Wazuh dashboard server is not ready yet from current VM

[Isaac Golding]

Hello,   The issue I'm having is that after a fresh install of the Wazuh VM from https://documentation.wazuh.com/current/deployment-options/virtual-machine/virtual-machine.html   I get the message  "Wazuh dashboard server is not ready yet".

The VM is configured per directions on the linked page.   No alterations have been made to the VM to include still using DHCP.  This is literally fresh out of the box.

When I run systemctl status I get the following response:

[root@wazuh-server ~]# systemctl status
● wazuh-server
    State: degraded
     Jobs: 0 queued
   Failed: 3 units
    Since: Thu 2022-07-21 14:30:26 UTC; 9min ago
   CGroup: /
           ├─1 /usr/lib/systemd/systemd --switched-root --system --deserialize 21
           ├─user.slice
           │ └─user-1000.slice
           │   ├─session-3.scope
           │   │ ├─3031 sshd: wazuh-user [priv]
           │   │ ├─3035 sshd: wazuh-user@pts/0
           │   │ ├─3036 -bash
           │   │ ├─3061 sudo su -
           │   │ ├─3065 su -
           │   │ ├─3066 -bash
           │   │ ├─3088 systemctl status
           │   │ └─3089 less
           │   └─session-2.scope
           │     ├─ 524 login -- wazuh-user
           │     ├─1372 -bash
           │     ├─1478 sudo su -
           │     ├─1617 su -
           │     └─1624 -bash
           └─system.slice
             ├─wazuh-manager.service
             │ ├─1495 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
             │ ├─1535 /var/ossec/bin/wazuh-authd
             │ ├─1549 /var/ossec/bin/wazuh-db
             │ ├─1573 /var/ossec/bin/wazuh-execd
             │ ├─1585 /var/ossec/bin/wazuh-analysisd
             │ ├─1595 /var/ossec/bin/wazuh-syscheckd
             │ ├─1612 /var/ossec/bin/wazuh-remoted
             │ ├─1618 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
             │ ├─1621 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
             │ ├─1759 /var/ossec/bin/wazuh-logcollector
             │ ├─1779 /var/ossec/bin/wazuh-monitord
             │ └─1789 /var/ossec/bin/wazuh-modulesd
             ├─rsyslog.service
             │ └─855 /usr/sbin/rsyslogd -n
             ├─filebeat.service
             │ └─851 /usr/share/filebeat/bin/filebeat --environment systemd -c /etc/filebeat/filebeat.yml --path.home /usr/share/filebeat --path.config /etc/filebeat --path.data /var/lib/filebeat --path.logs /var/log/filebeat
             ├─tuned.service
             │ └─850 /usr/bin/python2 -Es /usr/sbin/tuned -l -P
             ├─postfix.service
             │ ├─972 /usr/libexec/postfix/master -w
             │ ├─973 pickup -l -t unix -u
             │ └─974 qmgr -l -t unix -u
             ├─sshd.service
             │ └─848 /usr/sbin/sshd -D -u0
             ├─network.service
             │ └─791 /sbin/dhclient -1 -q -lf /var/lib/dhclient/dhclient--eth0.lease -pf /var/run/dhclient-eth0.pid -H wazuh-server eth0
             ├─crond.service
             │ └─526 /usr/sbin/crond -n
             ├─NetworkManager.service
             │ └─518 /usr/sbin/NetworkManager --no-daemon
             ├─dbus.service
             │ └─473 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
             ├─systemd-logind.service
             │ └─472 /usr/lib/systemd/systemd-logind

             ├─qemu-guest-agent.service
             │ └─471 /usr/bin/qemu-ga --method=virtio-serial --path=/dev/virtio-ports/org.qemu.guest_agent.0 --blacklist=guest-file-open,guest-file-close,guest-file-read,guest-file-write,guest-file-seek,guest-file-flush,guest-exec,guest-
             ├─gssproxy.service
             │ └─508 /usr/sbin/gssproxy -D
             ├─irqbalance.service
             │ └─460 /usr/sbin/irqbalance --foreground
             ├─wazuh-dashboard.service
             │ └─457 /usr/share/wazuh-dashboard/bin/../node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/bin/../src/cli/dist -c /etc/wazuh-dashboard/opensearch_dashboards.yml
             ├─polkit.service
             │ └─456 /usr/lib/polkit-1/polkitd --no-debug
             ├─chronyd.service
             │ └─478 /usr/sbin/chronyd
             ├─rpcbind.service
             │ └─490 /sbin/rpcbind -w
             ├─auditd.service
             │ └─362 /sbin/auditd
             ├─systemd-udevd.service
             │ └─336 /usr/lib/systemd/systemd-udevd
             └─systemd-journald.service
               └─298 /usr/lib/systemd/systemd-journald
lines 19-80/80 (END)

Any advice would be appreciated.

Isaac 

[Sergio Gabriel Uncos]

Hi Isaac,

Thanks for using Wazuh!

Sometimes it takes some time to get the Wazuh Dashboard ready and it depends of the resources assigned to that VM.

This error usually refers to the Wazuh Indexer that is no running for some reason.

In order to help you:

1. How many cores and memory RAM did you assign to the VM?

2. Could you please share the output of the command: cat /etc/wazuh-indexer/jvm.options | egrep -i "xms|xmx"

3. Please check if indexer is working using curl https://localhost:9200/ -k -uadmin:admin 

If you get a response, then the dashboard is delayed to start.

I'll be aware of your answer.

Thanks in advance!

Sergio Uncos

[Isaac Golding]

Sergio,

My answers are as follows:

#1   8 cores assigned, 8 GB Ram

#2 

[root@wazuh-server ~]# cat /etc/wazuh-indexer/jvm.options | egrep -i "xms|xmx"

## -Xms4g
## -Xmx4g
# Xms represents the initial size of total heap space
# Xmx represents the maximum size of total heap space
-Xms3990m
-Xmx3990m
[root@wazuh-server ~]#

#3 

[root@wazuh-server ~]# curl https://localhost:9200/ -k -uadmin:admin
curl: (7) Failed connect to localhost:9200; Connection refused
[root@wazuh-server ~]#

[Sergio Gabriel Uncos]

Hi Isaac,

According to the "curl: (7) Failed connect to localhost:9200; Connection refused" error, can you check the status of the Wazuh Indexer?:

• systemctl status wazuh-indexer

If it is not running, please execute:

• systemctl start wazuh-indexer

Additional to this, I'd like to ask you to restart the wazuh-indexer service as well and test reach the dashboard again:

• systemctl restart wazuh-indexer

Thanks in advance,

Regards.

Sergio Uncos

[sintayehu seyoum]

thank you 

the recommendation solves my issue