Errors in ossec.log after upgrading to 4.8.0.

[KnaveXVX]

Hello,

I have some warnings in ossec.log after upgrading to 4.8.0. I did follow all the troubleshooting steps.

"Failed to sync agent '005' with the indexer"

" IndexerConnector initialization failed for index 'wazuh-states-vulnerabilities-wazuh-server', retrying until the connection is successful."

I am seeing activity on the Wazuh Vulnerability dashboard but it doesn't refresh unless I reboot the server. I sometimes need to re-enter the username and password for the indexer into the wazuh-keystore and then restart the Wazuh services. I also checked the overall health of the system and it is in a yellow status. The reasoning is due to some unassigned indices but I have no idea how to fix this.

 

When looking at those indices, they all show as being setup with a replica count of 1 but I only have one server. Some of the indices, I can manually set to 0 but others give me an error when saving. I don't know why some indices are defaulting to 1 replica.

Thank you.

[Sebastian Dario Bustos]

Hi KnaveXVX,

In order to set the amount of replicas (to 0 in this case) you will need to create an index template to set the future indices replicas, you can do this from the DevTools section, for example:

PUT _index_template/managed-history
{
  "index_patterns": [
    ".opendistro-ism-managed-index-history-*"
  ],
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 0
    }
  }
}

Once this is applied you can set the amount of replicas for the existent indices with the following endpoint:

PUT / .opendistro-ism-managed-index-history-*/_settings
{
  "index" : {
    "number_of_replicas" : 0
  }
}

Let me know if this helps.

Regards.

[KnaveXVX]

Thanks for the reply. I ran that first PUT command and got this reply:

{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "index template [managed-history] has index patterns [.opendistro-ism-managed-index-history-*] matching patterns from existing templates [replicas] with patterns (replicas => [*]) that have the same priority [0], multiple index templates may not match during index creation, please use a different priority"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "index template [managed-history] has index patterns [.opendistro-ism-managed-index-history-*] matching patterns from existing templates [replicas] with patterns (replicas => [*]) that have the same priority [0], multiple index templates may not match during index creation, please use a different priority"
  },
  "status": 400