Wazuh-Dashboard not available

Andrehens Chicfici

unread,

Feb 24, 2025, 2:57:31 AMFeb 24

to Wazuh | Mailing List

Hey,

since Friday I am not able to connect to my dashboard anymore. I didn't change anything and also didn't update to 4.11 yet. I just get the message "Wazuh dashboard server is not ready yet". At first I thought that there is a problem with the certificates, so I created new ones. No change so far. Any ideas, what to check next?

sudo cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn|crit|fatal"

[2025-02-24T01:00:02,058][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T01:00:02,185][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T06:16:12,808][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:25,007][ERROR][o.o.j.s.u.LockService ] [node-1] Exception occurred finding lock [2025-02-24T08:41:25,024][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [node-1] uncaught exception in thread [DefaultDispatcher-worker-2] [2025-02-24T08:41:31,179][INFO ][o.o.n.Node ] [node-1] JVM arguments [-Xshare:auto, -Dopensearch.networkaddress.cache.ttl=60, -Dopensearch.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -XX:+ShowCodeDetailsInExceptionMessages, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.security.manager=allow, -Djava.locale.providers=SPI,COMPAT, -Xms24g, -Xmx24g, -XX:+UseG1GC, -XX:G1ReservePercent=25, -XX:InitiatingHeapOccupancyPercent=30, -Djava.io.tmpdir=/var/log/wazuh-indexer/tmp, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=/var/lib/wazuh-indexer, -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Djava.security.manager=allow, -Djava.util.concurrent.ForkJoinPool.common.threadFactory=org.opensearch.secure_sm.SecuredForkJoinWorkerThreadFactory, -Dclk.tck=100, -Djdk.attach.allowAttachSelf=true, -Djava.security.policy=file:///etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy, --add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED, -XX:MaxDirectMemorySize=12884901888, -Dopensearch.path.home=/usr/share/wazuh-indexer, -Dopensearch.path.conf=/etc/wazuh-indexer, -Dopensearch.distribution.type=deb, -Dopensearch.bundled_jdk=true] [2025-02-24T08:41:31,303][WARN ][o.a.l.i.v.VectorizationProvider] [node-1] Java vector incubator module is not readable. For optimal vector performance, pass '--add-modules jdk.incubator.vector' to enable Vector API. [2025-02-24T08:41:32,926][WARN ][o.o.s.OpenSearchSecurityPlugin] [node-1] File /etc/wazuh-indexer/root-ca.pem has insecure file permissions (should be 0600) [2025-02-24T08:41:32,926][WARN ][o.o.s.OpenSearchSecurityPlugin] [node-1] File /etc/wazuh-indexer/certs/.root-ca.pem has insecure file permissions (should be 0600) [2025-02-24T08:41:32,926][WARN ][o.o.s.OpenSearchSecurityPlugin] [node-1] File /etc/wazuh-indexer/certs/root-ca.pem has insecure file permissions (should be 0600) [2025-02-24T08:41:34,414][WARN ][stderr ] [node-1] WARNING: A restricted method in java.lang.foreign.Linker has been called [2025-02-24T08:41:34,414][WARN ][stderr ] [node-1] WARNING: java.lang.foreign.Linker::downcallHandle has been called by the unnamed module [2025-02-24T08:41:34,414][WARN ][stderr ] [node-1] WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for this module [2025-02-24T08:41:36,888][WARN ][o.o.s.c.Salt ] [node-1] If you plan to use field masking pls configure compliance salt e1ukloTsQlOgPquJ to be a random string of 16 chars length identical on all nodes [2025-02-24T08:41:36,922][ERROR][o.o.s.a.s.SinkProvider ] [node-1] Default endpoint could not be created, auditlog will not work properly. [2025-02-24T08:41:36,923][WARN ][o.o.s.a.r.AuditMessageRouter] [node-1] No default storage available, audit log may not work properly. Please check configuration. [2025-02-24T08:41:37,862][WARN ][o.o.s.p.SQLPlugin ] [node-1] Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information [2025-02-24T08:41:39,077][WARN ][o.o.g.DanglingIndicesState] [node-1] gateway.auto_import_dangling_indices is disabled, dangling indices will not be automatically detected or imported and must be managed manually [2025-02-24T08:41:39,690][ERROR][o.o.s.l.BuiltinLogTypeLoader] [node-1] Failed loading builtin log types from disk! at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138) [opensearch-cli-2.16.0.jar:2.16.0] [2025-02-24T08:41:40,412][WARN ][o.o.p.c.s.h.ConfigOverridesClusterSettingHandler] [node-1] Config override setting update called with empty string. Ignoring. [2025-02-24T08:41:40,421][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:40,439][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:40,721][ERROR][o.o.i.i.ManagedIndexCoordinator] [node-1] get managed-index failed: NoShardAvailableActionException[No shard available for [org.opensearch.action.get.MultiGetShardRequest@2038349b]] [2025-02-24T08:41:40,753][ERROR][o.o.i.i.ManagedIndexCoordinator] [node-1] Failed to get ISM policies with templates: Failed to execute phase [query], all shards failed [2025-02-24T08:41:40,753][WARN ][o.o.o.i.ObservabilityIndex] [node-1] message: index [.opensearch-observability/1pRjyzrgRjSJ3VEWIq7KQQ] already exists [2025-02-24T08:41:40,755][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:40,760][WARN ][o.o.s.SecurityAnalyticsPlugin] [node-1] Failed to initialize LogType config index and builtin log types [2025-02-24T08:41:41,216][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:41,396][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:41,614][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:41,779][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:41,938][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:42,107][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:42,214][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:42,333][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:42,450][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:42,991][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:43,125][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:43,471][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:43,540][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:43,624][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:43,871][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:44,065][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:44,166][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:44,334][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:44,488][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:44,576][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:44,698][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:44,849][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:44,926][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:45,103][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:45,243][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:45,300][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:45,401][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:45,543][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:45,620][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:45,728][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:45,850][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:45,919][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:45,985][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:46,146][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:46,216][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:46,316][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:46,405][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:46,476][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:46,541][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:46,635][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:46,704][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:46,822][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:46,928][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:47,050][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:47,132][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:47,234][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:47,468][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:47,691][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:47,819][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:47,911][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:47,997][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:48,077][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:48,239][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:48,349][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:48,420][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:48,657][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:48,804][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:49,068][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:49,154][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:49,220][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:49,284][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:49,380][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:49,486][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:49,612][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:49,684][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:49,787][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:49,860][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:49,924][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:50,019][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:50,170][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:50,236][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:50,413][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:50,491][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:50,592][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:50,751][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:50,838][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:50,926][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:51,047][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:51,215][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:51,306][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:51,438][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:51,551][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:51,803][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:51,901][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:52,171][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:52,258][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:52,424][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:52,491][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:52,605][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:52,711][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:52,782][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:52,885][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:52,940][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:53,037][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:53,102][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:53,215][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:53,297][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:53,478][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:53,543][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:53,609][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:53,749][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:53,921][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:54,089][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:54,189][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:54,251][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:54,387][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:54,470][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:54,554][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:54,658][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:54,784][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:54,852][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:54,953][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:55,131][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:55,312][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:55,430][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:55,536][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:55,643][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:55,714][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:55,843][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:55,927][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:56,029][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:56,133][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:56,250][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:56,323][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:56,396][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:56,472][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:56,586][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:56,669][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:56,756][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:56,839][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:56,978][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:57,049][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:57,148][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:57,329][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:57,421][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:57,487][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:57,586][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:57,654][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:57,729][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:57,810][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:57,883][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:58,055][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:58,250][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:58,452][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:58,635][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:58,863][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:59,048][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:59,206][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:59,350][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set [2025-02-24T08:41:59,495][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set

sudo systemctl status wazuh-dashboard.service

Feb 24 08:55:47 wazuh opensearch-dashboards[1061]: {"type":"log","@timestamp":"2025-02-24T07:55:47Z","tags":["error","opensearch","data"],"pid":1061,"message":"[ResponseError]: Response Error"}

hasitha.u...@wazuh.com

unread,

Feb 24, 2025, 3:26:15 AMFeb 24

to Wazuh | Mailing List

Hi Andrehens,

The error "Wazuh dashboard is not ready yet" normally indicates an issue in communication between Wazuh dashboard and Wazuh indexer. May I know the exact internal user password you changed? Also, do you have an all-in-one architecture or you're using distributed architecture?

For example, if you change the kibanaserver user password from the indexer server, you will also need to update the Wazuh dashboard keystore with the new password:

echo <KIBANASERVER_PASSWORD> | /usr/share/wazuh-dashboard/bin/opensearch-dashboards-keystore --allow-root add -f --stdin opensearch.password

Restart the Wazuh dashboard service:

systemctl restart wazuh-dashboard

For an all-in-one architecture, it automatically updates the passwords where necessary. You can also check the below link for more information:

https://documentation.wazuh.com/current/user-manual/user-administration/password-management.html

If the issue persists after verifying the above, kindly share the full output of the below commands:

cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn|crit|fatal"

journalctl -u wazuh-dashboard
systemctl status wazuh-indexer

Can you also check the disk space and memory usage by running this commands.

df -h
free -h

Additionally, share the cluster health to check further.

curl -k -u admin:indexerpassword -XGET https://indexer-IP:9200/_cluster/health?pretty

Let me know the update on this to check further.

Regards,
Hasitha Upekshitha

Message has been deleted

Andrehens Chicfici

unread,

Feb 24, 2025, 4:22:00 AMFeb 24

to Wazuh | Mailing List

Hey,

I didn't change any passwords.

Restarting the dashboard didn't help. Tried it a few times and also restarted the whole server with no changes...

[...] This message is repeated few hundred times

[2025-02-24T08:41:59,350][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set
[2025-02-24T08:41:59,495][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set

[2025-02-24T09:36:59,493][INFO ][o.o.n.Node ] [node-1] JVM arguments [-Xshare:auto, -Dopensearch.networkaddress.cache.ttl=60, -Dopensearch.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -XX:+ShowCodeDetailsInExceptionMessages, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.security.manager=allow, -Djava.locale.providers=SPI,COMPAT, -Xms24g, -Xmx24g, -XX:+UseG1GC, -XX:G1ReservePercent=25, -XX:InitiatingHeapOccupancyPercent=30, -Djava.io.tmpdir=/var/log/wazuh-indexer/tmp, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=/var/lib/wazuh-indexer, -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Djava.security.manager=allow, -Djava.util.concurrent.ForkJoinPool.common.threadFactory=org.opensearch.secure_sm.SecuredForkJoinWorkerThreadFactory, -Dclk.tck=100, -Djdk.attach.allowAttachSelf=true, -Djava.security.policy=file:///etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy, --add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED, -XX:MaxDirectMemorySize=12884901888, -Dopensearch.path.home=/usr/share/wazuh-indexer, -Dopensearch.path.conf=/etc/wazuh-indexer, -Dopensearch.distribution.type=deb, -Dopensearch.bundled_jdk=true]
[2025-02-24T09:36:59,611][WARN ][o.a.l.i.v.VectorizationProvider] [node-1] Java vector incubator module is not readable. For optimal vector performance, pass '--add-modules jdk.incubator.vector' to enable Vector API.
[2025-02-24T09:37:01,173][WARN ][o.o.s.OpenSearchSecurityPlugin] [node-1] File /etc/wazuh-indexer/certs/.root-ca.pem has insecure file permissions (should be 0600)
[2025-02-24T09:37:02,522][WARN ][stderr] [node-1] WARNING: A restricted method in java.lang.foreign.Linker has been called
[2025-02-24T09:37:02,523][WARN ][stderr] [node-1] WARNING: java.lang.foreign.Linker::downcallHandle has been called by the unnamed module
[2025-02-24T09:37:02,523][WARN ][stderr] [node-1] WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for this module
[2025-02-24T09:37:05,255][WARN ][o.o.s.c.Salt ] [node-1] If you plan to use field masking pls configure compliance salt e1ukloTsQlOgPquJ to be a random string of 16 chars length identical on all nodes
[2025-02-24T09:37:05,286][ERROR][o.o.s.a.s.SinkProvider ] [node-1] Default endpoint could not be created, auditlog will not work properly.
[2025-02-24T09:37:05,287][WARN ][o.o.s.a.r.AuditMessageRouter] [node-1] No default storage available, audit log may not work properly. Please check configuration.
[2025-02-24T09:37:06,170][WARN ][o.o.s.p.SQLPlugin ] [node-1] Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information
[2025-02-24T09:37:07,210][WARN ][o.o.g.DanglingIndicesState] [node-1] gateway.auto_import_dangling_indices is disabled, dangling indices will not be automatically detected or imported and must be managed manually
[2025-02-24T09:37:07,754][ERROR][o.o.s.l.BuiltinLogTypeLoader] [node-1] Failed loading builtin log types from disk! at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138) [opensearch-cli-2.16.0.jar:2.16.0]
[2025-02-24T09:37:08,437][WARN ][o.o.p.c.s.h.ConfigOverridesClusterSettingHandler] [node-1] Config override setting update called with empty string. Ignoring.
[2025-02-24T09:37:08,445][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set
[2025-02-24T09:37:08,463][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set
[2025-02-24T09:37:08,693][ERROR][o.o.i.i.ManagedIndexCoordinator] [node-1] get managed-index failed: NoShardAvailableActionException[No shard available for [org.opensearch.action.get.MultiGetShardRequest@bfbdee0]]
[2025-02-24T09:37:08,726][WARN ][o.o.o.i.ObservabilityIndex] [node-1] message: index [.opensearch-observability/1pRjyzrgRjSJ3VEWIq7KQQ] already exists
[2025-02-24T09:37:08,730][WARN ][o.o.s.SecurityAnalyticsPlugin] [node-1] Failed to initialize LogType config index and builtin log types
[2025-02-24T09:37:08,730][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set
[2025-02-24T09:37:08,731][ERROR][o.o.i.i.ManagedIndexCoordinator] [node-1] Failed to get ISM policies with templates: Failed to execute phase [query], all shards failed
[2025-02-24T09:37:08,999][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set
[2025-02-24T09:37:09,153][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set
[2025-02-24T09:37:09,318][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set
[2025-02-24T09:37:09,431][ERROR][o.o.s.a.BackendRegistry ] [node-1] Not yet initialized (you may need to run securityadmin)
[2025-02-24T09:37:09,466][ERROR][o.o.s.a.BackendRegistry ] [node-1] Not yet initialized (you may need to run securityadmin)
[2025-02-24T09:37:09,468][ERROR][o.o.s.a.BackendRegistry ] [node-1] Not yet initialized (you may need to run securityadmin)
[2025-02-24T09:37:09,470][ERROR][o.o.s.a.BackendRegistry ] [node-1] Not yet initialized (you may need to run securityadmin)
[2025-02-24T09:37:09,489][WARN ][o.o.c.r.a.AllocationService] [node-1] Falling back to single shard assignment since batch mode disable or multiple custom allocators set
[...] This message is repeated a few hundred times

journalctl -u wazuh-dashboard

No messages since December....

systemctl status wazuh-indexer
● wazuh-indexer.service - wazuh-indexer
Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; preset: enabled)
Active: active (running) since Mon 2025-02-24 09:37:08 CET; 28min ago
Docs: https://documentation.wazuh.com
Main PID: 1224 (java)
Tasks: 155 (limit: 57721)
Memory: 27.9G (peak: 27.9G)
CPU: 3min 33.933s
CGroup: /system.slice/wazuh-indexer.service
└─1224 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1>

Feb 24 09:36:58 wazuh systemd-entrypoint[1224]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.>
Feb 24 09:36:58 wazuh systemd-entrypoint[1224]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Feb 24 09:36:58 wazuh systemd-entrypoint[1224]: WARNING: System::setSecurityManager will be removed in a future release
Feb 24 09:36:59 wazuh systemd-entrypoint[1224]: Feb 24, 2025 9:36:59 AM sun.util.locale.provider.LocaleProviderAdapter <clinit>
Feb 24 09:36:59 wazuh systemd-entrypoint[1224]: WARNING: COMPAT locale provider will be removed in a future release
Feb 24 09:36:59 wazuh systemd-entrypoint[1224]: WARNING: A terminally deprecated method in java.lang.System has been called
Feb 24 09:36:59 wazuh systemd-entrypoint[1224]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.16>
Feb 24 09:36:59 wazuh systemd-entrypoint[1224]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Feb 24 09:36:59 wazuh systemd-entrypoint[1224]: WARNING: System::setSecurityManager will be removed in a future release
Feb 24 09:37:08 wazuh systemd[1]: Started wazuh-indexer.service - wazuh-indexer.

df -h

Filesystem Size Used Avail Use% Mounted on

tmpfs 4,8G 1,2M 4,8G 1% /run

/dev/mapper/ubuntu--vg-ubuntu--lv 785G 333G 416G 45% /

tmpfs 24G 80K 24G 1% /dev/shm

tmpfs 5,0M 0 5,0M 0% /run/lock

/dev/sda2 2,0G 184M 1,7G 11% /boot

tmpfs 4,8G 16K 4,8G 1% /run/user/1000

free -h

Mem: 47Gi 27Gi 465Mi 1,9Mi 20Gi 20Gi

Swap: 8,0Gi 0B 8,0Gi

curl -XGET https://XXX.XXX.XXX.XXX:9200/_cat/shards?v -k -u admin

.opendistro-ism-managed-index-history-2025.02.01-000045 0 r UNASSIGNED

wazuh-monitoring-2024.50w 0 p STARTED 67998 9.4mb XXX.XXX.XXX.XXX node-1

wazuh-monitoring-2025.6w 0 p STARTED 68523 9.5mb XXX.XXX.XXX.XXX node-1

wazuh-alerts-4.x-2025.01.04 0 p STARTED 365799 232.2mb XXX.XXX.XXX.XXX node-1

wazuh-alerts-4.x-2025.01.04 1 p STARTED 365234 234.7mb XXX.XXX.XXX.XXX node-1

wazuh-alerts-4.x-2025.01.04 2 p STARTED 364661 229.7mb XXX.XXX.XXX.XXX node-1

wazuh-alerts-4.x-2025.01.03 0 p STARTED 517273 313.1mb XXX.XXX.XXX.XXX node-1

wazuh-alerts-4.x-2025.01.03 1 p STARTED 516684 313.7mb XXX.XXX.XXX.XXX node-1

wazuh-alerts-4.x-2025.01.03 2 p STARTED 518755 312.9mb XXX.XXX.XXX.XXX node-1

wazuh-statistics-2024.49w 0 p STARTED 4011 1.6mb XXX.XXX.XXX.XXX node-1

and a lot more entries in that style....

I hope thats enough for debugging. Tell me, if you need more!

hasitha.u...@wazuh.com

unread,

Feb 25, 2025, 3:56:48 AMFeb 25

to Wazuh | Mailing List

Hi Andrehens,

If you see HeapDumpOnOutOfMemoryError with this error continuously, I suggest you try increasing the RAM and configuring heap memory accordingly.
We need to manually adjust the heap size settings in jvm.options a file, setting both minimum and maximum heap sizes to the same value. this is recommended to prevent performance degradation.

Let's say your system has 8gb of RAM, you can set both -Xms4g -Xmx4g. navigate to /etc/wazuh-indexer/jvm.options file to change the heap space.
free -h

set the value to reference the below option

-Xms4g
-Xmx4g

Save the changes.

Restart the Wazuh-Indexer using the command:

systemctl restart wazuh-indexer

Ref: https://documentation.wazuh.com/current/user-manual/wazuh-indexer/wazuh-indexer-tuning.html

Not yet initialized (you may need to run securityadmin)

To address this, you could try running the following command:

/usr/share/wazuh-indexer/bin/indexer-security-init.sh

File /etc/wazuh-indexer/certs/.root-ca.pem has insecure file permissions (should be 0600)

Also, share the output of this command.

ls -lh /etc/wazuh-indexer/certs/
chmod 400 /etc/wazuh-indexer/certs/*
chown wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs/*

Please let me know the update on the above-mentioned points to check further.

Regards,
Hasitha Upekshitha

Message has been deleted

Andrehens Chicfici

unread,

Feb 25, 2025, 8:22:31 AMFeb 25

to Wazuh | Mailing List

free -h

total used free shared buff/cache available

Mem: 47Gi 26Gi 445Mi 1,9Mi 20Gi 20Gi

Swap: 8,0Gi 0B 8,0Gi

I already changed the heap size when I built the system:

# Xms represents the initial size of total heap space

# Xmx represents the maximum size of total heap space

-Xms24g

-Xmx24g

/usr/share/wazuh-indexer/bin/indexer-security-init.sh

**************************************************************************

** This tool will be deprecated in the next major release of OpenSearch **

** https://github.com/opensearch-project/security/issues/1755 ** *************************************************************************

Security Admin v7

Will connect to XXX.XXX.XXX.XXX:9200

ERR: Seems there is no OpenSearch running on XXX.XXX.XXX.XXX:9200 - Will exit

ls -lh /etc/wazuh-indexer/certs/

total 20K

-r-------- 1 wazuh-indexer wazuh-indexer 1,7K Feb 25 13:14 admin-key.pem

-r-------- 1 wazuh-indexer wazuh-indexer 1,1K Feb 25 13:14 admin.pem

-r-------- 1 wazuh-indexer wazuh-indexer 1,2K Feb 25 13:14 root-ca.pem

-r-------- 1 wazuh-indexer wazuh-indexer 1,7K Feb 25 13:14 wazuh-indexer-key.pem

-r-------- 1 wazuh-indexer wazuh-indexer 1,3K Feb 25 13:14 wazuh-indexer.pem

Andrehens Chicfici

unread,

Feb 26, 2025, 9:59:26 AMFeb 26

to Wazuh | Mailing List

So I tried to debug a bit. Re-Enrolled the certificates and managed to figure out more. Weird opensearch-dashboard errors....:

SSL ERROR KIBANA:

curl -w %{certs} https://XXX.XXX.XXX.XXX:9200 > cacert.pem

% Total % Received % Xferd Average Speed Time Time Time Current

Dload Upload Total Spent Left Speed

0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0

curl: (60) SSL certificate problem: unable to get local issuer certificate

More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not

establish a secure connection to it. To learn more about this situation and

how to fix it, please visit the web page mentioned above.

curl without SSL-ERROR:

curl -k -u admin https://XXX.XXX.XXX.XXX:9200

Enter host password for user 'admin':

{

"name" : "node-1",

"cluster_name" : "wazuh-cluster",

"cluster_uuid" : "-DbLDK65Q3ynbYV3dWAWPg",

"version" : {

"number" : "7.10.2",

"build_type" : "deb",

"build_hash" : "7149046c7c9c64aa43e437826af0b8b0dcabd730",

"build_date" : "2025-01-15T11:04:30.997631Z",

"build_snapshot" : false,

"lucene_version" : "9.11.1",

"minimum_wire_compatibility_version" : "7.10.0",

"minimum_index_compatibility_version" : "7.0.0"

},

"tagline" : "The OpenSearch Project: https://opensearch.org/"

}

opensearch-security-admin output:

bash securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securitycon fig/ -icl -nhnv -cacert /etc/wazuh-indexer/certs/root-ca.pem -cert /etc/wazuh-indexer/certs/admin.pem -key /etc/wazuh-indexer/certs/admin-key.pem

**************************************************************************

** This tool will be deprecated in the next major release of OpenSearch **

** https://github.com/opensearch-project/security/issues/1755 **

**************************************************************************

WARNING: nor OPENSEARCH_JAVA_HOME nor JAVA_HOME is set, will use /usr/bin/java

Security Admin v7

Will connect to localhost:9200

ERR: Seems there is no OpenSearch running on localhost:9200 - Will exit

dashboard-status:

systemctl status wazuh-dashboard

● wazuh-dashboard.service - wazuh-dashboard

Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; preset: enabled)

Active: active (running) since Wed 2025-02-26 15:41:57 CET; 26s ago

Main PID: 12570 (node)

Tasks: 11 (limit: 57721)

Memory: 158.1M (peak: 226.1M)

CPU: 4.935s

CGroup: /system.slice/wazuh-dashboard.service

└─12570 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 /usr/share/wazuh-dashboard/src/cli/dist

Feb 26 15:42:00 wazuh opensearch-dashboards[12570]: {"type":"log","@timestamp":"2025-02-26T14:42:00Z","tags":["error","savedobjects-service"],"pid":12570,"message":"Unable to retrieve version information from OpenSearch nodes."}

Feb 26 15:42:03 wazuh opensearch-dashboards[12570]: {"type":"log","@timestamp":"2025-02-26T14:42:03Z","tags":["error","opensearch","data"],"pid":12570,"message":"[ResponseError]: Response Error"}

Feb 26 15:42:05 wazuh opensearch-dashboards[12570]: {"type":"log","@timestamp":"2025-02-26T14:42:05Z","tags":["error","opensearch","data"],"pid":12570,"message":"[ResponseError]: Response Error"}

hasitha.u...@wazuh.com

unread,

Feb 27, 2025, 8:42:01 AMFeb 27

to Wazuh | Mailing List

Hi Andrehens,

It seems the issue might be with the certificates based on this error curl: (60) SSL certificate problem: unable to get local issuer certificate.
We might need to confirm how you are recreating the certificates.

Let me know how you're creating and installing certificates?

Reply all

Reply to author

Forward

Message has been deleted