Docker and reset configurations after host reboot

[Tech Master]

Hello,

I'm experiencing a data persistence problem.
Whenever I restart the host server (Ubuntu Server 20.04.4) Wazuh Docker v4.3.5 does not reload the ossec.conf configuration file with the customizations: it is in the reset / default state.
Every time I have to re-add the settings for syslog server, for vulnerability scan, etc.

[Franco Giovanolli]

Hi TechMaster,

Thank you for using Wazuh.

I think it may be related to the volumes. Could you share the docker-compose manifest you are using?

[Tech Master]

Hi Franco,

the docker-compose file is the standard single node deployment. The only difference is the custom admin password:

wazuh.manager and wazuh.dashboard:

       - ELASTIC_USERNAME = admin
       - ELASTIC_PASSWORD = mynewpassword

[HA]

Hi all,

Same issue for me with release 4.3.4.

Vulnerability settings are set to off (back to default value) after docker-compose down/up

Regards,

HA 

[Tech Master]

Regardless of the type of mount (volumes, named or bind mounts), having never performed a docker-compose down, but only the reboot of the host, the deletion of the containers absolutely does not happen, for this reason I find it as an anomaly.

[Tech Master]

Hi Franco,

have you tried to restart a host with Wazuh Docker 4.3.5 after changing even a single parameter in ossec.conf even only from the GUI?
Let me know!

[Franco Giovanolli]

Hi! Forgive my delay.

I see that it is a repeated behavior. I'm going to do the same test and I'm going to consult it with the team in charge of the development of the docker deployment. I'll get back to you as soon as possible.

F.

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/5c571c92-8b91-4512-a27a-5a3d71a70acbn%40googlegroups.com.

--

Franco Giovanolli Cloud Team The Open Source Security Platform

[Mayler Saíd]

Hello, you can consult the two links below to better understand how file persistence file config works using wazuh's docker.

https://groups.google.com/g/wazuh/c/yULmvyYW-Mg/m/_4wlvKImCAAJ

https://loggar.hashnode.dev/configuring-wazuh-single-node-data-volumes

Opening docker-compose inside multi-node:

You can use the same path to transfer your personal configuration to wazuh docker.

- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf

The RED part its or backup files that we want to map and transfer to wazuh docker image when we UP the image. You need to copy the config that you want that follow the image and will work fine.

The Green part its a folder inside the Wazuh-Manager-Master and Worker that is used to read the file located in - ./config/wazuh_cluster and than copy to the directory (/var/ossec/etc/ossec.conf.

You can do this with any specific file that you want, you just need to target ./config/wazuh_cluster(inside wazuh-docker) and the file will copy to /wazuh-config-mount and than copy to the original destination