Wazuh dashboard server is not ready yet after update to 4.3.10

[David Perhacs]

Hello,

After updating my WAZUH server to 4.3.10, I've lost access to my dashboard. 
System is installed on Ubuntu 22.04, No clusters. Installed and updated via GIT.

I've tried everything I could find in the help items listed online that were even remotely close to my issue.

[Eduardo Leon Aldazoro]

Hi David, Thanks for using Wazuh!

Can you please answer me following questions so I can look further into your issue:

- What do you mean when you said you lost access to the dashboard? 

- Are you able to open the dashboard url? 

- Is it a credential issue? 

- Is there a specific error shown on the screen?

- What version were you using before the update?

- Did you use our upgrade guide? 

I'll be waiting for your response.

Best Regards,

[David Perhacs]

Hi Eduardo,

I get the "WAZUH Dashboard server is not ready yet".

Yes, I followed the guide when updating.
I was a 4.3.9 prior.

The server will show active when I run a status check and I am still receiving my emails from Wazuh.

[Eduardo Leon Aldazoro]

Hi David, thank you for the response

Looking at the message these are normally the reasons you might be getting this message:

- Wazuh-Dashboard is having a problem starting, could be a config issue or connection issue.

- Wazuh-Indexer is down therefore the Wazuh-Dashboard can't start.

You said server shows active after running the following command:

- systemctl status wazuh-dashboard

if that's the case you can check error logs for the Wazuh-Dashboard with the following command:

- journalctl -u wazuh-dashboard cat /usr/share/wazuh-dashboard/data/wazuh/logs/wazuhapp.log | grep -i -E "error|warn"

If you can't find any errors after running the command above, you can check the Wazuh-Indexer Status running the following command:

- systemctl status wazuh-indexer

If Wazuh-Indexer shows active you can look for errors in it running the following command:

- cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn"

or in case the file does not exist under that name search for the logs on folder `var/log/wazuh-indexer/`

You can also try restarting the services to fix any connection issue that occurred in the moment of your execution by running the following command:

- systemctl restart wazuh-indexer 

- systemctl restart wazuh-dashboard

You can check our documentation on troubleshooting Wazuh-dashboard for some common issues:

 If the solutions provided above are still not solving your issue don't hesitate to ask again by providing error logs if there are any or providing screenshots or whatever resource that can help us guide you through the issue.

Let me know if this helped,

Best Regards,

[David Perhacs]

Seems the indexer keeps failing. I can restart it but it will show active but with multiple WARN

Feb 10 19:03:58 XXXXX systemd[1]: Starting Wazuh-indexer...
Feb 10 19:04:38  XXXXX   systemd-entrypoint[4223]: WARNING: An illegal reflective access operation has occurred
Feb 10 19:04:38  XXXXX   systemd-entrypoint[4223]: WARNING: Illegal reflective access by io.protostuff.runtime.PolymorphicThrowableSchema (file:/usr/share/wazuh-indexer/plugi>
Feb 10 19:04:38  XXXXX   systemd-entrypoint[4223]: WARNING: Please consider reporting this to the maintainers of io.protostuff.runtime.PolymorphicThrowableSchema
Feb 10 19:04:38  XXXXX   systemd-entrypoint[4223]: WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
Feb 10 19:04:38  XXXXX   systemd-entrypoint[4223]: WARNING: All illegal access operations will be denied in a future release
Feb 10 19:04:43  XXXXX   systemd[1]: Started Wazuh-indexer.

[David Perhacs]

I am also getting a connection error for the dashboard

 opensearch-dashboards[988]: {"type":"log","@timestamp":"2023-02-10T19:35:53Z","tags":["error","opensearch","data"],"pid":988,"message":"[ConnectionEr>

[Eduardo Leon Aldazoro]

Hi David,

The warning you see Is a known issue from opensearch, as seen here, and you can see the explanation of the warning here.

It should not affect the behavior or functionality of the indexer.

Regarding the connection error on the dashboard:

You can get more information by checking the following log:

grep -i -E "error|warn" /var/log/wazuh-indexer/wazuh-indexer-cluster.log

Again if can't find the specific log file can look in /var/log/wazuh-indexer/

Also, can you confirm that your Wazuh-Dashboard configuration in /etc/wazuh-dashboard/opensearch_dashboards.yml is correct after the upgrade? 

You can look at our guide on Installing the Wazuh dashboard step by step to confirm it.

I hope this answers your question if not please let me know.

Best Regards,