Wazuh vulnerability

[Lucas Veríssimo]

  I am receiving this message when checking the logs with the command:

cat /var/ossec/logs/ossec.log | grep -i -E "vulnerability"
ERROR = 2024/08/02 11:50:05 wazuh-modulesd:vulnerability-scanner: ERROR: VulnerabilityScannerFacade::start: Failed to open RocksDB database. Reason: While opening a file for sequentially reading: queue/vd/event/MANIFEST-000005: No such file or directory

I am not receiving the vulnerabilities from all agents. How can I proceed to fix this issue?

[Manuel Jose Cano Rojo]

Hello Lucas!

This is a known issue that we have been tracking here. The fix will come in upcoming versions. In the meantime, you could follow these steps:

• • Stop the manager
  • Remove /var/ossec/queue/indexer/wazuh-states-vulnerabilities-name file
  • Start the manager

Doing so should regenerate those files.

Hope it helps!

[Emre Erdem]

Hi Manuel Jose,

I have the same problem but I tried the solution you showed but unfortunately my problem persists.

I deleted the vuln file in this file and stopped / started /var/ossec/queue/indexer again but it didn't work. In fact, there was another file called db under this file and I deleted it and stopped / started again. The problem persists.

Error log:

cat /var/ossec/logs/ossec.log | grep -iE "vuln"

wazuh-modulesd:vulnerability-scanner: ERROR: VulnerabilityScannerFacade::start: Failed to open RocksDB database. Reason: While opening a file for sequentially reading: queue/vd/event/MANIFEST-000005: No such file or directory

BEST REGARDS

29 Ağustos 2024 Perşembe tarihinde saat 09:48:58 UTC+3 itibarıyla Manuel Jose Cano Rojo şunları yazdı:

[Lucas Veríssimo]

Thanks for the comments. Exactly, the error still persists, the file is removed, but when the manager starts, a new file is generated.

[Manuel Jose Cano Rojo]

Hi Lucas and Emre!

I'm sorry for not getting back to you sooner. As you mentioned Lucas, the file should be regenerated after restarting, so the reported behavior is expected. The official fix for this issue is planned to be released in 4.10.0 version, you can see it here: https://github.com/wazuh/wazuh/pull/24333

I hope it helps!