Wazuh cannot restart - Process broked
Luke Lee
ERROR : sys_rpm_packages(): ERROR: sys_rpm_packages(): Failed to open database '/var/lib/rpm/Packages'
Luke Lee
- wazuh-modulesd:vulnerability-detector[36207] wm_vuln_detector.c:2117 at wm_vuldet_run_update(): DEBUG: (5451): Red Hat Enterprise Linux OVAL has been updated correctly.
Tomás Turina
Hi Luke,
The logs from vulnerability detector related to Red Hat are because it is necessary to download a feed to populate the CVE database. This feed is not the same for each OS, so depending on the platform that you are running Wazuh, the URL to get the CVE json file will change.
Regarding the log from the first email you sent, it is an error related to the Syscollector module. One of Syscollector’s inventories collects the packages installed in the system, which in your case (Red Hat) they are stored in the path ‘/var/lib/rpm/Package’. Syscollector is trying to open that DB but it is failing. I think it can be a problem with the permissions to open that DB file.
Did you try to restart the Wazuh service as root? Did you check if the DB file is corrupted?
Regards,
Tomás.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/93f90638-702a-42d3-b8d8-015df8dd747c%40googlegroups.com.
Luke Lee
wazuh-clusterd not running...
ossec-logcollector not running...
ossec-remoted not running...
ossec-syscheckd not running...
ossec-agentlessd not running...
ossec-integratord not running...
ossec-dbd not running...
ossec-csyslogd not running...
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
Luke Lee
Tomás Turina
Hi Luke,
Actually, there are some feeds for vulnerability detector that the manager will download no matter the OS. This is because they are necessary to detect possible problems in the agents connected to it, and these agents can be running on different OS (Ubuntu, RedHat, Windows, etc.).
These feeds can be enabled/disabled by configuration in the vulnerability-detector section of ossec.conf:
<vulnerability-detector>
<enabled>no</enabled>
<interval>5m</interval>
<ignore_time>6h</ignore_time>
<run_on_start>yes</run_on_start>
<provider name="canonical">
<enabled>no</enabled>
<os>precise</os>
<os>trusty</os>
<os>xenial</os>
<os>bionic</os>
<update_interval>1h</update_interval>
</provider>
<provider name="debian">
<enabled>no</enabled>
<os>wheezy</os>
<os>stretch</os>
<os>jessie</os>
<os>buster</os>
<update_interval>1h</update_interval>
</provider>
<provider name="redhat">
<enabled>no</enabled>
<update_from_year>2010</update_from_year>
<update_interval>1h</update_interval>
</provider>
<provider name="nvd">
<enabled>no</enabled>
<update_from_year>2010</update_from_year>
<update_interval>1h</update_interval>
</provider>
</vulnerability-detector>
So, if you check your configuration file, it is almost for sure that the provider “redhat” is enabled. That’s why your ubuntu manager is downloading those feeds for RedHat and it shouldn’t be any problem since they are necessary for RedHat agents connected to it.
On the other topic, as I can see most of the daemons are not running. To restart all of them, you can use the following command (this is the same for Wazuh manager and Wazuh agent):
# /var/ossec/bin/ossec-control restart
To get you packages database fixed, I think that this link could be useful for you: https://unix.stackexchange.com/questions/198703/yum-errorrpmdb-open-failed
Please, let me know if this fixes your problem.
but strange enough,
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/93f90638-702a-42d3-b8d8-015df8dd747c%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/38e1369b-0bc4-4114-b249-7dd810894db1%40googlegroups.com.
Luke Lee
but strange enough,
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/93f90638-702a-42d3-b8d8-015df8dd747c%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
Luke Lee
Tomás Turina
Hi Luke,
As I can see from the output of the ossec-control status command, there are some processes that should be running but they aren’t.
Could you please attach the full log so I can check why they aren’t running? Before that, I recommend you to restart all the daemons by running the command:
#/var/ossec/bin/ossec-control restart
Also, by default the agents connect to the server through port 1515. Following the simple registration service, to get your agent connected to the server you should run (in the agent side):
#/var/ossec/agent-auth -m your_server_ip -p 1514
Here you can check the full options of the agent-auth tool: https://documentation.wazuh.com/3.10/user-manual/reference/tools/agent-auth.html
Please, make sure that the firewall is not blocking connections to port 1514 on your server side.
Regarding the error messages, all of them are from wazuh-modules daemon, so they aren’t the reason why you can’t connect your agent to the manager.
In order to fix them, please make sure that the ‘/var/lib/rpm/Packages’ file exists, and if not please regenerate it following this instructions: https://unix.stackexchange.com/questions/198703/yum-errorrpmdb-open-failed
Please, let me know if this information helps you.
ossec-execd is running...
but strange enough,
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/93f90638-702a-42d3-b8d8-015df8dd747c%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/38e1369b-0bc4-4114-b249-7dd810894db1%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/cfe434c1-bc0d-4073-b544-cfdd23b3831a%40googlegroups.com.
Luke Lee
but strange enough,
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/93f90638-702a-42d3-b8d8-015df8dd747c%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/38e1369b-0bc4-4114-b249-7dd810894db1%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
Luke Lee
Tomás Turina
Hi Luke,
Here you can find a description of all the Wazuh daemons: https://documentation.wazuh.com/3.10/user-manual/reference/daemons/index.html
In order to get your manager run and receive data from your agents, you need the following processes up and running:
- ossec-authd: necessary to interchange keys between manager and agents in a secure way.
- ossec-remoted: this process is in charge of receive data from the agents connected to the manager.
- ossec-analysisd: it analyzes, decodes and matches data with the rules in order to generate alerts.
- wazuh-db: this process stores data in DB.
From the logs you shared I couldn’t find an error related to these processes, but the process ossec-remoted wasn’t running. I guess that after you restarted the processes with the command that I shared, all the processes listed above were able to get up and run and that’s why your manager is now receiving data from your agents.
Let me know if your problem is already solved and don’t hesitate to contact if any problem persists.
Kind regards,
Tomás.
From: Luke Lee
Sent: Friday, January 10, 2020 3:10 AM
To: Wazuh mailing list
Subject: Re: Wazuh cannot restart - Process broked
Strange enough,
ossec-monitord not running...
ossec-logcollector not running...
ossec-remoted not running...
ossec-syscheckd not running...
ossec-analysisd is running...
ossec-maild is running..
ossec-execd is running...
wazuh-db is running..
ossec-authd is running...
but strange enough,
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/93f90638-702a-42d3-b8d8-015df8dd747c%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/38e1369b-0bc4-4114-b249-7dd810894db1%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/cfe434c1-bc0d-4073-b544-cfdd23b3831a%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/de371a53-63e9-4b34-b383-042de9b110a6%40googlegroups.com.
Luke Lee
Thanks !
but strange enough,
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/93f90638-702a-42d3-b8d8-015df8dd747c%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/38e1369b-0bc4-4114-b249-7dd810894db1%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/cfe434c1-bc0d-4073-b544-cfdd23b3831a%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
Tomás Turina
Hi Luke,
The problem you face isn’t related to the ports you use. After analyzing the log you sent, we realized that remoted and some of the processes aren’t running because the can’t connect to the process analysisd.
Analysisd is the process that receives all the messages from the rest of the processes from a socket located in the path /var/ossec/queue/ossec/queue. In you case, analysisd takes a lot of time to read and load all its initial configuration before starting this socket. That’s why, in the log we can see these lines:
2020/01/10 09:47:47 rootcheck[46120] rootcheck.c:250 at rootcheck_connect(): CRITICAL: (1211): Unable to access queue: '/var/ossec/queue/ossec/queue'. Giving up..
2020/01/10 09:47:47 ossec-logcollector[46135] main.c:183 at main(): CRITICAL: (1211): Unable to access queue: '/var/ossec/queue/ossec/queue'. Giving up..
2020/01/10 09:47:48 ossec-remoted[46127] secure.c:117 at HandleSecure(): CRITICAL: (1211): Unable to access queue: '/queue/ossec/queue'. Giving up..
2020/01/10 09:47:57 ossec-monitord[46139] monitord.c:63 at Monitord(): CRITICAL: (1211): Unable to access queue: '/queue/ossec/queue'. Giving up..
As you can see, those processes can’t connect to the socket and they are exiting.
In a normal case, analysisd should take less than 1 second to load all its configuration, but in your case it takes over 45 seconds. In that time, the rest of the processes give up to connect to the socket and exit.
In order to understand why it takes so much time to start, could you please share the specifications (CPUs, RAM, etc) of the machine where you are running Wazuh manager?
Also, a quick fix you can try is edit the file /var/ossec/bin/ossec-control and add a sleep after starting analysisd but before starting the rest of the processes. After this, you have to restart Wazuh manager with the command:
# /var/ossec/bin/ossec-control restart
If you get all the processes running, you should get this output:
root@tomas-VirtualBox:/var/ossec/bin# ./ossec-control status
wazuh-clusterd not running...
wazuh-modulesd is running...
ossec-monitord is running...
ossec-logcollector is running...
ossec-remoted is running...
ossec-syscheckd is running..
ossec-analysisd is running...
ossec-maild not running...
ossec-execd is running...
wazuh-db is running...
ossec-authd is running...
ossec-agentlessd not running...
ossec-integratord not running...
ossec-dbd not running...
ossec-csyslogd not running...
root@tomas-VirtualBox:/var/ossec/bin#
We also have an issue in our backlog to don’t make the processes give up when can’t connect to the socket and, instead, make them retry the connecting every certain period of time, so in future versions this issue should no longer appear.
I hope this information helps you.
ossec-authd is running...
but strange enough,
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/93f90638-702a-42d3-b8d8-015df8dd747c%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/38e1369b-0bc4-4114-b249-7dd810894db1%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/cfe434c1-bc0d-4073-b544-cfdd23b3831a%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/de371a53-63e9-4b34-b383-042de9b110a6%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/fb3759e2-d93f-48a3-b3ee-351c1833f675%40googlegroups.com.
Luke Lee
but strange enough,
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/93f90638-702a-42d3-b8d8-015df8dd747c%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/38e1369b-0bc4-4114-b249-7dd810894db1%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/cfe434c1-bc0d-4073-b544-cfdd23b3831a%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/de371a53-63e9-4b34-b383-042de9b110a6%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
Tomás Turina
Hi Luke,
The Wazuh documentation says that it is recommended to assign 6GB to Docker host preferences:
https://documentation.wazuh.com/3.10/docker/wazuh-container.html#container-memory
Let me know if this answers your question.
telnet: connect to address ip: Connection refused
Is there anything you can advise me on this? Is it due to the firewall ?
but strange enough,
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/93f90638-702a-42d3-b8d8-015df8dd747c%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/38e1369b-0bc4-4114-b249-7dd810894db1%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/cfe434c1-bc0d-4073-b544-cfdd23b3831a%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/de371a53-63e9-4b34-b383-042de9b110a6%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/fb3759e2-d93f-48a3-b3ee-351c1833f675%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/fc6b15c9-352c-4903-968a-37a5c31e59e8%40googlegroups.com.
Luke Lee
but strange enough,
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/93f90638-702a-42d3-b8d8-015df8dd747c%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/38e1369b-0bc4-4114-b249-7dd810894db1%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/cfe434c1-bc0d-4073-b544-cfdd23b3831a%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/de371a53-63e9-4b34-b383-042de9b110a6%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/fb3759e2-d93f-48a3-b3ee-351c1833f675%40googlegroups.com.
--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
Luke Lee
