Wazuh manager 4.11 installing from sources

[Rasm...@live.dk]

I recently tried installing the manager from sources without succes.

I followed the guide: https://documentation.wazuh.com/current/deployment-options/wazuh-from-sources/wazuh-server/index.html

i installed dependencies:
cmake + python gcc g++ make libc6-dev curl policycoreutils automake autoconf libtool libssl-dev procps

i downloaded and extracted the latest version.

i ran  apt install libgeoip-dev

I compiled with flags: make  make TARGET=server USE_GEOIP=yes

i did DOWNLOAD_CONTENT=y ./install.sh

After installation the manager runs initially but even restarting after making no changes to any files, it fails on start.


Logs:

root@xxxx:/home/rasmus# sudo tail -f /var/ossec/logs/api.log 2025/02/25 08:51:19 INFO: Generated private key file in WAZUH_PATH/api/configuration/ssl/server.key 2025/02/25 08:51:19 INFO: Generated certificate file in WAZUH_PATH/api/configuration/ssl/server.crt 2025/02/25 08:51:19 INFO: Checking RBAC database integrity... 2025/02/25 08:51:19 INFO: RBAC database not found. Initializing 2025/02/25 08:51:20 INFO: /var/ossec/api/configuration/security/rbac.db database created successfully 2025/02/25 08:51:20 INFO: RBAC database integrity check finished successfully 2025/02/25 08:51:22 INFO: Listening on ['0.0.0.0', '::']:55000. 2025/02/25 08:51:22 INFO: Populating installation UID... 2025/02/25 08:51:22 INFO: Getting updates information... 2025/02/25 08:56:36 INFO: Shutdown wazuh-apid server.


root@xxxx:/home/rasmus# sudo tail -f /var/ossec/logs/ossec.log 2025/02/25 08:56:34 wazuh-execd: INFO: (1314): Shutdown received. Deleting responses. 2025/02/25 08:56:34 wazuh-execd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning... 2025/02/25 08:56:34 wazuh-db: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning... 2025/02/25 08:56:35 wazuh-db: INFO: Graceful process shutdown. 2025/02/25 08:56:35 wazuh-authd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning... 2025/02/25 08:56:36 wazuh-authd: INFO: Exiting... 2025/02/25 08:56:37 wazuh-modulesd:router: INFO: Loaded router module. 2025/02/25 08:56:37 wazuh-modulesd:content_manager: INFO: Loaded content_manager module. 2025/02/25 08:57:43 wazuh-modulesd:router: INFO: Loaded router module. 2025/02/25 08:57:43 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.

systemctl status:

wazuh-manager.service - Wazuh manager Loaded: loaded (/etc/systemd/system/wazuh-manager.service; enabled; preset: enabled) Active: failed (Result: exit-code) since Tue 2025-02-25 08:58:45 UTC; 3min 0s ago Duration: 5min 3.978s Process: 34447 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=1/FAILURE) CPU: 2.716s Feb 25 08:57:43 wazuhtest2 env[34480]: 2025/02/25 08:57:43 wazuh-modulesd:content_manager: INFO: Loaded content_manager module. Feb 25 08:57:43 wazuhtest2 env[34447]: Starting Wazuh v4.11.0... Feb 25 08:57:44 wazuhtest2 env[34510]: wazuh-apid: Non existent process 34102, removing from /var/ossec/var/run... Feb 25 08:57:44 wazuhtest2 env[34511]: wazuh-apid: Non existent process 34102, removing from /var/ossec/var/run... Feb 25 08:57:44 wazuhtest2 env[34512]: wazuh-apid: Non existent process 34102, removing from /var/ossec/var/run... Feb 25 08:58:45 wazuhtest2 env[34447]: wazuh-apid did not start correctly. Feb 25 08:58:45 wazuhtest2 systemd[1]: wazuh-manager.service: Control process exited, code=exited, status=1/FAILURE Feb 25 08:58:45 wazuhtest2 systemd[1]: wazuh-manager.service: Failed with result 'exit-code'. Feb 25 08:58:45 wazuhtest2 systemd[1]: Failed to start wazuh-manager.service - Wazuh manager. Feb 25 08:58:45 wazuhtest2 systemd[1]: wazuh-manager.service: Consumed 2.716s CPU time, 154.4M memory peak, 0B memory swap peak.

[Enrique Araque Espinosa]

Hi,

To help you further, could you please tell me which OS you are trying to install the Wazuh manager on?

Thanks

[Rasm...@live.dk]

Im sorry. Ubuntu 24.04 LTS

[Rasm...@live.dk]

Im sorry, Ubuntu 24.04 LTS

On Tuesday, February 25, 2025 at 4:47:27 PM UTC+1 Enrique Araque Espinosa wrote:

[Enrique Araque Espinosa]

Hi, sorry for the delay.

I have been trying to reproduce the issue you are facing, but after following the same steps (except for make TARGET=server which I did not run on my machine), the manager starts without any problems.

To assist you further, could you confirm if you have any other Wazuh components installed on this machine, or are you only trying to install the manager?

Additionally, could you provide the logs from `journalctl` using the following command?
journalctl -u wazuh-manager --no-pager


From the logs you shared, the issue seems to be related to wazuh-apid. One possible cause could be that Python is not properly installed or configured in the manager.

To verify if the required Python modules are installed correctly, please run:
/var/ossec/framework/python/bin/python3 -m pip list | grep wazuh

Let me know what output you get from these commands so we can troubleshoot further.

[Rasm...@live.dk]

All good! Thank you for helping =)

/var/ossec/framework/python/bin/python3 -m pip list | grep wazuh

wazuh                     4.11.0

journalctl -u wazuh-manager --no-pager:

Feb 28 13:41:31 wazuhtest2 env[895]: Starting Wazuh v4.11.0...
Feb 28 13:41:33 wazuhtest2 env[1156]: wazuh-apid: Non existent process 2659, removing from /var/ossec/var/run...
Feb 28 13:41:33 wazuhtest2 env[1159]: wazuh-apid: Non existent process 2659, removing from /var/ossec/var/run...
Feb 28 13:41:33 wazuhtest2 env[1160]: wazuh-apid: Non existent process 2659, removing from /var/ossec/var/run...
Feb 28 13:42:34 wazuhtest2 env[895]: wazuh-apid did not start correctly.
Feb 28 13:42:34 wazuhtest2 systemd[1]: wazuh-manager.service: Control process exited, code=exited, status=1/FAILURE
Feb 28 13:42:34 wazuhtest2 systemd[1]: wazuh-manager.service: Failed with result 'exit-code'.
Feb 28 13:42:34 wazuhtest2 systemd[1]: Failed to start wazuh-manager.service - Wazuh manager.
Feb 28 13:42:34 wazuhtest2 systemd[1]: wazuh-manager.service: Consumed 5.303s CPU time.
Feb 28 13:42:43 wazuhtest2 systemd[1]: Starting wazuh-manager.service - Wazuh manager...
Feb 28 13:42:44 wazuhtest2 env[1838]: 2025/02/28 13:42:44 wazuh-modulesd:router: INFO: Loaded router module.
Feb 28 13:42:44 wazuhtest2 env[1838]: 2025/02/28 13:42:44 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.

[Enrique Araque Espinosa]

Hi,

Could you please send me the output of the following commands?

cat /var/ossec/logs/ossec.log | grep -i -E "error|warn|fatal|crit"
cat /var/ossec/logs/api.log | grep -i -E "error|warn|fatal|crit"

Thank you! This will help to see in more detail where the error might be coming from.

[Rasm...@live.dk]

Hello Enrique.

Since ur message i have tried reinstalling a couple of times. Out of nowhere the problem seems to have resolved itself.

Before putting this thread to bed, could u perhaps help me with a burning question?

When upgrading a wazuh manager compiled with my flags  make TARGET=server USE_GEOIP=yes  :
Is there anything i should be aware of when upgrading the version? Or do i just follow the guides already available in the official documentation?

i cant seem to find any information regarding this in documentation of here in the group.

Thanks alot!!

[Enrique Araque Espinosa]

Hi,

I'm glad your issue has been resolved!

You can continue using those make options without any problems. Just follow the same documentation you used to download Wazuh from sources (making sure to use the documentation for the version you want to upgrade to). When you run the install.sh script, it will detect that you already have a Wazuh installation and ask if you want to update it to this new version.

Best regards.