Wazuh Agent fail "the control process exited with error code"

[Jordan Empresas]

Hello everyone,

Please anyone can help me with this problem:

root@newcarganuvera:/home/nuvera# systemctl daemon-reload
root@newcarganuvera:/home/nuvera# systemctl enable wazuh-agent
root@newcarganuvera:/home/nuvera# systemctl start wazuh-agent

Job for wazuh-agent.service failed because the control process exited with error code.
See "systemctl status wazuh-agent.service" and "journalctl -xeu wazuh-agent.service" for details.

the configuration ossec.conf: 

The Ip server is Ok

<ossec_config>
  <client>
    <server>
      <address>10.0.0.16</address>
      <port>1514</port>
      <protocol>tcp</protocol>
    </server>
    <config-profile>ubuntu, ubuntu24, ubuntu24.04</config-profile>
    <notify_time>10</notify_time>
    <time-reconnect>60</time-reconnect>
    <auto_restart>yes</auto_restart>
    <crypto_method>aes</crypto_method>
    <enrollment>
      <enabled>yes</enabled>
      <agent_name>newcarganuvera</agent_name>
      <groups>Servers_Linux_OnPremise</groups>
      <authorization_pass_path>etc/authd.pass</authorization_pass_path>
    </enrollment>
  </client>

  <client_buffer>
    <!-- Agent buffer options -->
    <disabled>no</disabled>
    <queue_size>5000</queue_size>
    <events_per_second>500</events_per_second>
  </client_buffer>

The commands:

 cat /var/ossec/logs/ossec.log  > (doesn't show anything)

 journalctl -xeu wazuh-agent.service

 The process' exit code is 'exited' and its exit status is 203.
feb 05 13:26:37 newcarganuvera systemd[1]: wazuh-agent.service: Failed with result 'exit-code'.
 Subject: Unit failed
Defined-By: systemd
 Support: http://www.ubuntu.com/support

 The unit wazuh-agent.service has entered the 'failed' state with result 'exit-code'.
feb 05 13:26:37 newcarganuvera systemd[1]: Failed to start wazuh-agent.service - Wazuh agent.
 Subject: A start job for unit wazuh-agent.service has failed
 Defined-By: systemd
Support: http://www.ubuntu.com/support

 A start job for unit wazuh-agent.service has finished with a failure.

 The job identifier is 27342 and the job result is failed.
feb 05 13:39:04 newcarganuvera systemd[1]: Starting wazuh-agent.service - Wazuh agent...
Subject: A start job for unit wazuh-agent.service has begun execution
 Defined-By: systemd
 Support: http://www.ubuntu.com/support

A start job for unit wazuh-agent.service has begun execution.

 The job identifier is 27970.
feb 05 13:39:04 newcarganuvera systemd[1]: wazuh-agent.service: Control process exited, code=exited, status=203/EXEC
 Subject: Unit process exited
Defined-By: systemd
 Support: http://www.ubuntu.com/support

 An ExecStart= process belonging to unit wazuh-agent.service has exited.

 The process' exit code is 'exited' and its exit status is 203.
feb 05 13:39:04 newcarganuvera systemd[1]: wazuh-agent.service: Failed with result 'exit-code'.
 Subject: Unit failed
Defined-By: systemd
 Support: http://www.ubuntu.com/support

The unit wazuh-agent.service has entered the 'failed' state with result 'exit-code'.
feb 05 13:39:04 newcarganuvera systemd[1]: Failed to start wazuh-agent.service - Wazuh agent.
 Subject: A start job for unit wazuh-agent.service has failed
 Defined-By: systemd
 Support: http://www.ubuntu.com/support

 A start job for unit wazuh-agent.service has finished with a failure.

 The job identifier is 27970 and the job result is failed.

 ps -aux | grep wazuh

root       36217  0.0  0.1   6544  2304 pts/1    S+   13:48   0:00 grep --color=auto wazuh

the versión of the server with the agent is:

Distributor ID: Ubuntu
Description:    Ubuntu 24.04 LTS
Release:        24.04
Codename:       noble

Thanks.

[Eric Franco Fahnle]

Hi!

It looks to me like a configuration file issue, although I might be wrong. Could you share the full ossec.conf file? 

Can you reach the server from the agent on the enrollment ports? Try

nc -zv 10.0.0.16 1514 1515 

You can also try to put the agent in debug mode to see what could be the issue https://documentation.wazuh.com/current/user-manual/reference/internal-options.html#agent

In /var/ossec/etc/local_internal_options.conf put agent.debug=2

Do you see any errors in the /var/ossec/logs/ossec.log file on the manager side? (I understand that the cat command you mention was ran on the agent)