Error Wazuh Dashboard v4.7.5

[ShtrudelMan]

Good morning!
Hello, everyone!
I encountered this error when refreshing the Wazuh-Dashboard page:

"Error: Internal Server Error at Fetch._callee3$ (https://192.168.12.237/47502/bundles/core/core.entry.js:15:585158) at tryCatch (https://192.168.12.237/47502/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:786910) at Generator.invoke [as _invoke] (https://192.168.12.237/47502/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:790926) at Generator.next (https://192.168.12.237/47502/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:788105) at fetch_asyncGeneratorStep (https://192.168.12.237/47502/bundles/core/core.entry.js:15:578070) at _next (https://192.168.12.237/47502/bundles/core/core.entry.js:15:578386)"

[ShtrudelMan]

circuit_breaking_exception [parent] Data too large, data for [<reduce_aggs>] would be [1025902592/978.3mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1025902592/978.3mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=2160313/2mb, in_flight_requests=3772/3.6kb] Error: Too Many Requests at Fetch._callee3$ (https://192.168.12.237/47502/bundles/core/core.entry.js:15:585158) at tryCatch (https://192.168.12.237/47502/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:786910) at Generator.invoke [as _invoke] (https://192.168.12.237/47502/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:790926) at Generator.next (https://192.168.12.237/47502/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:788105) at fetch_asyncGeneratorStep (https://192.168.12.237/47502/bundles/core/core.entry.js:15:578070) at _next (https://192.168.12.237/47502/bundles/core/core.entry.js:15:578386)

понедельник, 2 сентября 2024 г. в 16:55:17 UTC+3, ShtrudelMan:

[Olusegun Adenrele Oyebo]

Hello,

As you can see from the logs, you have reached a circuit breakage exception, and you'll need to increase the Wazuh indexer heap size. The essence is to increase the performance of your Wazuh indexer. Edit the /etc/wazuh-indexer/jvm.options so as to increase the JVM heap size. The recommended value is half of the system RAM. For example, set the size as follows for a system with 8 GB of RAM:

-Xms4g
-Xmx4g

Where the total heap space:

• -Xms4g - initial size is set to 4Gb of RAM.
• -Xmx4g - maximum size is to 4Gb of RAM

Restart the Wazuh indexer and dashboard service:

• systemctl daemon-reload
• systemctl restart wazuh-indexer

Let me know if this resolves the issue.

Best regards.

[ShtrudelMan]

I changed the setting in “etc/wazuh-indexer/jvm.options” to the following values:
- Xms6g
- Xmx6g
Since my RAM capacity is 12GB.
Next I did a systemctl daemon-reload and systemctl restart wazuh-indexer.
But got the following notifications:
“Error: Error Pattern Handler (getPatternList)
    at pattern_handler_PatternHandler.getPatternList (https://192.168.12.237/48201/bundles/plugin/wazuh/wazuh.chunk.10.js:1:2192985)
    at async WzMenu.load (https://192.168.12.237/48201/bundles/plugin/wazuh/wazuh.chunk.10.js:1:2782725)
    at async WzMenu.componentDidUpdate (https://192.168.12.237/48201/bundles/plugin/wazuh/wazuh.chunk.10.js:1:2781160)”

понедельник, 2 сентября 2024 г. в 18:27:27 UTC+3, Olusegun Adenrele Oyebo:

[ShtrudelMan]

Hey, everybody!
These messages have now disappeared.
This is most likely due to the fact that I have 4 1TB hard disks on my server and they are combined into a RAID 1/0 array. And the processor is only 4 cores Intel Xeon from 2010. Although I have 12GB RAM, which is quite consistent with the requirements of Wazuh.

вторник, 3 сентября 2024 г. в 14:01:02 UTC+3, ShtrudelMan:

[ShtrudelMan]

I am also interested in a question related to learning the Wazuh platform itself. Since the product itself is based on OpenSearch, does it make sense to study the documentation on the OpenSearch website for better understanding, focusing on the version you use in the product, i.e. OpenSearch v2.10?

вторник, 3 сентября 2024 г. в 17:37:30 UTC+3, ShtrudelMan:

[Olusegun Adenrele Oyebo]

Hello,

I'm glad to hear that the issue has been resolved.

With regards to your second query, yes, studying the OpenSearch documentation is beneficial, and learning about OpenSearch can help you understand the underlying components like querying, indices, and dashboards.So combining both OpenSearch and Wazuh documentation will provide you with a deeper understanding of the platform’s capabilities.

Also note that the latest version of Wazuh i.e. v4.9 is based on OpenSearch dashoard 2.13.0. Reference below:

• https://github.com/wazuh/wazuh-dashboard-plugins/releases
  

We remain attentive to your queries.

Best regards.