Error Instaling Wazuh Server Cluter , but Dashboard and Indexer is Fine.

[Aditya Firman Nugroho]

i want to instal wazuh with mode distributed, when i install indexer node 1 and 2 , is done and success. instaling the dashboard successful too, but when instaling the wazuh manager node 1 and node 2 is problem with 

" 02/07/2026 07:48:11 DEBUG: wazuh-manager started.
02/07/2026 07:48:11 DEBUG: Changing API passwords.
02/07/2026 07:48:11 ERROR: User  is not registered in Wazuh API
02/07/2026 07:48:11 INFO: --- Removing existing Wazuh installation ---
02/07/2026 07:48:11 INFO: Removing Wazuh manager.

"

oot@yipsvrwzh04:/opt/wazuh-opt# ls -l
total 220
-rw------- 1 ityip ityip  14913 Jul  2 07:35 wazuh-install-files.tar
-rw-r--r-- 1 root  root  208288 Jul  2 03:43 wazuh-install.sh
root@yipsvrwzh04:/opt/wazuh-opt# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether bc:24:11:f5:ca:6d brd ff:ff:ff:ff:ff:ff
    altname enp0s18
    inet 10.11.2.83/24 brd 10.11.2.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::be24:11ff:fef5:ca6d/64 scope link
       valid_lft forever preferred_lft forever
root@yipsvrwzh04:/opt/wazuh-opt# bash wazuh-install.sh --wazuh-server wazuh-1
02/07/2026 07:37:59 INFO: Starting Wazuh installation assistant. Wazuh version: 4.14.6
02/07/2026 07:37:59 INFO: Verbose logging redirected to /var/log/wazuh-install.log
^C
Do you want to remove the ongoing installation?[Y/N]y
02/07/2026 07:38:09 INFO: --- Removing existing Wazuh installation ---
02/07/2026 07:38:09 INFO: Removing Filebeat.
02/07/2026 07:39:35 INFO: Filebeat removed.
02/07/2026 07:39:36 INFO: Installation cleaned.
root@yipsvrwzh04:/opt/wazuh-opt# bash wazuh-install.sh --wazuh-server wazuh-1 -v
02/07/2026 07:39:50 DEBUG: Checking root permissions.
02/07/2026 07:39:50 INFO: Starting Wazuh installation assistant. Wazuh version: 4.14.6
02/07/2026 07:39:50 INFO: Verbose logging redirected to /var/log/wazuh-install.log
02/07/2026 07:39:50 DEBUG: APT package manager will be used.
02/07/2026 07:39:50 DEBUG: Checking Wazuh installation.
02/07/2026 07:39:52 DEBUG: Checking system distribution.
02/07/2026 07:39:52 DEBUG: Detected distribution name: ubuntu
02/07/2026 07:39:52 DEBUG: Detected distribution version: 24
02/07/2026 07:39:52 DEBUG: Installing check dependencies.
Hit:1 http://security.ubuntu.com/ubuntu noble-security InRelease
Hit:2 http://archive.ubuntu.com/ubuntu noble InRelease
Get:3 http://archive.ubuntu.com/ubuntu noble-updates InRelease [126 kB]
Hit:4 http://archive.ubuntu.com/ubuntu noble-backports InRelease
Get:5 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages [1073 kB]
Fetched 1199 kB in 2s (755 kB/s)
Reading package lists...
02/07/2026 07:40:00 DEBUG: Checking system architecture.
02/07/2026 07:40:00 DEBUG: System architecture: x86_64
02/07/2026 07:40:00 INFO: Verifying that your system meets the recommended minimum hardware requirements.
02/07/2026 07:40:01 DEBUG: CPU cores detected: 8
02/07/2026 07:40:01 DEBUG: Free RAM memory detected: 8065
02/07/2026 07:40:01 DEBUG: Checking previous certificate existence.
02/07/2026 07:40:01 DEBUG: Checking ports availability.
Hit:1 http://security.ubuntu.com/ubuntu noble-security InRelease
Hit:2 http://archive.ubuntu.com/ubuntu noble InRelease
Hit:3 http://archive.ubuntu.com/ubuntu noble-updates InRelease
Hit:4 http://archive.ubuntu.com/ubuntu noble-backports InRelease
Reading package lists...
02/07/2026 07:40:10 DEBUG: Installing prerequisites dependencies.
02/07/2026 07:40:11 DEBUG: Checking curl tool version.
02/07/2026 07:40:13 DEBUG: Adding the Wazuh repository.
gpg: keyring '/usr/share/keyrings/wazuh.gpg' created
gpg: key 96B3EE5F29111145: public key "Wazuh.com (Wazuh Signing Key)  xxx imported
gpg: Total number processed: 1
gpg:               imported: 1
deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main
Get:1 https://packages.wazuh.com/4.x/apt stable InRelease [17.3 kB]
Get:2 https://packages.wazuh.com/4.x/apt stable/main amd64 Packages [53.2 kB]
Hit:3 http://archive.ubuntu.com/ubuntu noble InRelease
Hit:4 http://archive.ubuntu.com/ubuntu noble-updates InRelease
Hit:5 http://archive.ubuntu.com/ubuntu noble-backports InRelease
Hit:6 http://security.ubuntu.com/ubuntu noble-security InRelease
Fetched 70.5 kB in 1s (51.1 kB/s)
Reading package lists...
02/07/2026 07:40:18 INFO: Wazuh repository added.
02/07/2026 07:40:18 DEBUG: Extracting Wazuh configuration.
02/07/2026 07:40:18 DEBUG: Reading configuration file.
02/07/2026 07:40:18 DEBUG: Checking if 10.11.2.80 is private.
02/07/2026 07:40:18 DEBUG: Checking if 10.11.2.81 is private.
02/07/2026 07:40:18 DEBUG: Checking if 10.11.2.83 is private.
02/07/2026 07:40:18 DEBUG: Checking if 10.11.2.82 is private.
02/07/2026 07:40:18 DEBUG: Checking if 10.11.2.84 is private.
02/07/2026 07:40:18 DEBUG: Checking node names in the configuration file.
02/07/2026 07:40:18 INFO: --- Wazuh server ---
02/07/2026 07:40:18 INFO: Starting the Wazuh manager installation.
Reading package lists... Building dependency tree... Reading state information... Suggested packages: expect The following NEW packages will be installed: wazuh-manager 0 upgraded, 1 newly installed, 0 to remove and 1 not upgraded. Need to get 0 B/530 MB of archives. After this operation, 1114 MB  Running kernel seems to be up-to-date. Restarting services... systemctl restart filebeat.service Failed to restart filebeat.service: Unit filebeat.service not found. No containers need to be restarted. No user sessions are running outdated binaries. No VM guests are running outdated hypervisor (qemu) binaries on this host.
02/07/2026 07:45:19 DEBUG: Checking Wazuh installation.
02/07/2026 07:45:19 DEBUG: There are Wazuh remaining files.
02/07/2026 07:45:21 INFO: Wazuh manager installation finished.
02/07/2026 07:45:21 DEBUG: Configuring Wazuh manager.
02/07/2026 07:45:21 DEBUG: Setting provisional Wazuh indexer password.
02/07/2026 07:45:24 INFO: Wazuh manager vulnerability detection configuration finished.
02/07/2026 07:45:24 DEBUG: Starting Wazuh manager cluster.
02/07/2026 07:45:24 INFO: Starting service wazuh-manager.
Created symlink /etc/systemd/system/multi-user.target.wants/wazuh-manager.service → /usr/lib/systemd/system/wazuh-manager.service.
02/07/2026 07:45:49 INFO: wazuh-manager service started.
02/07/2026 07:45:49 INFO: Starting Filebeat installation.
Reading package lists... Building dependency tree... Reading state information... The following NEW packages will be installed: filebeat 0 upgraded, 1 newly installed, 0 to remove and 1 not upgraded. Need to get 0 B/22.1 MB of archives. After this operation, 73.6 MB of additional disk space will b Running kernel seems to be up-to-date. Restarting services... systemctl restart filebeat.service No containers need to be restarted. No user sessions are running outdated binaries. No VM guests are running outdated hypervisor (qemu) binaries on this host.
02/07/2026 07:46:35 DEBUG: Checking Wazuh installation.
02/07/2026 07:46:35 DEBUG: There are Wazuh remaining files.
02/07/2026 07:46:36 DEBUG: There are Filebeat remaining files.
02/07/2026 07:46:37 INFO: Filebeat installation finished.
02/07/2026 07:46:37 DEBUG: Configuring Filebeat.
02/07/2026 07:46:37 DEBUG: Filebeat template was download successfully.
wazuh/
wazuh/alerts/
wazuh/alerts/manifest.yml
wazuh/alerts/config/
wazuh/alerts/config/alerts.yml
wazuh/alerts/ingest/
wazuh/alerts/ingest/pipeline.json
wazuh/archives/
wazuh/archives/manifest.yml
wazuh/archives/config/
wazuh/archives/config/archives.yml
wazuh/archives/ingest/
wazuh/archives/ingest/pipeline.json
wazuh/_meta/
wazuh/_meta/config.yml
wazuh/_meta/fields.yml
wazuh/_meta/docs.asciidoc
wazuh/module.yml
02/07/2026 07:46:37 DEBUG: Filebeat module was downloaded successfully.
02/07/2026 07:46:37 DEBUG: Copying Filebeat certificates.
Created filebeat keystore
Successfully updated the keystore
Successfully updated the keystore
02/07/2026 07:46:43 INFO: Filebeat post-install configuration finished.
02/07/2026 07:46:43 DEBUG: Setting Wazuh indexer cluster passwords.
02/07/2026 07:46:43 DEBUG: Checking Wazuh installation.
02/07/2026 07:46:43 DEBUG: There are Wazuh remaining files.
02/07/2026 07:46:44 DEBUG: There are Filebeat remaining files.
Successfully updated the keystore
Successfully updated the keystore
02/07/2026 07:47:15 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password.
02/07/2026 07:47:15 DEBUG: Restarting filebeat service...
02/07/2026 07:47:20 DEBUG: filebeat started.
02/07/2026 07:47:41 DEBUG: Restarting wazuh-manager service...
02/07/2026 07:48:11 DEBUG: wazuh-manager started.
02/07/2026 07:48:11 DEBUG: Changing API passwords.
02/07/2026 07:48:11 ERROR: User  is not registered in Wazuh API
02/07/2026 07:48:11 INFO: --- Removing existing Wazuh installation ---
02/07/2026 07:48:11 INFO: Removing Wazuh manager.
Reading package lists...
Building dependency tree...
Reading state information...
The following packages will be REMOVED:
  wazuh-manager*
0 upgraded, 0 newly installed, 1 to remove and 1 not upgraded.
                                                              After this operation, 1114 MB disk space will be freed.
(Reading database ... 131200 files and directories currently installed.)                                             (Reading database ...
Removing wazuh-manager (4.14.6-1) ...
(Reading database ... 107151 files and directories currently installed.)
Purging configuration files for wazuh-manager (4.14.6-1) ...
02/07/2026 07:48:47 INFO: Wazuh manager removed.
02/07/2026 07:48:47 INFO: Removing Filebeat.
Reading package lists...
Building dependency tree...
Reading state information...
The following packages will be REMOVED:
  filebeat*
0 upgraded, 0 newly installed, 1 to remove and 1 not upgraded.
                                                              After this operation, 73.6 MB disk space will be freed.
(Reading database ... 107134 files and directories currently installed.)                                             (Reading database ...
Removing filebeat (7.10.2-2) ...
(Reading database ... 106842 files and directories currently installed.)
Purging configuration files for filebeat (7.10.2-2) ...
dpkg: warning: while removing filebeat, directory '/usr/share/filebeat/module' not empty so not removed
dpkg: warning: while removing filebeat, directory '/etc/filebeat' not empty so not removed
02/07/2026 07:48:58 INFO: Filebeat removed.
02/07/2026 07:48:58 DEBUG: Removing GPG key from system.
02/07/2026 07:48:59 INFO: Installation cleaned. Check the /var/log/wazuh-install.log file to learn more about the issue.
root@yipsvrwzh04:/opt/wazuh-opt# 

unistall the wazuh and installing the ubuntu is not solve the problem. is there any missing configuration ? 

i used this documentation https://documentation.wazuh.com/current/installation-guide/index.html

and this is not my first time instaling wazuh with distributed , but right now the problem " api user not register ..  " it is weird because i dont change the password , config.yml is correctly to

[Miguel Ángel De la Vega Rodríguez]

Permissions on `wazuh-install-files.tar` are too restrictive or leftover config exists.

Fix:
1. Run `chmod 644 wazuh-install-files.tar`.
2. Delete `/var/ossec` and `/etc/wazuh-manager` from prior installs.
3. Restart the installer.