Wazuh API down | Error 1017
739 views
Skip to first unread message
Phreak Evony
Sep 28, 2022, 7:15:38 AM9/28/22
to Wazuh mailing list
Hi All,
I have done a fresh install of wazuh in Ubuntu 22.04.1 LTS and Manager API is down due to the below error. Request all to please help how to resolve the issue.
#curl -u wazuh-wui:wazuh-wui -k -X GET "https://localhost:55000/security/user/authenticate?raw=true"
{"title": "Bad Request", "detail": "Some Wazuh daemons are not ready yet in node \"node01\" (wazuh-modulesd->failed, wazuh-analysisd->failed, wazuh-execd->failed, wazuh-db->failed, wazuh-remoted->failed)", "dapi_errors": {"node01": {"error": "Some Wazuh daemons are not ready yet in node \"node01\" (wazuh-modulesd->failed, wazuh-analysisd->failed, wazuh-execd->failed, wazuh-db->failed, wazuh-remoted->failed)"}}, "error": 1017}
{"title": "Bad Request", "detail": "Some Wazuh daemons are not ready yet in node \"node01\" (wazuh-modulesd->failed, wazuh-analysisd->failed, wazuh-execd->failed, wazuh-db->failed, wazuh-remoted->failed)", "dapi_errors": {"node01": {"error": "Some Wazuh daemons are not ready yet in node \"node01\" (wazuh-modulesd->failed, wazuh-analysisd->failed, wazuh-execd->failed, wazuh-db->failed, wazuh-remoted->failed)"}}, "error": 1017}
Complete ossec.log :-
2022/09/28 11:08:36 wazuh-modulesd:syscollector: INFO: Stop received for Syscollector.
2022/09/28 11:08:36 wazuh-modulesd:syscollector: INFO: Module finished.
2022/09/28 11:08:36 wazuh-logcollector: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2022/09/28 11:08:36 wazuh-syscheckd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2022/09/28 11:08:37 wazuh-execd: INFO: (1314): Shutdown received. Deleting responses.
2022/09/28 11:08:37 wazuh-execd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2022/09/28 11:08:37 wazuh-authd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2022/09/28 11:08:38 wazuh-authd: INFO: Exiting...
2022/09/28 11:08:40 wazuh-csyslogd: INFO: Remote syslog server not configured. Clean exit.
2022/09/28 11:08:40 wazuh-dbd: INFO: Database not configured. Clean exit.
2022/09/28 11:08:40 wazuh-integratord: INFO: Remote integrations not configured. Clean exit.
2022/09/28 11:08:40 wazuh-agentlessd: INFO: Not configured. Exiting.
2022/09/28 11:08:40 wazuh-authd: INFO: Started (pid: 118511).
2022/09/28 11:08:40 wazuh-authd: INFO: Accepting connections on port 1515. No password required.
2022/09/28 11:08:40 wazuh-authd: INFO: Setting network timeout to 1.000000 sec.
2022/09/28 11:08:42 wazuh-execd: INFO: Started (pid: 118556).
2022/09/28 11:08:44 wazuh-syscheckd: INFO: Started (pid: 118631).
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/bin', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/boot', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/etc', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/sbin', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/usr/bin', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/usr/sbin', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/mtab'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/hosts.deny'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/mail/statistics'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/random-seed'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/random.seed'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/adjtime'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/httpd/logs'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/utmpx'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/wtmpx'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/cups/certs'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/dumpdates'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/svc/volatile'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6207): Ignore 'file' sregex '.log$|.swp$'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6004): No diff for file: '/etc/ssl/private.key'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6000): Starting daemon...
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6010): File integrity monitoring scan frequency: 43200 seconds
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6008): File integrity monitoring scan started.
2022/09/28 11:08:44 rootcheck: INFO: Starting rootcheck scan.
2022/09/28 11:08:46 wazuh-logcollector: INFO: Monitoring output of command(360): df -P
2022/09/28 11:08:46 wazuh-logcollector: INFO: Monitoring full output of command(360): netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d
2022/09/28 11:08:46 wazuh-logcollector: INFO: Monitoring full output of command(360): last -n 20
2022/09/28 11:08:46 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/audit/audit.log'.
2022/09/28 11:08:46 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/ossec/logs/active-responses.log'.
2022/09/28 11:08:46 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/dpkg.log'.
2022/09/28 11:08:46 wazuh-logcollector: INFO: Started (pid: 118682).
2022/09/28 11:08:48 wazuh-syscheckd: INFO: (6009): File integrity monitoring scan ended.
2022/09/28 11:08:48 wazuh-modulesd: INFO: Started (pid: 118792).
2022/09/28 11:08:48 sca: INFO: Module started.
2022/09/28 11:08:48 wazuh-modulesd:ciscat: INFO: Module disabled. Exiting...
2022/09/28 11:08:48 sca: INFO: Loaded policy '/var/ossec/ruleset/sca/cis_ubuntu22-04.yml'
2022/09/28 11:08:48 wazuh-modulesd:osquery: INFO: Module disabled. Exiting...
2022/09/28 11:08:48 wazuh-modulesd:agent-upgrade: INFO: (8153): Module Agent Upgrade started.
2022/09/28 11:08:48 wazuh-modulesd:database: INFO: Module started.
2022/09/28 11:08:48 wazuh-modulesd:task-manager: INFO: (8200): Module Task Manager started.
2022/09/28 11:08:48 sca: INFO: Starting Security Configuration Assessment scan.
2022/09/28 11:08:48 wazuh-modulesd:download: INFO: Module started.
2022/09/28 11:08:48 wazuh-modulesd:control: INFO: Starting control thread.
2022/09/28 11:08:48 wazuh-modulesd:syscollector: INFO: Module started.
2022/09/28 11:08:48 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2022/09/28 11:08:48 sca: INFO: Starting evaluation of policy: '/var/ossec/ruleset/sca/cis_ubuntu22-04.yml'
2022/09/28 11:08:48 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2022/09/28 11:08:53 sca: INFO: Evaluation finished for policy '/var/ossec/ruleset/sca/cis_ubuntu22-04.yml'
2022/09/28 11:08:53 sca: INFO: Security Configuration Assessment scan finished. Duration: 5 seconds.
2022/09/28 11:09:08 rootcheck: INFO: Ending rootcheck scan.
root@ip-192-168-2-229:/var/ossec/bin# clear
root@ip-192-168-2-229:/var/ossec/bin# cat /var/ossec/logs/ossec.log
2022/09/28 11:08:36 wazuh-modulesd:syscollector: INFO: Stop received for Syscollector.
2022/09/28 11:08:36 wazuh-modulesd:syscollector: INFO: Module finished.
2022/09/28 11:08:36 wazuh-logcollector: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2022/09/28 11:08:36 wazuh-syscheckd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2022/09/28 11:08:37 wazuh-execd: INFO: (1314): Shutdown received. Deleting responses.
2022/09/28 11:08:37 wazuh-execd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2022/09/28 11:08:37 wazuh-authd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2022/09/28 11:08:38 wazuh-authd: INFO: Exiting...
2022/09/28 11:08:40 wazuh-csyslogd: INFO: Remote syslog server not configured. Clean exit.
2022/09/28 11:08:40 wazuh-dbd: INFO: Database not configured. Clean exit.
2022/09/28 11:08:40 wazuh-integratord: INFO: Remote integrations not configured. Clean exit.
2022/09/28 11:08:40 wazuh-agentlessd: INFO: Not configured. Exiting.
2022/09/28 11:08:40 wazuh-authd: INFO: Started (pid: 118511).
2022/09/28 11:08:40 wazuh-authd: INFO: Accepting connections on port 1515. No password required.
2022/09/28 11:08:40 wazuh-authd: INFO: Setting network timeout to 1.000000 sec.
2022/09/28 11:08:42 wazuh-execd: INFO: Started (pid: 118556).
2022/09/28 11:08:44 wazuh-syscheckd: INFO: Started (pid: 118631).
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/bin', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/boot', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/etc', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/sbin', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/usr/bin', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/usr/sbin', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/mtab'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/hosts.deny'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/mail/statistics'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/random-seed'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/random.seed'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/adjtime'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/httpd/logs'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/utmpx'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/wtmpx'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/cups/certs'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/dumpdates'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/svc/volatile'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6207): Ignore 'file' sregex '.log$|.swp$'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6004): No diff for file: '/etc/ssl/private.key'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6000): Starting daemon...
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6010): File integrity monitoring scan frequency: 43200 seconds
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6008): File integrity monitoring scan started.
2022/09/28 11:08:44 rootcheck: INFO: Starting rootcheck scan.
2022/09/28 11:08:46 wazuh-logcollector: INFO: Monitoring output of command(360): df -P
2022/09/28 11:08:46 wazuh-logcollector: INFO: Monitoring full output of command(360): netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d
2022/09/28 11:08:46 wazuh-logcollector: INFO: Monitoring full output of command(360): last -n 20
2022/09/28 11:08:46 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/audit/audit.log'.
2022/09/28 11:08:46 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/ossec/logs/active-responses.log'.
2022/09/28 11:08:46 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/dpkg.log'.
2022/09/28 11:08:46 wazuh-logcollector: INFO: Started (pid: 118682).
2022/09/28 11:08:48 wazuh-syscheckd: INFO: (6009): File integrity monitoring scan ended.
2022/09/28 11:08:48 wazuh-modulesd: INFO: Started (pid: 118792).
2022/09/28 11:08:48 sca: INFO: Module started.
2022/09/28 11:08:48 wazuh-modulesd:ciscat: INFO: Module disabled. Exiting...
2022/09/28 11:08:48 sca: INFO: Loaded policy '/var/ossec/ruleset/sca/cis_ubuntu22-04.yml'
2022/09/28 11:08:48 wazuh-modulesd:osquery: INFO: Module disabled. Exiting...
2022/09/28 11:08:48 wazuh-modulesd:agent-upgrade: INFO: (8153): Module Agent Upgrade started.
2022/09/28 11:08:48 wazuh-modulesd:database: INFO: Module started.
2022/09/28 11:08:48 wazuh-modulesd:task-manager: INFO: (8200): Module Task Manager started.
2022/09/28 11:08:48 sca: INFO: Starting Security Configuration Assessment scan.
2022/09/28 11:08:48 wazuh-modulesd:download: INFO: Module started.
2022/09/28 11:08:48 wazuh-modulesd:control: INFO: Starting control thread.
2022/09/28 11:08:48 wazuh-modulesd:syscollector: INFO: Module started.
2022/09/28 11:08:48 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2022/09/28 11:08:48 sca: INFO: Starting evaluation of policy: '/var/ossec/ruleset/sca/cis_ubuntu22-04.yml'
2022/09/28 11:08:48 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2022/09/28 11:08:53 sca: INFO: Evaluation finished for policy '/var/ossec/ruleset/sca/cis_ubuntu22-04.yml'
2022/09/28 11:08:53 sca: INFO: Security Configuration Assessment scan finished. Duration: 5 seconds.
2022/09/28 11:09:08 rootcheck: INFO: Ending rootcheck scan.
2022/09/28 11:08:36 wazuh-modulesd:syscollector: INFO: Module finished.
2022/09/28 11:08:36 wazuh-logcollector: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2022/09/28 11:08:36 wazuh-syscheckd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2022/09/28 11:08:37 wazuh-execd: INFO: (1314): Shutdown received. Deleting responses.
2022/09/28 11:08:37 wazuh-execd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2022/09/28 11:08:37 wazuh-authd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2022/09/28 11:08:38 wazuh-authd: INFO: Exiting...
2022/09/28 11:08:40 wazuh-csyslogd: INFO: Remote syslog server not configured. Clean exit.
2022/09/28 11:08:40 wazuh-dbd: INFO: Database not configured. Clean exit.
2022/09/28 11:08:40 wazuh-integratord: INFO: Remote integrations not configured. Clean exit.
2022/09/28 11:08:40 wazuh-agentlessd: INFO: Not configured. Exiting.
2022/09/28 11:08:40 wazuh-authd: INFO: Started (pid: 118511).
2022/09/28 11:08:40 wazuh-authd: INFO: Accepting connections on port 1515. No password required.
2022/09/28 11:08:40 wazuh-authd: INFO: Setting network timeout to 1.000000 sec.
2022/09/28 11:08:42 wazuh-execd: INFO: Started (pid: 118556).
2022/09/28 11:08:44 wazuh-syscheckd: INFO: Started (pid: 118631).
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/bin', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/boot', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/etc', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/sbin', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/usr/bin', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/usr/sbin', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/mtab'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/hosts.deny'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/mail/statistics'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/random-seed'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/random.seed'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/adjtime'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/httpd/logs'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/utmpx'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/wtmpx'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/cups/certs'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/dumpdates'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/svc/volatile'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6207): Ignore 'file' sregex '.log$|.swp$'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6004): No diff for file: '/etc/ssl/private.key'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6000): Starting daemon...
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6010): File integrity monitoring scan frequency: 43200 seconds
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6008): File integrity monitoring scan started.
2022/09/28 11:08:44 rootcheck: INFO: Starting rootcheck scan.
2022/09/28 11:08:46 wazuh-logcollector: INFO: Monitoring output of command(360): df -P
2022/09/28 11:08:46 wazuh-logcollector: INFO: Monitoring full output of command(360): netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d
2022/09/28 11:08:46 wazuh-logcollector: INFO: Monitoring full output of command(360): last -n 20
2022/09/28 11:08:46 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/audit/audit.log'.
2022/09/28 11:08:46 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/ossec/logs/active-responses.log'.
2022/09/28 11:08:46 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/dpkg.log'.
2022/09/28 11:08:46 wazuh-logcollector: INFO: Started (pid: 118682).
2022/09/28 11:08:48 wazuh-syscheckd: INFO: (6009): File integrity monitoring scan ended.
2022/09/28 11:08:48 wazuh-modulesd: INFO: Started (pid: 118792).
2022/09/28 11:08:48 sca: INFO: Module started.
2022/09/28 11:08:48 wazuh-modulesd:ciscat: INFO: Module disabled. Exiting...
2022/09/28 11:08:48 sca: INFO: Loaded policy '/var/ossec/ruleset/sca/cis_ubuntu22-04.yml'
2022/09/28 11:08:48 wazuh-modulesd:osquery: INFO: Module disabled. Exiting...
2022/09/28 11:08:48 wazuh-modulesd:agent-upgrade: INFO: (8153): Module Agent Upgrade started.
2022/09/28 11:08:48 wazuh-modulesd:database: INFO: Module started.
2022/09/28 11:08:48 wazuh-modulesd:task-manager: INFO: (8200): Module Task Manager started.
2022/09/28 11:08:48 sca: INFO: Starting Security Configuration Assessment scan.
2022/09/28 11:08:48 wazuh-modulesd:download: INFO: Module started.
2022/09/28 11:08:48 wazuh-modulesd:control: INFO: Starting control thread.
2022/09/28 11:08:48 wazuh-modulesd:syscollector: INFO: Module started.
2022/09/28 11:08:48 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2022/09/28 11:08:48 sca: INFO: Starting evaluation of policy: '/var/ossec/ruleset/sca/cis_ubuntu22-04.yml'
2022/09/28 11:08:48 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2022/09/28 11:08:53 sca: INFO: Evaluation finished for policy '/var/ossec/ruleset/sca/cis_ubuntu22-04.yml'
2022/09/28 11:08:53 sca: INFO: Security Configuration Assessment scan finished. Duration: 5 seconds.
2022/09/28 11:09:08 rootcheck: INFO: Ending rootcheck scan.
root@ip-192-168-2-229:/var/ossec/bin# clear
root@ip-192-168-2-229:/var/ossec/bin# cat /var/ossec/logs/ossec.log
2022/09/28 11:08:36 wazuh-modulesd:syscollector: INFO: Stop received for Syscollector.
2022/09/28 11:08:36 wazuh-modulesd:syscollector: INFO: Module finished.
2022/09/28 11:08:36 wazuh-logcollector: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2022/09/28 11:08:36 wazuh-syscheckd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2022/09/28 11:08:37 wazuh-execd: INFO: (1314): Shutdown received. Deleting responses.
2022/09/28 11:08:37 wazuh-execd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2022/09/28 11:08:37 wazuh-authd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2022/09/28 11:08:38 wazuh-authd: INFO: Exiting...
2022/09/28 11:08:40 wazuh-csyslogd: INFO: Remote syslog server not configured. Clean exit.
2022/09/28 11:08:40 wazuh-dbd: INFO: Database not configured. Clean exit.
2022/09/28 11:08:40 wazuh-integratord: INFO: Remote integrations not configured. Clean exit.
2022/09/28 11:08:40 wazuh-agentlessd: INFO: Not configured. Exiting.
2022/09/28 11:08:40 wazuh-authd: INFO: Started (pid: 118511).
2022/09/28 11:08:40 wazuh-authd: INFO: Accepting connections on port 1515. No password required.
2022/09/28 11:08:40 wazuh-authd: INFO: Setting network timeout to 1.000000 sec.
2022/09/28 11:08:42 wazuh-execd: INFO: Started (pid: 118556).
2022/09/28 11:08:44 wazuh-syscheckd: INFO: Started (pid: 118631).
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/bin', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/boot', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/etc', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/sbin', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/usr/bin', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6003): Monitoring path: '/usr/sbin', with options 'size | permissions | owner | group | mtime | inode | hash_md5 | hash_sha1 | hash_sha256 | scheduled'.
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/mtab'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/hosts.deny'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/mail/statistics'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/random-seed'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/random.seed'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/adjtime'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/httpd/logs'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/utmpx'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/wtmpx'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/cups/certs'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/dumpdates'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6206): Ignore 'file' entry '/etc/svc/volatile'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6207): Ignore 'file' sregex '.log$|.swp$'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6004): No diff for file: '/etc/ssl/private.key'
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6000): Starting daemon...
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6010): File integrity monitoring scan frequency: 43200 seconds
2022/09/28 11:08:44 wazuh-syscheckd: INFO: (6008): File integrity monitoring scan started.
2022/09/28 11:08:44 rootcheck: INFO: Starting rootcheck scan.
2022/09/28 11:08:46 wazuh-logcollector: INFO: Monitoring output of command(360): df -P
2022/09/28 11:08:46 wazuh-logcollector: INFO: Monitoring full output of command(360): netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d
2022/09/28 11:08:46 wazuh-logcollector: INFO: Monitoring full output of command(360): last -n 20
2022/09/28 11:08:46 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/audit/audit.log'.
2022/09/28 11:08:46 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/ossec/logs/active-responses.log'.
2022/09/28 11:08:46 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/dpkg.log'.
2022/09/28 11:08:46 wazuh-logcollector: INFO: Started (pid: 118682).
2022/09/28 11:08:48 wazuh-syscheckd: INFO: (6009): File integrity monitoring scan ended.
2022/09/28 11:08:48 wazuh-modulesd: INFO: Started (pid: 118792).
2022/09/28 11:08:48 sca: INFO: Module started.
2022/09/28 11:08:48 wazuh-modulesd:ciscat: INFO: Module disabled. Exiting...
2022/09/28 11:08:48 sca: INFO: Loaded policy '/var/ossec/ruleset/sca/cis_ubuntu22-04.yml'
2022/09/28 11:08:48 wazuh-modulesd:osquery: INFO: Module disabled. Exiting...
2022/09/28 11:08:48 wazuh-modulesd:agent-upgrade: INFO: (8153): Module Agent Upgrade started.
2022/09/28 11:08:48 wazuh-modulesd:database: INFO: Module started.
2022/09/28 11:08:48 wazuh-modulesd:task-manager: INFO: (8200): Module Task Manager started.
2022/09/28 11:08:48 sca: INFO: Starting Security Configuration Assessment scan.
2022/09/28 11:08:48 wazuh-modulesd:download: INFO: Module started.
2022/09/28 11:08:48 wazuh-modulesd:control: INFO: Starting control thread.
2022/09/28 11:08:48 wazuh-modulesd:syscollector: INFO: Module started.
2022/09/28 11:08:48 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2022/09/28 11:08:48 sca: INFO: Starting evaluation of policy: '/var/ossec/ruleset/sca/cis_ubuntu22-04.yml'
2022/09/28 11:08:48 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2022/09/28 11:08:53 sca: INFO: Evaluation finished for policy '/var/ossec/ruleset/sca/cis_ubuntu22-04.yml'
2022/09/28 11:08:53 sca: INFO: Security Configuration Assessment scan finished. Duration: 5 seconds.
2022/09/28 11:09:08 rootcheck: INFO: Ending rootcheck scan.
Phreak Evony
Sep 28, 2022, 11:02:04 AM9/28/22
to Wazuh mailing list
While using "Wazuh installation assistant" for the server I am getting the below error. It seems like some bug. Do I need to create "wazuh" and "wazuh-wui" users manually?
root@ip-192-168-2-229:~/wazuh# bash wazuh-install.sh --wazuh-server wazuh-1
28/09/2022 14:54:25 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.8
28/09/2022 14:54:25 INFO: Verbose logging redirected to /var/log/wazuh-install.log
28/09/2022 14:54:29 INFO: Wazuh repository added.
28/09/2022 14:54:29 INFO: --- Wazuh server ---
28/09/2022 14:54:29 INFO: Starting the Wazuh manager installation.
28/09/2022 14:54:58 INFO: Wazuh manager installation finished.
28/09/2022 14:54:58 INFO: Starting service wazuh-manager.
28/09/2022 14:55:14 INFO: wazuh-manager service started.
28/09/2022 14:55:14 INFO: Starting Filebeat installation.
28/09/2022 14:55:17 INFO: Filebeat installation finished.
28/09/2022 14:55:17 INFO: Filebeat post-install configuration finished.
28/09/2022 14:55:18 ERROR: The Wazuh API user wazuh does not exist
28/09/2022 14:55:18 ERROR: The Wazuh API user wazuh-wui does not exist
28/09/2022 14:55:18 INFO: Starting service filebeat.
28/09/2022 14:55:19 INFO: filebeat service started.
28/09/2022 14:55:19 INFO: Installation finished.
28/09/2022 14:54:25 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.8
28/09/2022 14:54:25 INFO: Verbose logging redirected to /var/log/wazuh-install.log
28/09/2022 14:54:29 INFO: Wazuh repository added.
28/09/2022 14:54:29 INFO: --- Wazuh server ---
28/09/2022 14:54:29 INFO: Starting the Wazuh manager installation.
28/09/2022 14:54:58 INFO: Wazuh manager installation finished.
28/09/2022 14:54:58 INFO: Starting service wazuh-manager.
28/09/2022 14:55:14 INFO: wazuh-manager service started.
28/09/2022 14:55:14 INFO: Starting Filebeat installation.
28/09/2022 14:55:17 INFO: Filebeat installation finished.
28/09/2022 14:55:17 INFO: Filebeat post-install configuration finished.
28/09/2022 14:55:18 ERROR: The Wazuh API user wazuh does not exist
28/09/2022 14:55:18 ERROR: The Wazuh API user wazuh-wui does not exist
28/09/2022 14:55:18 INFO: Starting service filebeat.
28/09/2022 14:55:19 INFO: filebeat service started.
28/09/2022 14:55:19 INFO: Installation finished.
Fabricio Brunetti
Sep 28, 2022, 12:54:03 PM9/28/22
to Wazuh mailing list
Hello phreakcool,
Have you installed the Wazuh-indexer?, you can follow this guide to install it: https://documentation.wazuh.com/current/installation-guide/wazuh-indexer/installation-assistant.html#initial-configuration
Looks like that is missing from your installation.
Regards,
Fabricio Brunetti
Phreak Evony
Sep 29, 2022, 1:50:55 AM9/29/22
to Fabricio Brunetti, Wazuh mailing list
Hi Fabricio,
I have installed wazuh all three components as mentioned in the documentation. Below is the output of wazuh assistant all in one. I have tried step-by-step instructions as well.
# bash wazuh-install.sh -a -o
29/09/2022 05:42:31 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.8
29/09/2022 05:42:31 INFO: Verbose logging redirected to /var/log/wazuh-install.log
29/09/2022 05:42:32 INFO: --- Removing existing Wazuh installation ---
29/09/2022 05:42:32 INFO: Wazuh GPG key not found in the system
29/09/2022 05:42:32 INFO: Installation cleaned.
29/09/2022 05:42:38 INFO: Wazuh repository added.
29/09/2022 05:42:38 INFO: --- Configuration files ---
29/09/2022 05:42:38 INFO: Generating configuration files.
29/09/2022 05:42:39 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
29/09/2022 05:42:39 INFO: --- Wazuh indexer ---
29/09/2022 05:42:39 INFO: Starting Wazuh indexer installation.
29/09/2022 05:43:12 INFO: Wazuh indexer installation finished.
29/09/2022 05:43:12 INFO: Wazuh indexer post-install configuration finished.
29/09/2022 05:43:12 INFO: Starting service wazuh-indexer.
29/09/2022 05:43:29 INFO: wazuh-indexer service started.
29/09/2022 05:43:29 INFO: Initializing Wazuh indexer cluster security settings.
29/09/2022 05:43:43 INFO: Wazuh indexer cluster initialized.
29/09/2022 05:43:43 INFO: --- Wazuh server ---
29/09/2022 05:43:43 INFO: Starting the Wazuh manager installation.
29/09/2022 05:44:20 INFO: Wazuh manager installation finished.
29/09/2022 05:44:20 INFO: Starting service wazuh-manager.
29/09/2022 05:44:38 INFO: wazuh-manager service started.
29/09/2022 05:44:38 INFO: Starting Filebeat installation.
29/09/2022 05:44:44 INFO: Filebeat installation finished.
29/09/2022 05:44:45 INFO: Filebeat post-install configuration finished.
29/09/2022 05:44:45 INFO: Starting service filebeat.
29/09/2022 05:44:46 INFO: filebeat service started.
29/09/2022 05:44:46 INFO: --- Wazuh dashboard ---
29/09/2022 05:44:46 INFO: Starting Wazuh dashboard installation.
29/09/2022 05:45:17 INFO: Wazuh dashboard installation finished.
29/09/2022 05:45:17 INFO: Wazuh dashboard post-install configuration finished.
29/09/2022 05:45:17 INFO: Starting service wazuh-dashboard.
29/09/2022 05:45:18 INFO: wazuh-dashboard service started.
29/09/2022 05:45:20 ERROR: The Wazuh API user wazuh does not exist
29/09/2022 05:45:20 ERROR: The Wazuh API user wazuh-wui does not exist
29/09/2022 05:45:50 ERROR: User is not registered in Wazuh API
29/09/2022 05:45:50 INFO: --- Removing existing Wazuh installation ---
29/09/2022 05:45:50 INFO: Removing Wazuh manager.
29/09/2022 05:46:00 INFO: Wazuh manager removed.
29/09/2022 05:46:00 INFO: Removing Wazuh indexer.
29/09/2022 05:46:04 INFO: Wazuh indexer removed.
29/09/2022 05:46:04 INFO: Removing Filebeat.
29/09/2022 05:46:06 INFO: Filebeat removed.
29/09/2022 05:46:06 INFO: Removing Wazuh dashboard.
29/09/2022 05:46:11 INFO: Wazuh dashboard removed.
29/09/2022 05:46:11 INFO: Wazuh GPG key not found in the system
29/09/2022 05:46:11 INFO: Installation cleaned.
29/09/2022 05:42:31 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.8
29/09/2022 05:42:31 INFO: Verbose logging redirected to /var/log/wazuh-install.log
29/09/2022 05:42:32 INFO: --- Removing existing Wazuh installation ---
29/09/2022 05:42:32 INFO: Wazuh GPG key not found in the system
29/09/2022 05:42:32 INFO: Installation cleaned.
29/09/2022 05:42:38 INFO: Wazuh repository added.
29/09/2022 05:42:38 INFO: --- Configuration files ---
29/09/2022 05:42:38 INFO: Generating configuration files.
29/09/2022 05:42:39 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
29/09/2022 05:42:39 INFO: --- Wazuh indexer ---
29/09/2022 05:42:39 INFO: Starting Wazuh indexer installation.
29/09/2022 05:43:12 INFO: Wazuh indexer installation finished.
29/09/2022 05:43:12 INFO: Wazuh indexer post-install configuration finished.
29/09/2022 05:43:12 INFO: Starting service wazuh-indexer.
29/09/2022 05:43:29 INFO: wazuh-indexer service started.
29/09/2022 05:43:29 INFO: Initializing Wazuh indexer cluster security settings.
29/09/2022 05:43:43 INFO: Wazuh indexer cluster initialized.
29/09/2022 05:43:43 INFO: --- Wazuh server ---
29/09/2022 05:43:43 INFO: Starting the Wazuh manager installation.
29/09/2022 05:44:20 INFO: Wazuh manager installation finished.
29/09/2022 05:44:20 INFO: Starting service wazuh-manager.
29/09/2022 05:44:38 INFO: wazuh-manager service started.
29/09/2022 05:44:38 INFO: Starting Filebeat installation.
29/09/2022 05:44:44 INFO: Filebeat installation finished.
29/09/2022 05:44:45 INFO: Filebeat post-install configuration finished.
29/09/2022 05:44:45 INFO: Starting service filebeat.
29/09/2022 05:44:46 INFO: filebeat service started.
29/09/2022 05:44:46 INFO: --- Wazuh dashboard ---
29/09/2022 05:44:46 INFO: Starting Wazuh dashboard installation.
29/09/2022 05:45:17 INFO: Wazuh dashboard installation finished.
29/09/2022 05:45:17 INFO: Wazuh dashboard post-install configuration finished.
29/09/2022 05:45:17 INFO: Starting service wazuh-dashboard.
29/09/2022 05:45:18 INFO: wazuh-dashboard service started.
29/09/2022 05:45:20 ERROR: The Wazuh API user wazuh does not exist
29/09/2022 05:45:20 ERROR: The Wazuh API user wazuh-wui does not exist
29/09/2022 05:45:50 ERROR: User is not registered in Wazuh API
29/09/2022 05:45:50 INFO: --- Removing existing Wazuh installation ---
29/09/2022 05:45:50 INFO: Removing Wazuh manager.
29/09/2022 05:46:00 INFO: Wazuh manager removed.
29/09/2022 05:46:00 INFO: Removing Wazuh indexer.
29/09/2022 05:46:04 INFO: Wazuh indexer removed.
29/09/2022 05:46:04 INFO: Removing Filebeat.
29/09/2022 05:46:06 INFO: Filebeat removed.
29/09/2022 05:46:06 INFO: Removing Wazuh dashboard.
29/09/2022 05:46:11 INFO: Wazuh dashboard removed.
29/09/2022 05:46:11 INFO: Wazuh GPG key not found in the system
29/09/2022 05:46:11 INFO: Installation cleaned.
--
You received this message because you are subscribed to a topic in the Google Groups "Wazuh mailing list" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/wazuh/E4CxompCuwE/unsubscribe.
To unsubscribe from this group and all its topics, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/880b5255-4315-46b6-ab48-223ea00b5f10n%40googlegroups.com.
Fabricio Brunetti
Sep 29, 2022, 11:38:31 AM9/29/22
to Phreak Evony, Wazuh mailing list
You did set the config.yml file with the correct values, right? (as indicated here: https://documentation.wazuh.com/current/installation-guide/wazuh-indexer/installation-assistant.html#initial-configuration)
I will try to reproduce the error. Could you share your configuration and the steps you followed?
Thanks,
I will try to reproduce the error. Could you share your configuration and the steps you followed?
Thanks,
Fabricio
Reply all
Reply to author
Forward
0 new messages