Wazuh Main Server installation error : User is not registered in Wazuh API

[Noa LEDET]

Hi !

I'm having trouble to install Wazuh server.

I have indeed successfully installed Wazuh Indexer and Wazuh Dashboard (both on different server (Ubuntu 26.04 LTS)) but when I try to install Wazuh Main Server on another server (which is turning on Ubuntu 24.04.3 LTS) I'm having an error : "User  is not registered in Wazuh API".

The script then removes Wazuh Server from the server without providing any further information about the cause of the failure.

Two log file is uploaded with this report.

In total I have three server :

• Wazuh Indexer Server (Ubuntu 26.04 LTS)
• Wazuh Main Server (Ubuntu 24.04.3 LTS)
• Wazuh Dashboard Server (Ubuntu 26.04 LTS)

Can you help me resolving this issue ?

[Olamilekan Abdullateef Ajani]

Hello,

Thanks for sharing the logs. The Wazuh manager installation itself looks successful based on what you shared, the manager installs and starts correctly, and Filebeat is also installed and configured.

The failure happens afterwards, when the installation assistant reaches the password configuration step and communicates with the local Wazuh API on port 55000.

Regarding this message: ERROR: User is not registered in Wazuh API

There is no username shown after User. This suggests that the installer did not receive a usable list of API users, rather than a specific API user simply being missing.

You need to check whether the Wazuh API is actually starting and responding correctly on the server.

Since the assistant automatically removes the manager after the failure, we need to isolate the issue by installing and starting the manager temporarily and test the API directly:


apt-get install -y wazuh-manager
systemctl start wazuh-manager
sleep 30

/var/ossec/bin/wazuh-control status | grep apid
ss -lntp | grep 55000

curl -k -u wazuh:wazuh -X POST "https://localhost:55000/security/user/authenticate?raw=true"


If that returns a JWT token, the API itself is working, and we can then look at the installation files/password configuration.

If it times out or the connection is refused, please check:

tail -n 100 /var/ossec/logs/api.log
journalctl -u wazuh-manager -n 100 --no-pager

If it returns invalid credentials, please share.

Lastly, please verify that you are using the same wazuh-install-files.tar originally generated for the deployment on all three nodes and that wazuh-1 matches the server name in the original config.yml. You can verify the API users in the tarball locally without posting the passwords.

That said, one little thing to bring to your attention is with the environment, Ubuntu 26.04 is currently not a supported OS for the Wazuh central components, the supported Ubuntu versions currently stop at 24.04. I don't think that explains this particular local API failure on your Ubuntu 24.04 server, but I would recommend moving the indexer and dashboard to a supported OS version as well.

I await feedback from you.

[Noa LEDET]

Hi !

Thanks your for trying to help me !

I manually installer wazuh-manager.

Indeed, when using these command : 

/var/ossec/bin/wazuh-control status | grep apid
ss -lntp | grep 55000
curl -k -u wazuh:wazuh -X POST "https://localhost:55000/security/user/authenticate?raw=true"

I have this result : 

root@srv-wazuh-server:~# /var/ossec/bin/wazuh-control status | grep apid

ss -lntp | grep 55000

curl -k -u wazuh:wazuh -X POST "https://localhost:55000/security/user/authenticate?raw=true"

wazuh-apid is running...
curl: (7) Failed to connect to localhost port 55000 after 0 ms: Couldn't connect to server

As for the logs, you can find it attached.

For the Indexer server, when installed on Ubuntu 26.04 LTS, I didn't had any error so I asume it's working well since I can connect on it from any server I have on the same local network. As for the Dashboard, I don't have tested yet.

[Olamilekan Abdullateef Ajani]

Hello,

Thank you for the log shared, it confirms the issue is with the Wazuh API itself.

Although: wazuh-apid is running...

Reports show nothing is actually listening on port 55000, and the connection is refused. So the earlier "User is not registered in Wazuh API" message is probably just a result of the installer being unable to communicate with the API.

We can try to start the API in the foreground so we can see the actual startup error.

First stop the manager: systemctl stop wazuh-manager

Then make sure there are no remaining API processes: ps -ef | grep wazuh_apid

If there are still wazuh_apid.py processes left after stopping the service, terminate them and run:

/var/ossec/bin/wazuh-apid -fdd

Please share the output from that command. A successful start should eventually show that the API is listening on port 55000. Running it in the foreground should expose the error that isn't currently obvious from wazuh-control.

You can also check the following too and share:

free -h
swapon --show
dmesg -T | grep -iE "out of memory|oom-kill|killed process"

ls -la /var/ossec/api/configuration/security/
grep -vE '^\s*#|^\s*$' /var/ossec/api/configuration/api.yaml


Your API configuration should normally use port 55000, and the default configuration allows it to listen on IPv4 and IPv6.

Please let me know what you find