Can not start wazuh-indexer

[Monitorização Servidores]

Hi there i start by apologizing for my English because its not my native language, but i have a problem in starting wazuh-indexer service

i ran the command "service wazuh-indexer restart" but unfortunately is giving me this error:

Job for wazuh-indexer.service failed because the control process exited with error code.
See "systemctl status wazuh-indexer.service" and "journalctl -xeu wazuh-indexer.service" for details.

Then i executed "journalctl -xeu wazuh-indexer.service"

Apr 19 14:10:23 srv-wazuh systemd-entrypoint[6908]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Apr 19 14:10:23 srv-wazuh systemd-entrypoint[6908]: WARNING: System::setSecurityManager will be removed in a future release
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]: uncaught exception in thread [main]
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]: java.lang.IllegalStateException: failed to load plugin class [org.opensearch.security.OpenSearchSecurityPlugin]
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]: Likely root cause: OpenSearchException[Unable to read /etc/wazuh-indexer/certs/indexer.pem (/etc/wazuh-indexer/certs/indexer.pem). Please make sure this files exists and is readable re>
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.security.ssl.DefaultSecurityKeyStore.checkPath(DefaultSecurityKeyStore.java:983)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.security.ssl.DefaultSecurityKeyStore.resolve(DefaultSecurityKeyStore.java:235)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.security.ssl.DefaultSecurityKeyStore.initTransportSSLConfig(DefaultSecurityKeyStore.java:394)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.security.ssl.DefaultSecurityKeyStore.initSSLConfig(DefaultSecurityKeyStore.java:256)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.security.ssl.DefaultSecurityKeyStore.<init>(DefaultSecurityKeyStore.java:177)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.security.ssl.OpenSearchSecuritySSLPlugin.<init>(OpenSearchSecuritySSLPlugin.java:218)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.security.OpenSearchSecurityPlugin.<init>(OpenSearchSecurityPlugin.java:263)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:77)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:499)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:480)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.plugins.PluginsService.loadPlugin(PluginsService.java:782)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.plugins.PluginsService.loadBundle(PluginsService.java:731)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.plugins.PluginsService.loadBundles(PluginsService.java:533)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.plugins.PluginsService.<init>(PluginsService.java:195)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.node.Node.<init>(Node.java:434)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.node.Node.<init>(Node.java:361)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:242)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:242)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:404)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:180)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.bootstrap.OpenSearch.execute(OpenSearch.java:171)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:104)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.cli.Command.main(Command.java:101)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:137)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]:         at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:103)
Apr 19 14:10:26 srv-wazuh systemd-entrypoint[6908]: For complete error details, refer to the log at /var/log/wazuh-indexer/wazuh-cluster.log
Apr 19 14:10:26 srv-wazuh systemd[1]: wazuh-indexer.service: Main process exited, code=exited, status=1/FAILURE
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ An ExecStart= process belonging to unit wazuh-indexer.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 1.
Apr 19 14:10:26 srv-wazuh systemd[1]: wazuh-indexer.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ The unit wazuh-indexer.service has entered the 'failed' state with result 'exit-code'.
Apr 19 14:10:26 srv-wazuh systemd[1]: Failed to start Wazuh-indexer.
░░ Subject: A start job for unit wazuh-indexer.service has failed
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit wazuh-indexer.service has finished with a failure.
░░
░░ The job identifier is 1391 and the job result is failed.
Apr 19 14:10:26 srv-wazuh systemd[1]: wazuh-indexer.service: Consumed 17.958s CPU time.
░░ Subject: Resources consumed by unit runtime
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ The unit wazuh-indexer.service completed and consumed the indicated resources.

So went to "/etc/wazuh-indexer/certs/indexer.pem" to check if the file was there but it does not exist.

Can you guys help me fix this? I am running Ubuntu 22.04.2 LTS

  

[Kasim Mustapha]

Hello Monitorização Servidores,

Apologies for the late response.

Kindly share with me the content of /etc/wazuh-indexer/certs/ directory. I would like to see the permission as well, so, I will appreciate using the "ll  /etc/wazuh-indexer/certs/". 

If the certificates are missing I would recommend you generate another one using the guide below;

https://documentation.wazuh.com/current/user-manual/certificates.html 

I hope this helps. Let me know if you have further questions.