wazuh-indexer stopped working after 4.7.2-> 4.8.0 upgrade

248 views
Skip to first unread message

M V

unread,
Jun 26, 2024, 4:12:44 AM6/26/24
to Wazuh | Mailing List
system: ubuntu 22.04 LTS (Jammy)
wazuh type: standalone
{"error":0,"data":[{"WAZUH_VERSION":"v4.8.0"},{"WAZUH_REVISION":"40812"},{"WAZUH_TYPE":"server"}] 

4.7.2 version was working flawlessly. cron job performed its weekly `apt update` on all systems. This upgraded wazuh from 4.7.2 to 4.8. After which, wazuh-dashboard started throwing `ECONN REFUSED` errors. I checked for indexer service on port 9200. Nothing. 

/var/log/wazuh-indexer/wazuh.log 
```
[2024-06-25T06:34:58,079][INFO ][o.o.h.AbstractHttpServerTransport] [scanner] publish_address {192.168.100.16:9200}, bound_addresses {192.168.100.16:9200}
[2024-06-25T06:34:58,080][INFO ][o.o.n.Node               ] [scanner] started
[2024-06-25T06:34:58,085][INFO ][o.o.s.OpenSearchSecurityPlugin] [scanner] Node started
[2024-06-25T06:34:58,085][INFO ][o.o.s.c.ConfigurationRepository] [scanner] Will not attempt to create index .opendistro_security and default configs if they are absent. Use securityadmin to initialize cluster
[2024-06-25T06:34:58,097][INFO ][o.o.s.c.ConfigurationRepository] [scanner] Background init thread started. Install default config?: false
[2024-06-25T06:34:58,097][INFO ][o.o.s.c.ConfigurationRepository] [scanner] Wait for cluster to be available ...
[2024-06-25T06:34:58,102][INFO ][o.o.s.OpenSearchSecurityPlugin] [scanner] 0 OpenSearch Security modules loaded so far: []
[2024-06-25T06:34:58,738][INFO ][o.o.c.s.ClusterSettings  ] [scanner] updating [plugins.index_state_management.template_migration.control] from [0] to [-1]
[2024-06-25T06:34:58,800][INFO ][o.o.a.c.HashRing         ] [scanner] Node added: [NYwAnnogQQGj1f5CMYjJoQ]
[2024-06-25T06:34:58,804][INFO ][o.o.a.c.HashRing         ] [scanner] Add data node to AD version hash ring: NYwAnnogQQGj1f5CMYjJoQ
[2024-06-25T06:34:58,806][INFO ][o.o.a.c.HashRing         ] [scanner] All nodes with known AD version: {NYwAnnogQQGj1f5CMYjJoQ=ADNodeInfo{version=2.10.0, isEligibleDataNode=true}}
[2024-06-25T06:34:58,806][INFO ][o.o.a.c.HashRing         ] [scanner] Rebuild AD hash ring for realtime AD with cooldown, nodeChangeEvents size 0
[2024-06-25T06:34:58,806][INFO ][o.o.a.c.HashRing         ] [scanner] Build AD version hash ring successfully
[2024-06-25T06:34:58,807][INFO ][o.o.a.c.ADDataMigrator   ] [scanner] Start migrating AD data
[2024-06-25T06:34:58,807][INFO ][o.o.a.c.ADDataMigrator   ] [scanner] AD job index doesn't exist, no need to migrate
[2024-06-25T06:34:58,807][INFO ][o.o.a.c.ADClusterEventListener] [scanner] Init AD version hash ring successfully
[2024-06-25T06:34:58,811][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [scanner] Detected cluster change event for destination migration
[2024-06-25T06:34:58,833][INFO ][o.o.g.GatewayService     ] [scanner] recovered [211] indices into cluster_state
[2024-06-25T06:34:58,835][INFO ][o.o.s.l.LogTypeService   ] [scanner] Loading builtin types!
[2024-06-25T06:34:58,837][WARN ][o.o.o.i.ObservabilityIndex] [scanner] message: index [.opensearch-observability/NxSo7GFITU-77U-NQB8HJQ] already exists
[2024-06-25T06:34:58,837][INFO ][o.o.o.i.ObservabilityIntegrationsIndex] [scanner] observability:createMappingTemplate ss4o_metrics_template API called
[2024-06-25T06:34:58,840][INFO ][o.o.s.l.LogTypeService   ] [scanner] Indexing [418] fieldMappingDocs from logTypes: 23
[2024-06-25T06:34:58,867][ERROR][o.o.b.Bootstrap          ] [scanner] Exception
java.lang.IllegalArgumentException: index template [ss4o_metrics_template] has index patterns [ss4o_metrics-*-*] matching patterns from existing templates [ss4o_metric_template] with patterns (ss4o_metric_template => [ss4o_metrics-*-*]) that have the same priority [1], multiple index templates may not match during index creation, please use a different priority
        at org.opensearch.cluster.metadata.MetadataIndexTemplateService.addIndexTemplateV2(MetadataIndexTemplateService.java:560) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cluster.metadata.MetadataIndexTemplateService$4.execute(MetadataIndexTemplateService.java:493) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cluster.ClusterStateUpdateTask.execute(ClusterStateUpdateTask.java:65) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cluster.service.MasterService.executeTasks(MasterService.java:874) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cluster.service.MasterService.calculateTaskOutputs(MasterService.java:424) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cluster.service.MasterService.runTasks(MasterService.java:295) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cluster.service.MasterService$Batcher.run(MasterService.java:206) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cluster.service.TaskBatcher.runIfNotProcessed(TaskBatcher.java:204) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cluster.service.TaskBatcher$BatchedTask.run(TaskBatcher.java:242) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:849) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.common.util.concurrent.PrioritizedOpenSearchThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedOpenSearchThreadPoolExecutor.java:282) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.common.util.concurrent.PrioritizedOpenSearchThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedOpenSearchThreadPoolExecutor.java:245) ~[opensearch-2.10.0.jar:2.10.0]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) ~[?:?]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) ~[?:?]
        at java.lang.Thread.run(Thread.java:833) ~[?:?]
[2024-06-25T06:34:58,872][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [scanner] uncaught exception in thread [main]
org.opensearch.bootstrap.StartupException: java.lang.IllegalArgumentException: index template [ss4o_metrics_template] has index patterns [ss4o_metrics-*-*] matching patterns from existing templates [ss4o_metric_template] with patterns (ss4o_metric_template => [ss4o_metrics-*-*]) that have the same priority [1], multiple index templates may not match during index creation, please use a different priority
        at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:184) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.OpenSearch.execute(OpenSearch.java:171) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:104) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138) ~[opensearch-cli-2.10.0.jar:2.10.0]
        at org.opensearch.cli.Command.main(Command.java:101) ~[opensearch-cli-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:137) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:103) ~[opensearch-2.10.0.jar:2.10.0]
Caused by: java.lang.IllegalArgumentException: index template [ss4o_metrics_template] has index patterns [ss4o_metrics-*-*] matching patterns from existing templates [ss4o_metric_template] with patterns (ss4o_metric_template => [ss4o_metrics-*-*]) that have the same priority [1], multiple index templates may not match during index creation, please use a different priority
        at org.opensearch.cluster.metadata.MetadataIndexTemplateService.addIndexTemplateV2(MetadataIndexTemplateService.java:560) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cluster.metadata.MetadataIndexTemplateService$4.execute(MetadataIndexTemplateService.java:493) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cluster.ClusterStateUpdateTask.execute(ClusterStateUpdateTask.java:65) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cluster.service.MasterService.executeTasks(MasterService.java:874) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cluster.service.MasterService.calculateTaskOutputs(MasterService.java:424) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cluster.service.MasterService.runTasks(MasterService.java:295) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cluster.service.MasterService$Batcher.run(MasterService.java:206) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cluster.service.TaskBatcher.runIfNotProcessed(TaskBatcher.java:204) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cluster.service.TaskBatcher$BatchedTask.run(TaskBatcher.java:242) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:849) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.common.util.concurrent.PrioritizedOpenSearchThreadPoolExecutor$TieBreakingPrioritizedRunnable.runAndClean(PrioritizedOpenSearchThreadPoolExecutor.java:282) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.common.util.concurrent.PrioritizedOpenSearchThreadPoolExecutor$TieBreakingPrioritizedRunnable.run(PrioritizedOpenSearchThreadPoolExecutor.java:245) ~[opensearch-2.10.0.jar:2.10.0]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) ~[?:?]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) ~[?:?]
        at java.lang.Thread.run(Thread.java:833) [?:?]
[2024-06-25T06:34:58,878][WARN ][o.o.s.SecurityAnalyticsPlugin] [scanner] Failed to initialize LogType config index and builtin log types
```

Help please.

Tomas Sarquis

unread,
Jul 1, 2024, 2:57:48 AM7/1/24
to Wazuh | Mailing List
Hi M V

The error your log shows is: org.opensearch.bootstrap.StartupException: java.lang.IllegalArgumentException: index template [ss4o_metrics_template] has index patterns [ss4o_metrics-*-*] matching patterns from existing templates [ss4o_metric_template] with patterns (ss4o_metric_template => [ss4o_metrics-*-*]) that have the same priority [1], multiple index templates may not match during index creation, please use a different priority

It seems that this is a known issue.
To fix this problem, you have to run:
For more information, see:

Give it a try and tell me if the problem persists.

M V

unread,
Jul 8, 2024, 3:52:35 AM7/8/24
to Wazuh | Mailing List
Brilliant. I’ll execute it and revert tomorrow!

M V

unread,
Jul 8, 2024, 3:59:43 AM7/8/24
to Wazuh | Mailing List
You folks are amazing! 

I can't see visible errors in log anymore. Will monitor over few more days:
```
[2024-07-02T00:00:01,386][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
  2 [2024-07-02T00:00:20,904][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
  3 [2024-07-02T00:05:20,904][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
  4 [2024-07-02T00:05:20,938][INFO ][o.o.a.t.CronTransportAction] [scanner] Start running AD hourly cron.
  5 [2024-07-02T00:05:20,939][INFO ][o.o.a.t.ADTaskManager    ] [scanner] Start to maintain running historical tasks
  6 [2024-07-02T00:05:20,941][INFO ][o.o.a.c.HourlyCron       ] [scanner] Hourly maintenance succeeds
  7 [2024-07-02T00:05:20,943][ERROR][o.o.a.a.AlertIndices     ] [scanner] info deleteOldIndices
  8 [2024-07-02T00:05:20,944][INFO ][o.o.a.a.AlertIndices     ] [scanner] No Old Finding Indices to delete
  9 [2024-07-02T00:05:20,960][ERROR][o.o.a.a.AlertIndices     ] [scanner] info deleteOldIndices
 10 [2024-07-02T00:05:20,960][INFO ][o.o.a.a.AlertIndices     ] [scanner] Deleting old History indices viz []
 11 [2024-07-02T00:05:20,961][INFO ][o.o.i.i.IndexStateManagementHistory] [scanner] No Old History Indices to delete
 12 [2024-07-02T00:05:20,961][INFO ][o.o.a.a.AlertIndices     ] [scanner] .opendistro-alerting-alert-history-write not rolled over. Conditions were: {[max_age: 30d]=false, [max_docs: 1000]=false}
 13 [2024-07-02T00:05:20,985][INFO ][o.o.s.i.DetectorIndexManagementService] [scanner] No Old Alert Indices to delete
 14 [2024-07-02T00:05:20,987][INFO ][o.o.s.i.DetectorIndexManagementService] [scanner] No Old Finding Indices to delete
 15 [2024-07-02T00:10:20,907][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 16 [2024-07-02T00:15:00,515][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
 17 [2024-07-02T00:15:20,907][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 18 [2024-07-02T00:20:20,909][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 19 [2024-07-02T00:25:20,911][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 20 [2024-07-02T00:30:00,267][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
 21 [2024-07-02T00:30:20,911][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 22 [2024-07-02T00:35:20,912][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 23 [2024-07-02T00:40:20,912][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 24 [2024-07-02T00:45:01,013][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
 25 [2024-07-02T00:45:20,914][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 26 [2024-07-02T00:50:20,916][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 27 [2024-07-02T00:55:20,918][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 28 [2024-07-02T01:00:01,317][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
 29 [2024-07-02T01:00:20,920][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 30 [2024-07-02T01:05:20,922][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 31 [2024-07-02T01:05:20,938][INFO ][o.o.a.t.CronTransportAction] [scanner] Start running AD hourly cron.
 32 [2024-07-02T01:05:20,939][INFO ][o.o.a.t.ADTaskManager    ] [scanner] Start to maintain running historical tasks
 33 [2024-07-02T01:05:20,940][INFO ][o.o.a.c.HourlyCron       ] [scanner] Hourly maintenance succeeds
 34 [2024-07-02T01:10:20,924][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 35 [2024-07-02T01:15:00,433][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
 36 [2024-07-02T01:15:20,926][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 37 [2024-07-02T01:20:20,941][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 38 [2024-07-02T01:25:20,944][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 39 [2024-07-02T01:30:00,186][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
 40 [2024-07-02T01:30:20,946][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 41 [2024-07-02T01:35:20,959][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 42 [2024-07-02T01:40:20,960][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 43 [2024-07-02T01:45:00,941][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
[2024-07-02T01:45:20,961][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 45 [2024-07-02T01:50:20,962][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 46 [2024-07-02T01:55:20,962][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 47 [2024-07-02T02:00:00,659][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
 48 [2024-07-02T02:00:20,963][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 49 [2024-07-02T02:05:20,939][INFO ][o.o.a.t.CronTransportAction] [scanner] Start running AD hourly cron.
 50 [2024-07-02T02:05:20,939][INFO ][o.o.a.t.ADTaskManager    ] [scanner] Start to maintain running historical tasks
 51 [2024-07-02T02:05:20,940][INFO ][o.o.a.c.HourlyCron       ] [scanner] Hourly maintenance succeeds
 52 [2024-07-02T02:05:20,964][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 53 [2024-07-02T02:10:20,966][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 54 [2024-07-02T02:15:00,389][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
 55 [2024-07-02T02:15:20,967][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 56 [2024-07-02T02:20:20,967][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 57 [2024-07-02T02:25:20,968][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 58 [2024-07-02T02:30:00,132][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
 59 [2024-07-02T02:30:20,970][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 60 [2024-07-02T02:35:20,972][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 61 [2024-07-02T02:40:20,974][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 62 [2024-07-02T02:45:01,424][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
 63 [2024-07-02T02:45:20,978][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 64 [2024-07-02T02:50:20,979][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 65 [2024-07-02T02:55:20,980][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 66 [2024-07-02T03:00:00,600][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
 67 [2024-07-02T03:00:20,980][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 68 [2024-07-02T03:05:20,939][INFO ][o.o.a.t.CronTransportAction] [scanner] Start running AD hourly cron.
 69 [2024-07-02T03:05:20,940][INFO ][o.o.a.t.ADTaskManager    ] [scanner] Start to maintain running historical tasks
 70 [2024-07-02T03:05:20,940][INFO ][o.o.a.c.HourlyCron       ] [scanner] Hourly maintenance succeeds
 71 [2024-07-02T03:05:20,982][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 72 [2024-07-02T03:10:20,984][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 73 [2024-07-02T03:15:00,318][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
 74 [2024-07-02T03:15:20,985][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 75 [2024-07-02T03:20:20,990][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 76 [2024-07-02T03:25:20,993][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 77 [2024-07-02T03:30:01,068][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
 78 [2024-07-02T03:30:20,994][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 79 [2024-07-02T03:35:20,998][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 80 [2024-07-02T03:40:21,003][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 81 [2024-07-02T03:45:01,416][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
 82 [2024-07-02T03:45:21,005][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 83 [2024-07-02T03:50:21,007][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
 84 [2024-07-02T03:55:21,009][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
[2024-07-02T06:57:00,586][INFO ][o.o.c.m.MetadataMappingService] [scanner] [wazuh-alerts-4.x-2024.07.02/njil4R3FRPelcbtDnxzq8Q] update_mapping [_doc]
144 [2024-07-02T06:57:00,683][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [scanner] Detected cluster change event for destination migration
145 [2024-07-02T06:57:00,684][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [scanner] Reset destination migration process.
146 [2024-07-02T06:58:00,684][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [scanner] Performing migration of destination data.
147 [2024-07-02T06:58:00,691][INFO ][k.j.i.ClassReference     ] [scanner] Need to migrate 0 email accounts, 0 email groups and 0 destinations (0 configs total)
148 [2024-07-02T06:59:00,684][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [scanner] Cancel background destination migration process.
149 [2024-07-02T06:59:00,684][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [scanner] Performing migration of destination data.
150 [2024-07-02T06:59:00,685][INFO ][k.j.i.ClassReference     ] [scanner] Destination migration has finished.
151 [2024-07-02T06:59:35,566][INFO ][o.o.p.PluginsService     ] [scanner] PluginService:onIndexModule index:[wazuh-alerts-4.x-2024.07.02/njil4R3FRPelcbtDnxzq8Q]
152 [2024-07-02T06:59:35,579][INFO ][o.o.c.m.MetadataMappingService] [scanner] [wazuh-alerts-4.x-2024.07.02/njil4R3FRPelcbtDnxzq8Q] update_mapping [_doc]
153 [2024-07-02T06:59:35,618][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [scanner] Detected cluster change event for destination migration
154 [2024-07-02T06:59:35,618][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [scanner] Reset destination migration process.
155 [2024-07-02T07:00:01,611][INFO ][o.o.c.m.MetadataUpdateSettingsService] [scanner] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.27w]
156 [2024-07-02T07:00:21,077][INFO ][o.o.j.s.JobSweeper       ] [scanner] Running full sweep
157 [2024-07-02T07:00:35,618][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [scanner] Performing migration of destination data.
158 [2024-07-02T07:00:35,623][INFO ][k.j.i.ClassReference     ] [scanner] Need to migrate 0 email accounts, 0 email groups and 0 destinations (0 configs total)
159 [2024-07-02T07:01:35,618][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [scanner] Cancel background destination migration process.
160 [2024-07-02T07:01:35,619][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [scanner] Performing migration of destination data.
161 [2024-07-02T07:01:35,619][INFO ][k.j.i.ClassReference     ] [scanner] Destination migration has finished.
```

On Sunday, June 30, 2024 at 11:57:48 PM UTC-7 Tomas Sarquis wrote:
Reply all
Reply to author
Forward
0 new messages