Dashboard problem when upgrading from 4.7.5 to 4.8.1

[Massimiliano De Falco]

Good morning to all,

I have wazuh server installed on ubuntu 22.04 and I have upgraded the wazuh from 4.7.5 version to 4.8.1 using the apt-get update and apt-get upgrade commands.

When the installation ask me about the "configuration file /etc/wazuh-dashboard/opensearch_dashboards.yml" I have answer "yes" to "install the package maintainer's version" and now the dasboard have errors and do not start correctly.

by the command

watch systemctl status wazuh-dashboard

I can view some line with wazuh-dashboard.service: Failed with result 'exit-code'

and the web interface do not start.

Can you help me to solve this issue, thanks.

[Jethro Mic]

Hello,

Rollack and follow the guide :

https://documentation.wazuh.com/current/upgrade-guide/index.html

Many things have changed between the two versions.

And Check if the certs in :

/etc/wazuh-dashboard/certs/ 

have a correct name in :

/etc/wazuh-dashboard/opensearch_dashboards.yml

[Mohamed El Amine Gaoudi]

Hello Massimiliano, Regarding the issue with your Wazuh Dashboard after upgrading to version 4.8.0 Let's address this promptly.

1. Upgrade Process: It's important to note that upgrading Wazuh components using apt-get upgrade may not always be suitable, as it can overwrite configurations. For a successful upgrade, please follow our official upgrade guide  This guide provides specific instructions to ensure a smooth transition without configuration conflicts.
2. Dashboard upgrade: Here you will find the specific guide to follow for the dashboard upgrade
3. Dashboard Error: The error you're experiencing with the Wazuh Dashboard failing to start could be related to missing configuration parameters in the /etc/wazuh-dashboard/opensearch_dashboards.yml file, Please check the content of your /etc/wazuh-dashboard/opensearch_dashboards.yml file to ensure it has the correct configuration parameters. If possible, Could you kindly share this file with us for further inspection? Please censor any sensitive information while sharing (e.g., Ip addresses)
4. Troubleshooting:

        Review the Wazuh Dashboard logs to identify any issues. You can use the following commands and please share those logs with us as well if possible, keep in mind not to share any sensitive information.

journalctl -u wazuh-dashboard -f -n 50 journalctl -u wazuh-dashboard --no-pager | grep -iE "error|warn|fail"

[Massimiliano De Falco]

Good morning Mohamed, thanks for your answer. The problem is about a lot of file. I ask you how can I completely uninstall / remove the actual installation and use the official guide to re-install.

Thanks. 

[Mohamed El Amine Gaoudi]

You can uninstall all the Wazuh central components using the Wazuh installation assistant.
Which is a script used for assisted installation, you can use the same script for uninstallation as well by choosing these options:

Run the assistant with the option `-u` or `--uninstall` as follows:

sudo bash wazuh-install.sh --uninstall
This will remove the Wazuh indexer, the Wazuh server, and the Wazuh dashboard.
If you want to uninstall one specific central component, follow these instructions:

Uninstall the Wazuh dashboard:

yum remove wazuh-dashboard -y
rm -rf /var/lib/wazuh-dashboard/
rm -rf /usr/share/wazuh-dashboard/
rm -rf /etc/wazuh-dashboard/

Uninstall the Wazuh server:

- Remove the Wazuh manager installation:

yum remove wazuh-manager -y
rm -rf /var/ossec/

- Disable the Wazuh manager service:

systemctl disable wazuh-manager
systemctl daemon-reload

- Remove the Filebeat installation:

yum remove filebeat -y
rm -rf /var/lib/filebeat/
rm -rf /usr/share/filebeat/
rm -rf /etc/filebeat/

Uninstall the Wazuh indexer:

- Remove the Wazuh indexer installation:

yum remove wazuh-indexer -y
rm -rf /var/lib/wazuh-indexer/
rm -rf /usr/share/wazuh-indexer/
rm -rf /etc/wazuh-indexer/

I'm happy to share our comprehensive documentation with you. It contains a lot of useful information about various Wazuh functionalities.