Wazuh-Agent Update Failure and Rollback Due to Missing State File
blueack
I created a WPK using the custom configuration and sent a remote update command to the Linux system, but it failed and rolled back.
It seems like the installation completed successfully, but when I try to stop the wazuh-agent service, it throws an error saying that the wazuh-agentd.state file is missing.
2024/09/24 14:22:32 - Waiting for connection... Status = pending. Remaining attempts: 4.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
Below is the log from the failed client update:
2024/09/24 14:22:01 - Generating Backup.
tar: ./var/ossec/queue/alerts/execq: socket ignored
tar: ./var/ossec/queue/alerts/cfgaq: socket ignored
tar: ./var/ossec/queue/sockets/com: socket ignored
tar: ./var/ossec/queue/sockets/queue: socket ignored
tar: ./var/ossec/queue/sockets/syscheck: socket ignored
tar: ./var/ossec/queue/sockets/logcollector: socket ignored
tar: ./var/ossec/queue/sockets/wmodules: socket ignored
tar: ./var/ossec/queue/sockets/upgrade: socket ignored
tar: ./var/ossec/queue/sockets/control: socket ignored
2024/09/24 14:22:03 - Upgrade started.
Wazuh v4.5.4 (Rev. 40510) Installation Script - https://www.wazuh.com
You are about to start the installation process of Wazuh.
You must have a C compiler pre-installed in your system.
- System: Linux pmo-ti 3.10.0-1160.66.1.el7.x86_64 (centos 7.9)
- User: root
- Host: pmo-ti
-- Press ENTER to continue or Ctrl-C to abort. --
- You already have Wazuh installed. Do you want to update it? (y/n):
- Installation will be made at /var/ossec .
4- Installing the system
DIR="/var/ossec"
- Running the Makefile
Stopping Wazuh...
agent
Wait for success...
success
Removing old SCA policies...
Installing SCA policies...
Wait for success...
success
Starting Wazuh...
Job for wazuh-agent.service failed because the control process exited with error code. See "systemctl status wazuh-agent.service" and "journalctl -xe" for details.
- Configuration finished properly.
- To start Wazuh:
/var/ossec/bin/wazuh-control start
- To stop Wazuh:
/var/ossec/bin/wazuh-control stop
- The configuration can be viewed or modified at /var/ossec/etc/ossec.conf
Thanks for using Wazuh.
Please don't hesitate to contact us if you need help or find
any bugs.
Use our public Mailing List at:
https://groups.google.com/forum/#!forum/wazuh
More information can be found at:
- http://www.wazuh.com
--- Press ENTER to finish (maybe more information below). ---
- Update completed.
2024/09/24 14:22:06 - Installation result = 0
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:07 - Waiting connection... Status = pending. Remaining attempts: 29.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:08 - Waiting connection... Status = pending. Remaining attempts: 28.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:09 - Waiting connection... Status = pending. Remaining attempts: 27.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:10 - Waiting connection... Status = pending. Remaining attempts: 26.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:11 - Waiting connection... Status = pending. Remaining attempts: 25.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:12 - Waiting connection... Status = pending. Remaining attempts: 24.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:13 - Waiting connection... Status = pending. Remaining attempts: 23.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:14 - Waiting connection... Status = pending. Remaining attempts: 22.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:15 - Waiting connection... Status = pending. Remaining attempts: 21.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:16 - Waiting connection... Status = pending. Remaining attempts: 20.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:17 - Waiting connection... Status = pending. Remaining attempts: 19.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:18 - Waiting connection... Status = pending. Remaining attempts: 18.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:19 - Waiting connection... Status = pending. Remaining attempts: 17.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:20 - Waiting connection... Status = pending. Remaining attempts: 16.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:21 - Waiting connection... Status = pending. Remaining attempts: 15.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:22 - Waiting connection... Status = pending. Remaining attempts: 14.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:23 - Waiting connection... Status = pending. Remaining attempts: 13.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:24 - Waiting connection... Status = pending. Remaining attempts: 12.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:25 - Waiting connection... Status = pending. Remaining attempts: 11.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:26 - Waiting connection... Status = pending. Remaining attempts: 10.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:27 - Waiting connection... Status = pending. Remaining attempts: 9.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:28 - Waiting connection... Status = pending. Remaining attempts: 8.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:29 - Waiting connection... Status = pending. Remaining attempts: 7.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:30 - Waiting connection... Status = pending. Remaining attempts: 6.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:31 - Waiting connection... Status = pending. Remaining attempts: 5.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:32 - Waiting connection... Status = pending. Remaining attempts: 4.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:33 - Waiting connection... Status = pending. Remaining attempts: 3.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:34 - Waiting connection... Status = pending. Remaining attempts: 2.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:35 - Waiting connection... Status = pending. Remaining attempts: 1.
./var/upgrade/src/init/pkg_installer.sh: line 207: ./var/run/wazuh-agentd.state: No such file or directory
2024/09/24 14:22:36 - Waiting connection... Status = pending. Remaining attempts: 0.
2024/09/24 14:22:36 - Upgrade failed. Restoring...
wazuh-modulesd not running...
wazuh-logcollector not running...
wazuh-syscheckd not running...
wazuh-agentd not running...
wazuh-execd not running...
Wazuh v4.5.4 Stopped
2024/09/24 14:22:36 - Deleting upgrade files...
2024/09/24 14:22:36 - Restoring backup....
2024/09/24 14:22:37 - Restoring SELinux policy.
Starting Wazuh v4.3.10...
Started wazuh-execd...
Started wazuh-agentd...
2024/09/24 14:23:06 wazuh-syscheckd: INFO: (6001): File integrity monitoring disabled.
Started wazuh-syscheckd...
Started wazuh-logcollector...
Started wazuh-modulesd...
Completed.
blueack
Server : v 4.5.4
hasitha.u...@wazuh.com
We can also try remote updating following this.
https://documentation.wazuh.com/4.5/user-manual/agents/remote-upgrading/upgrading-agent.html
Also, you can use the available WPK package.
https://documentation.wazuh.com/4.5/user-manual/agents/remote-upgrading/wpk-list.html
To creating custom WPK need to follow this
https://documentation.wazuh.com/4.5/user-manual/agents/remote-upgrading/create-custom-wpk/create-wpk-key.html
For further troubleshooting you can follow this.
https://documentation.wazuh.com/current/user-manual/agent/agent-enrollment/troubleshooting.html
To check further about the issue, please share the ossec.log.
cat /var/ossec/logs/ossec.log | grep -i -E "error|warn"
For further please check that /var/run/wazuh-agentd.state file exists or not and the permission.
Let me know if this helps.
Regards,
Hasitha Upekshitha