly now.

Please let me know if you still have some kind of problems or doubts about anything.

Best regards,

Juanjo

[Juan Ezquerro LLanes]

Hi Juanjo,

Still not working, same error. I'm running a single-host architecture.

Here is a netstat:

# netstat -tanep | grep LISTEN

tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      0          14542       1177/sshd       

tcp        0      0 0.0.0.0:5601            0.0.0.0:*               LISTEN      116        17289       1132/node       

tcp6       0      0 127.0.0.1:9200          :::*                    LISTEN      115        15077       1113/java       

tcp6       0      0 ::1:9200                :::*                    LISTEN      115        15076       1113/java       

tcp6       0      0 127.0.0.1:9300          :::*                    LISTEN      115        15038       1113/java       

tcp6       0      0 ::1:9300                :::*                    LISTEN      115        17217       1113/java       

tcp6       0      0 :::22                   :::*                    LISTEN      0          14544       1177/sshd       

tcp6       0      0 :::55000                :::*                    LISTEN      112        158414      2547/nodejs     

tcp6       0      0 127.0.0.1:9600          :::*                    LISTEN      999        15095       1138/java

I have opened port 55000 for everyone in the firewall and the error persists.

This is what is recorded in the log:

# tail -f /var/ossec/logs/api.log

WazuhAPI 2018-01-08 09:02:08: [::ffff:127.0.0.1] GET /version? - 200 - error: '0'.

WazuhAPI 2018-01-08 09:02:08: [::ffff:127.0.0.1] GET /agents/000? - 200 - error: '0'.

WazuhAPI 2018-01-08 09:02:08: [::ffff:127.0.0.1] GET /cluster/status? - 404 - error: '603'.

A curl call to the API:

# curl -u XXX:XXX -k http://127.0.0.1:55000

{"error":0,"data":"Welcome to Wazuh HIDS API"}

At syslog:

Jan  8 09:06:36 ip-172-24-24-4 kibana[1132]: {"type":"response","@timestamp":"2018-01-08T09:06:36Z","tags":[],"pid":1132,"method":"post","statusCode":500,"req":{"url":"/api/wazuh-api/checkAPI","method":"post","headers":{"host":"**.**.**.**:5601","connection":"keep-alive","content-length":"115","pragma":"no-cache","cache-control":"no-cache","accept":"application/json, text/plain, */*","origin":"http://**.**.**.**:5601","kbn-version":"6.1.1","user-agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.108 Safari/537.36","content-type":"application/json;charset=UTF-8","referer":"http://**.**.**.**:5601/app/wazuh","accept-encoding":"gzip, deflate","accept-language":"es-ES,es;q=0.9,en;q=0.8"},"remoteAddress":"**.**.**.**","userAgent":"**.**.**.**","referer":"http://**.**.**.**:5601/app/wazuh"},"res":{"statusCode":500,"responseTime":91,"contentLength":9},"message":"POST /api/wazuh-api/checkAPI 500 91ms - 9.0B"}

[Juan Ezquerro LLanes]

I run a new installation from scratch and still not working, always the same problem

[jua...@wazuh.com]

Hi again Juan, and sorry for the late response.

Thank you so much for your logs, this helps us a lot to find the cause of some errors.

According to the output of /var/ossec/logs/api.log:

WazuhAPI 2018-01-08 09:02:08: [::ffff:127.0.0.1] GET /cluster/status? - 404 - error: '603'.

The error 603 means that the API cannot find the /cluster/status URL. A working example of this API call could be the following:

# curl -u foo:bar "localhost:55000/cluster/status?pretty"

{

   "error": 0,

   "data": {

      "running": "no",

      "enabled": "yes"

   }

}

And your CURL call to the API shows that you're using Wazuh 2.1.1, since the latest release (3.1.0) has a different output, such as:

# curl -u foo:bar "localhost:55000?pretty"

{

   "error": 0,

   "data": {

      "msg": "Welcome to Wazuh HIDS API",

      "api_version": "v3.1.0",

      "hostname": "node01",

      "timestamp": "Tue Jan 09 2018 16:26:44 GMT+0100 (CET)"

   }

}

Our latest Wazuh App release works with Elastic Stack 6.1.1 and Wazuh 3.1.0. We recommend you to update to the latest version, following the steps from our upgrading guide: https://documentation.wazuh.com/current/installation-guide/upgrading/different_major.html#upgrading-different-major

Proceed with the steps in order to update your Wazuh Manager and API installation. After that, try again to save the API credentials.

Let me know if everything is working or if you're still having any kind of issues or problems.

Best regards,

Juanjo

[Juan Ezquerro LLanes]

Hi Juanjo,

I have reinstalled from scratch and this problem has been fixed.

Now I have another problem, I have not installed Filebeat because I'm using a single host architecture and it does not look like Wazuh is collecting data. 

I have reviewed the file /etc/logstash/conf.d/01-wazuh.conf and the ossec disk log is no longer referenced. 

I'm doing something wrong?

Thank you.

[Jesús Ángel González]

Hi Juan Ezquerro, as I understand you now have a fresh single-host installation and you are using Logstash that is expected

to be fetching directly the alerts.json file. 

Check if Logstash is running:

# systemctl status logstash -l  

Check if Logstash is fetching alerts.json

# yum install lsof (only if you didn't install it)
# lsof /var/ossec/logs/alerts/alerts.json

Please, paste here the output of the lsof command. Anyway you should see a java process with the user logstash 

and the ossec user too. You should see something like this:

COMMAND    PID     USER   FD   TYPE DEVICE  SIZE/OFF     NODE NAME
java       662 logstash   66r   REG  253,0 433542009 17853451 /var/ossec/logs/alerts/alerts.json
ossec-ana 6650    ossec   10w   REG  253,0 433542009 17853451 /var/ossec/logs/alerts/alerts.json

Additionally, please give us the content of the /etc/logstash/conf.d/01-wazuh.conf file. I want to check this in order to discard

that you are using a remote configuration or a wrong configuration.

# cat /etc/logstash/conf.d/01-wazuh.conf

Best regards,

Jesús.

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To post to this group, send email to wa...@googlegroups.com.
Visit this group at https://groups.google.com/group/wazuh.

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/ef111578-f691-4e97-9bb6-9cef8e62cd89%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Juan Ezquerro LLanes]

Hi Jesus

Logstash is running:

# systemctl status logstash -l  

● logstash.service - logstash

   Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: enabled)

   Active: active (running) since Wed 2018-01-10 14:28:54 UTC; 22min ago

And the lsof output is:

# lsof /var/ossec/logs/alerts/alerts.json

COMMAND    PID  USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME

ossec-ana 1690 ossec   10w   REG  202,1 21198366 1287391 /var/ossec/logs/alerts/alerts.json

The wazuh.conf content is:

# cat /etc/logstash/conf.d/01-wazuh.conf

# Wazuh - Logstash configuration file

## Remote Wazuh Manager - Filebeat input

input {

    beats {

        port => 5000

        codec => "json_lines"

#       ssl => true

#       ssl_certificate => "/etc/logstash/logstash.crt"

#       ssl_key => "/etc/logstash/logstash.key"

    }

}

filter {

    if [data][srcip] {

        mutate {

            add_field => [ "@src_ip", "%{[data][srcip]}" ]

        }

    }

    if [data][aws][sourceIPAddress] {

        mutate {

            add_field => [ "@src_ip", "%{[data][aws][sourceIPAddress]}" ]

        }

    }

}

filter {

    geoip {

        source => "@src_ip"

        target => "GeoLocation"

        fields => ["city_name", "continent_code", "country_code2", "country_name", "region_name", "location"]

    }

    date {

        match => ["timestamp", "ISO8601"]

        target => "@timestamp"

    }

    mutate {

        remove_field => [ "timestamp", "beat", "input_type", "tags", "count", "@version", "log", "offset", "type","@src_ip"]

    }

}

output {

    elasticsearch {

        hosts => ["localhost:9200"]

        index => "wazuh-alerts-3.x-%{+YYYY.MM.dd}"

        document_type => "wazuh"

    }

}

[Jesús Ángel González]

Hi again Juan, you have a wrong configuration file in Logstash. Please
execute the following commands to fix it:

Stop logstash:

# systemctl stop logstash

Overwrite with the correct configuration file:

# curl -so /etc/logstash/conf.d/01-wazuh.conf
https://raw.githubusercontent.com/wazuh/wazuh/3.0/extensions/logstash/01-wazuh-local.conf

Restart logstash:

# systemctl restart logstash

Check one more time if logstash is now fetch the alerts.json file:

# lsof /var/ossec/logs/alerts/alerts.json

Best regards,
Jesús

>>> email to wazuh+un...@googlegroups.com.

>>> To post to this group, send email to wa...@googlegroups.com.
>>> Visit this group at https://groups.google.com/group/wazuh.
>>> To view this discussion on the web visit
>>> https://groups.google.com/d/msgid/wazuh/ef111578-f691-4e97-9bb6-9cef8e62cd89%40googlegroups.com.
>>>
>>> For more options, visit https://groups.google.com/d/optout.
>>
>>

> --
> You received this message because you are subscribed to the Google Groups
> "Wazuh mailing list" group.
> To unsubscribe from this group and stop receiving emails from it, send an

> email to wazuh+un...@googlegroups.com.

> To post to this group, send email to wa...@googlegroups.com.
> Visit this group at https://groups.google.com/group/wazuh.
> To view this discussion on the web visit

> https://groups.google.com/d/msgid/wazuh/7dd61adb-582d-4c02-9436-8ab561dbcad6%40googlegroups.com.

[Jesús Ángel González]

Juan you should also add logstash user to ossec group as follow:

# usermod -a -G ossec logstash

Sorry about this forgoten step!

King regards,
Jesús

[Juan Ezquerro LLanes]

Thank you Jose, looks like it works now:

# lsof /var/ossec/logs/alerts/alerts.json

COMMAND  PID     USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME

java    1124 logstash   63r   REG  202,1 21594923 1287391 /var/ossec/logs/alerts/alerts.json

But i have 4 agents and only one is sending data.

What port should be opened in the firewall so that the data is rocojan?

Ossec-remote uses port 1514 but is not running on the server:

# netstat -tanepu | grep LIST

tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      0          13700       1104/sshd       

tcp        0      0 0.0.0.0:5601            0.0.0.0:*               LISTEN      116        16224       1146/node       

tcp6       0      0 127.0.0.1:9200          :::*                    LISTEN      115        16309       1131/java       

tcp6       0      0 ::1:9200                :::*                    LISTEN      115        16306       1131/java       

tcp6       0      0 127.0.0.1:9300          :::*                    LISTEN      115        16265       1131/java       

tcp6       0      0 ::1:9300                :::*                    LISTEN      115        16256       1131/java       

tcp6       0      0 :::22                   :::*                    LISTEN      0          13702       1104/sshd       

tcp6       0      0 :::55000                :::*                    LISTEN      112        16220       1493/nodejs     

tcp6       0      0 127.0.0.1:9600          :::*                    LISTEN      999        17089       1124/java       

>>>> email to wazuh+unsubscribe@googlegroups.com.

>>>> To post to this group, send email to wa...@googlegroups.com.
>>>> Visit this group at https://groups.google.com/group/wazuh.
>>>> To view this discussion on the web visit
>>>> https://groups.google.com/d/msgid/wazuh/ef111578-f691-4e97-9bb6-9cef8e62cd89%40googlegroups.com.
>>>>
>>>> For more options, visit https://groups.google.com/d/optout.
>>>
>>>
>> --
>> You received this message because you are subscribed to the Google Groups
>> "Wazuh mailing list" group.
>> To unsubscribe from this group and stop receiving emails from it, send an

>> email to wazuh+unsubscribe@googlegroups.com.

[Juan Ezquerro LLanes]

Sorry, I wanted to say:

What port should be opened in the firewall for data to be collected?

[Jesús Ángel González]

Ok happy to help you and happy you finally could fix Logstash issue.
Now here we go with the agents problem:

- The manager should have to be accesible on port 1514 to receive
information from agents, also 1515 if you want to use authd.
- Additionally, if you are using cluster, it also uses the port 1516.
- The agents should have to be accesible on port 1514 as well.

Try it and let us know if you solved the agents issue.

King regards,
Jesús

>>> >>>> email to wazuh+un...@googlegroups.com.

>>> >>>> To post to this group, send email to wa...@googlegroups.com.
>>> >>>> Visit this group at https://groups.google.com/group/wazuh.
>>> >>>> To view this discussion on the web visit
>>> >>>>
>>> >>>> https://groups.google.com/d/msgid/wazuh/ef111578-f691-4e97-9bb6-9cef8e62cd89%40googlegroups.com.
>>> >>>>
>>> >>>> For more options, visit https://groups.google.com/d/optout.
>>> >>>
>>> >>>
>>> >> --
>>> >> You received this message because you are subscribed to the Google
>>> >> Groups
>>> >> "Wazuh mailing list" group.
>>> >> To unsubscribe from this group and stop receiving emails from it, send
>>> >> an

>>> >> email to wazuh+un...@googlegroups.com.

>>> >> To post to this group, send email to wa...@googlegroups.com.
>>> >> Visit this group at https://groups.google.com/group/wazuh.
>>> >> To view this discussion on the web visit
>>> >>
>>> >> https://groups.google.com/d/msgid/wazuh/7dd61adb-582d-4c02-9436-8ab561dbcad6%40googlegroups.com.
>>> >>
>>> >> For more options, visit https://groups.google.com/d/optout.
>

> --
> You received this message because you are subscribed to the Google Groups
> "Wazuh mailing list" group.
> To unsubscribe from this group and stop receiving emails from it, send an

> email to wazuh+un...@googlegroups.com.

> To post to this group, send email to wa...@googlegroups.com.
> Visit this group at https://groups.google.com/group/wazuh.
> To view this discussion on the web visit

> https://groups.google.com/d/msgid/wazuh/4e89eb03-fef6-4330-bc08-b3551c79f89a%40googlegroups.com.

[Juan Ezquerro LLanes]

Today is all working, data is collected, thank you.

>>> >>>> email to wazuh+unsubscribe@googlegroups.com.

>>> >>>> To post to this group, send email to wa...@googlegroups.com.
>>> >>>> Visit this group at https://groups.google.com/group/wazuh.
>>> >>>> To view this discussion on the web visit
>>> >>>>
>>> >>>> https://groups.google.com/d/msgid/wazuh/ef111578-f691-4e97-9bb6-9cef8e62cd89%40googlegroups.com.
>>> >>>>
>>> >>>> For more options, visit https://groups.google.com/d/optout.
>>> >>>
>>> >>>
>>> >> --
>>> >> You received this message because you are subscribed to the Google
>>> >> Groups
>>> >> "Wazuh mailing list" group.
>>> >> To unsubscribe from this group and stop receiving emails from it, send
>>> >> an

>>> >> email to wazuh+unsubscribe@googlegroups.com.

>>> >> To post to this group, send email to wa...@googlegroups.com.
>>> >> Visit this group at https://groups.google.com/group/wazuh.
>>> >> To view this discussion on the web visit
>>> >>
>>> >> https://groups.google.com/d/msgid/wazuh/7dd61adb-582d-4c02-9436-8ab561dbcad6%40googlegroups.com.
>>> >>
>>> >> For more options, visit https://groups.google.com/d/optout.
>
> --
> You received this message because you are subscribed to the Google Groups
> "Wazuh mailing list" group.
> To unsubscribe from this group and stop receiving emails from it, send an

> email to wazuh+unsubscribe@googlegroups.com.

[Jesús Ángel González]

Sounds good to me! Thank you for the feedback and happ that the
solution works for you Juan.

Best regards,
Jesús.

>> >>> >>>> email to wazuh+un...@googlegroups.com.

>> >>> >>>> To post to this group, send email to wa...@googlegroups.com.
>> >>> >>>> Visit this group at https://groups.google.com/group/wazuh.
>> >>> >>>> To view this discussion on the web visit
>> >>> >>>>
>> >>> >>>>
>> >>> >>>> https://groups.google.com/d/msgid/wazuh/ef111578-f691-4e97-9bb6-9cef8e62cd89%40googlegroups.com.
>> >>> >>>>
>> >>> >>>> For more options, visit https://groups.google.com/d/optout.
>> >>> >>>
>> >>> >>>
>> >>> >> --
>> >>> >> You received this message because you are subscribed to the Google
>> >>> >> Groups
>> >>> >> "Wazuh mailing list" group.
>> >>> >> To unsubscribe from this group and stop receiving emails from it,
>> >>> >> send
>> >>> >> an

>> >>> >> email to wazuh+un...@googlegroups.com.

>> >>> >> To post to this group, send email to wa...@googlegroups.com.
>> >>> >> Visit this group at https://groups.google.com/group/wazuh.
>> >>> >> To view this discussion on the web visit
>> >>> >>
>> >>> >>
>> >>> >> https://groups.google.com/d/msgid/wazuh/7dd61adb-582d-4c02-9436-8ab561dbcad6%40googlegroups.com.
>> >>> >>
>> >>> >> For more options, visit https://groups.google.com/d/optout.
>> >
>> > --
>> > You received this message because you are subscribed to the Google
>> > Groups
>> > "Wazuh mailing list" group.
>> > To unsubscribe from this group and stop receiving emails from it, send
>> > an

>> > email to wazuh+un...@googlegroups.com.

>> > To post to this group, send email to wa...@googlegroups.com.
>> > Visit this group at https://groups.google.com/group/wazuh.
>> > To view this discussion on the web visit
>> >
>> > https://groups.google.com/d/msgid/wazuh/4e89eb03-fef6-4330-bc08-b3551c79f89a%40googlegroups.com.
>> >
>> > For more options, visit https://groups.google.com/d/optout.
>

> --
> You received this message because you are subscribed to the Google Groups
> "Wazuh mailing list" group.
> To unsubscribe from this group and stop receiving emails from it, send an

> email to wazuh+un...@googlegroups.com.

> To post to this group, send email to wa...@googlegroups.com.
> Visit this group at https://groups.google.com/group/wazuh.
> To view this discussion on the web visit

> https://groups.google.com/d/msgid/wazuh/b846772f-c230-4901-b8f2-30188e03c541%40googlegroups.com.