Wazuh 4.14 - not displaying Mitre Att&&ck info

36 views
Skip to first unread message

Glyn Richards

unread,
Nov 6, 2025, 7:31:36 AM (5 days ago) Nov 6
to Wazuh | Mailing List
Hi we have just installed the latest version 4.14 when trying to display via the dashboard - we receive a message no results match your search critria..

Mauricio Aguilar

unread,
Nov 6, 2025, 8:02:50 AM (5 days ago) Nov 6
to Wazuh | Mailing List
Hi, 

* Run sudo /var/ossec/bin/agent_control -ls on the Wazuh manager to confirm the agent is active and connected.

* Verify that the Wazuh indexer is running and that indices are being created:
curl -u admin:admin -k https://localhost:9200/_cat/indices?v

* Check the manager logs to confirm that events are being generated:
tail -f /var/ossec/logs/ossec.log

Glyn Richards

unread,
Nov 10, 2025, 5:47:50 AM (19 hours ago) Nov 10
to Wazuh | Mailing List
Hi 

When i type in  curl -u admin:admin -k https://localhost:9200/_cat/indices?v
I get the following 
{"error":no handler found for the uri [/cat/incides] and method [GET}}

when i type in
tail -f /var/ossec/logs/ossec.log 

I get the following 

Error dbsync: bad response from Database :Cannot save syscheck

Mauricio Aguilar

unread,
Nov 10, 2025, 9:13:26 AM (15 hours ago) Nov 10
to Wazuh | Mailing List

Hi,


Index API error:

==============

The error

{"error":"no handler found for uri [/cat/incides] and method [GET]"}

seems to be caused by a small typo: it should be /cat/indices, not /cat/incides.

Please try again with the correct command:

Database sync error:

=================

The message

Error dbsync: bad response from Database :Cannot save syscheck

usually indicates that the Wazuh manager cannot communicate properly with its internal SQLite database.

This can happen if permissions or ownership were changed, or if the database is corrupted.

Please check:

ls -la /var/ossec/queue/db/

All files should be owned by wazuh:wazuh. If not, fix it with:

sudo chown -R wazuh:wazuh /var/ossec/queue/db

Then restart the manager:

sudo systemctl restart wazuh-manager

If the issue persists, you can try stopping the manager, deleting only the database file related to that agent (e.g., /var/ossec/queue/db/<agent-id>.db), and starting the service again — Wazuh will recreate it automatically.

Reply all
Reply to author
Forward
0 new messages