ERR_BAD_REQUEST while saving rule files – API reports daemons restarting, but backend shows all running

[Rahul Manoj]

Hi Team,

I’m facing an issue while editing and saving rule files from the Wazuh Dashboard.

  Whenever I try to make any change to a rule file (even a minor edit) and click Save, the operation fails with the following error:

Wazuh API error: ERR_BAD_REQUEST - Some Wazuh daemons are not ready yet
(wazuh-modulesd -> restarting,
 wazuh-analysisd -> restarting,
 wazuh-execd -> restarting,
 wazuh-db -> restarting,

AxiosError: Wazuh API error: ERR_BAD_REQUEST - Some Wazuh daemons are not ready yet in node01  (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)     at settle (https://node01/47502/bundles/plugin/wazuh/wazuh.plugin.js:8:20234)     at XMLHttpRequest.onloadend (https://node01/47502/bundles/plugin/wazuh/wazuh.plugin.js:8:25708)

 wazuh-remoted -> restarting)  

This happens consistently across multiple rule files. I checked the status of all Wazuh daemons on the backend using the CLI.  All daemons mentioned in the error message are shown as running on the backend and are not in a restarting state.  Despite this, the Dashboard/API continues to report them as “restarting” and blocks the save operation.

could you suggest a work around for this as this has stopped the ability to update rule files from gui.

Thank you

[Olamilekan Abdullateef Ajani]

Hello,

When you try to save a rule from the Wazuh GUI, Wazuh triggers a restart of the manager demons to apply the changes. This fails because the daemons you mentioned are part of the health check, and their status shows restarting. You will get the AxiosError when the manager daemons are not fully restarted or there are permission issues too.

Since you confirmed on the terminal their status shows as running, the problem could be a sync, timing, or cache issue between the API and the Wazuh manager itself.

What version of the Wazuh instance do you run?

We could do a quick inspection from the dashboard and navigate to Server Management > Status and check the status of the daemons. You can try to restart the Wazuh manager from there, refresh after 20 to 30 seconds, check the status again, and then try to save a rule and see the outcome.

Please see the attachment for reference and let me know the outcome.