ERROR: Cannot connect to Wazuh dashboard.

[Todor Dimitrov]

Good afternoon, 

I am using the assisted method for installation of Wazuh 4.9 components but when i get to the dashboard installation i paste the bash wazuh-install.sh --wazuh-dashboard dashboard-1 (because these are the names of my componenets - wazuh-1, node-1, dashboard-1) and i get to Initializing Wazuh dashboard web application and right after that i get this error:

ERROR: Cannot connect to Wazuh dashboard. 

ERROR: Wazuh indexer security settings not initialized. Please run the installation assistant using -s|--start-cluster in one of the wazuh indexer nodes. 

All the components are on the same Linux machine and i installed them using the assisted installation. In all the config files i have given the same IP to all the components or 127.0.0.1:9200 or localhost. Where am i going wrong? Please help!

Regards, 

Todor

[Md. Nazmur Sakib]

Hi Todor,

Based on your information it seems you missed the Wazuh indexer cluster initialization step.Let's first check the status of your indexer.systemctl restart wazuh_indexerIf you see your indexer is up and runningYou can run this command to initialize the indexer:
bash wazuh-install.sh --start-clusterThis command will load the new certificate information and start the cluster.You can refer to the Wazuh documentation for more details.Next,
Run the following command to check the status of cluster health. Replace <ADMIN_PASSWORD> with the password gotten from the output of the previous command. Replace <WAZUH_INDEXER_IP> with the configured Wazuh indexer IP address:curl -k -u admin:<ADMIN_PASSWORD> https://<WAZUH_INDEXER_IP>:9200/_cluster/health"If you cannot remember your admin password, run the following command to get the admin password:
tar -axf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt -O | grep -P "\'admin\'" -A 1If you see the indexer is working fine, you can try rerunning the Wazuh dashboard install command:

Also, I believe you have used dashboard-1 as the name of the Dashabord while the certificate creation. Use the same name you have used in the certificate.

 bash wazuh-install.sh --wazuh-dashboard dashboard-1

I hope this helps, and please let me know if it works for you.

[Todor Dimitrov]

Hi Nazmud, 

I tried doing a clean installation. I deleted everything and started the process again but with no success. I installed the indexer with no problem and the manager as well but when i need to install the dashboard that's where i get the problem. I checked the indexer and manager status before i started installing the dashboard and they were up and running. When i start the dashboard installation it stops at Initializing Wazuh dashboard web application and then it gives me the same problem. I typed systemctl restart wazuh-indexer but i got this message:

Job for wazuh-indexer.service failed because the control process exited with error code.
See "systemctl status wazuh-indexer.service" and "journalctl -xeu wazuh-indexer.service" for details.

Also when i try to run the bash wazuh-install.sh --start-cluster it gives me an error message saying:

ERROR: Connectivity check failed on node (The IP i'm using) port 9200. Possible causes: Wazuh indexer not installed on the node, the Wazuh indexer service is not running or you have connectivity issues with that node. Please check this before trying again.

I don't understand what am i doing wrong. Please help me figure this out so i can actually start using Wazuh. Thank you for your time. 

Regards, 

Todor

[Todor Dimitrov]

Hi Nazmur, 

I just have one stupid question: Is there a specific order in which the components should be installed?

Regards, 

Todor

On Wednesday 13 November 2024 at 14:33:25 UTC+2 Md. Nazmur Sakib wrote:

[Md. Nazmur Sakib]

Sorry for the late response. Somehow I missed the query. There is no septic order for the components should be installed.

But I always prefer to install in this order for check collection

Indexer > Manager > Dashboard.

If you are still having the issue with the indexer. Please share the output of these commands.

systemctl status wazuh_indexer


cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn"

Also, share the resources you are using for your endpoint.

[Todor Dimitrov]

Hi Nazmur, 

I made a new machine and started over. Now it works perfectly fine. Thank you for your time.

Regards, 

Todor