Wazuh dashboard server is not ready yet
891 views
Skip to first unread message
Alejandro Perez Reinoso
Sep 17, 2024, 12:30:21 PM9/17/24
to Wazuh | Mailing List
Good afternoon Team, I have an issue with Wazuh. I have 3 Wazuh servers and it been a while since the last time I logged in on those servers because I have access to the information I often use using Grafana. The thing is that when I try to access 2 of those server using the browser I get the message :
Wazuh dashboard server is not ready yet
I restarted the manager, indexer and dashboard, restarted the server and the problem persisted.
This is the version of one of my servers:
WAZUH_VERSION="v4.9.0"
WAZUH_REVISION="40907"
WAZUH_TYPE="server"
WAZUH_TYPE="server"
Can someone help me with this issue, thank you very much beforehand.
Systemctl status wazuh-manager
Output:
wazuh-manager.service - Wazuh manager
Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; preset: disabled)
Active: active (running) since Tue 2024-09-17 11:02:20 CDT; 23min ago
Process: 5369 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=0/SUCCESS)
Tasks: 177 (limit: 4200)
Memory: 1.5G
CPU: 9min 9.582s
CGroup: /system.slice/wazuh-manager.service
├─5431 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─5432 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─5435 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─5438 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─5480 /var/ossec/bin/wazuh-authd
├─5497 /var/ossec/bin/wazuh-db
├─5523 /var/ossec/bin/wazuh-execd
├─5535 /var/ossec/bin/wazuh-maild
├─5542 /var/ossec/bin/wazuh-analysisd
├─5552 /var/ossec/bin/wazuh-syscheckd
├─5570 /var/ossec/bin/wazuh-remoted
├─5571 /var/ossec/bin/wazuh-remoted
├─5656 /var/ossec/bin/wazuh-logcollector
├─5673 /var/ossec/bin/wazuh-monitord
└─5692 /var/ossec/bin/wazuh-modulesd
Sep 17 11:02:13 rrgbbcwazuhprod env[5369]: Started wazuh-analysisd...
Sep 17 11:02:14 rrgbbcwazuhprod env[5369]: Started wazuh-syscheckd...
Sep 17 11:02:15 rrgbbcwazuhprod env[5369]: Started wazuh-remoted...
Sep 17 11:02:16 rrgbbcwazuhprod env[5369]: Started wazuh-logcollector...
Sep 17 11:02:17 rrgbbcwazuhprod env[5369]: Started wazuh-monitord...
Sep 17 11:02:17 rrgbbcwazuhprod env[5690]: 2024/09/17 11:02:17 wazuh-modulesd:router: INFO: Loaded router module.
Sep 17 11:02:17 rrgbbcwazuhprod env[5690]: 2024/09/17 11:02:17 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
Sep 17 11:02:18 rrgbbcwazuhprod env[5369]: Started wazuh-modulesd...
Sep 17 11:02:20 rrgbbcwazuhprod env[5369]: Completed.
Sep 17 11:02:20 rrgbbcwazuhprod systemd[1]: Started Wazuh manager.
Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; preset: disabled)
Active: active (running) since Tue 2024-09-17 11:02:20 CDT; 23min ago
Process: 5369 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=0/SUCCESS)
Tasks: 177 (limit: 4200)
Memory: 1.5G
CPU: 9min 9.582s
CGroup: /system.slice/wazuh-manager.service
├─5431 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─5432 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─5435 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─5438 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─5480 /var/ossec/bin/wazuh-authd
├─5497 /var/ossec/bin/wazuh-db
├─5523 /var/ossec/bin/wazuh-execd
├─5535 /var/ossec/bin/wazuh-maild
├─5542 /var/ossec/bin/wazuh-analysisd
├─5552 /var/ossec/bin/wazuh-syscheckd
├─5570 /var/ossec/bin/wazuh-remoted
├─5571 /var/ossec/bin/wazuh-remoted
├─5656 /var/ossec/bin/wazuh-logcollector
├─5673 /var/ossec/bin/wazuh-monitord
└─5692 /var/ossec/bin/wazuh-modulesd
Sep 17 11:02:13 rrgbbcwazuhprod env[5369]: Started wazuh-analysisd...
Sep 17 11:02:14 rrgbbcwazuhprod env[5369]: Started wazuh-syscheckd...
Sep 17 11:02:15 rrgbbcwazuhprod env[5369]: Started wazuh-remoted...
Sep 17 11:02:16 rrgbbcwazuhprod env[5369]: Started wazuh-logcollector...
Sep 17 11:02:17 rrgbbcwazuhprod env[5369]: Started wazuh-monitord...
Sep 17 11:02:17 rrgbbcwazuhprod env[5690]: 2024/09/17 11:02:17 wazuh-modulesd:router: INFO: Loaded router module.
Sep 17 11:02:17 rrgbbcwazuhprod env[5690]: 2024/09/17 11:02:17 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
Sep 17 11:02:18 rrgbbcwazuhprod env[5369]: Started wazuh-modulesd...
Sep 17 11:02:20 rrgbbcwazuhprod env[5369]: Completed.
Sep 17 11:02:20 rrgbbcwazuhprod systemd[1]: Started Wazuh manager.
Systemctl status wazuh-indexer
Output:
● wazuh-indexer.service - wazuh-indexer
Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; preset: disabled)
Active: active (running) since Tue 2024-09-17 11:03:20 CDT; 24min ago
Docs: https://documentation.wazuh.com
Main PID: 6895 (java)
Tasks: 138 (limit: 4200)
Memory: 4.3G
CPU: 9min 88ms
CGroup: /system.slice/wazuh-indexer.service
└─6895 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encodin>
Sep 17 11:03:01 rrgbbcwazuhprod systemd-entrypoint[6895]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.13.0.jar)
Sep 17 11:03:01 rrgbbcwazuhprod systemd-entrypoint[6895]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Sep 17 11:03:01 rrgbbcwazuhprod systemd-entrypoint[6895]: WARNING: System::setSecurityManager will be removed in a future release
Sep 17 11:03:02 rrgbbcwazuhprod systemd-entrypoint[6895]: Sep 17, 2024 11:03:02 AM sun.util.locale.provider.LocaleProviderAdapter <clinit>
Sep 17 11:03:02 rrgbbcwazuhprod systemd-entrypoint[6895]: WARNING: COMPAT locale provider will be removed in a future release
Sep 17 11:03:03 rrgbbcwazuhprod systemd-entrypoint[6895]: WARNING: A terminally deprecated method in java.lang.System has been called
Sep 17 11:03:03 rrgbbcwazuhprod systemd-entrypoint[6895]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.13.0.jar)
Sep 17 11:03:03 rrgbbcwazuhprod systemd-entrypoint[6895]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Sep 17 11:03:03 rrgbbcwazuhprod systemd-entrypoint[6895]: WARNING: System::setSecurityManager will be removed in a future release
Sep 17 11:03:20 rrgbbcwazuhprod systemd[1]: Started wazuh-indexer.
Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; preset: disabled)
Active: active (running) since Tue 2024-09-17 11:03:20 CDT; 24min ago
Docs: https://documentation.wazuh.com
Main PID: 6895 (java)
Tasks: 138 (limit: 4200)
Memory: 4.3G
CPU: 9min 88ms
CGroup: /system.slice/wazuh-indexer.service
└─6895 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encodin>
Sep 17 11:03:01 rrgbbcwazuhprod systemd-entrypoint[6895]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.13.0.jar)
Sep 17 11:03:01 rrgbbcwazuhprod systemd-entrypoint[6895]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Sep 17 11:03:01 rrgbbcwazuhprod systemd-entrypoint[6895]: WARNING: System::setSecurityManager will be removed in a future release
Sep 17 11:03:02 rrgbbcwazuhprod systemd-entrypoint[6895]: Sep 17, 2024 11:03:02 AM sun.util.locale.provider.LocaleProviderAdapter <clinit>
Sep 17 11:03:02 rrgbbcwazuhprod systemd-entrypoint[6895]: WARNING: COMPAT locale provider will be removed in a future release
Sep 17 11:03:03 rrgbbcwazuhprod systemd-entrypoint[6895]: WARNING: A terminally deprecated method in java.lang.System has been called
Sep 17 11:03:03 rrgbbcwazuhprod systemd-entrypoint[6895]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.13.0.jar)
Sep 17 11:03:03 rrgbbcwazuhprod systemd-entrypoint[6895]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Sep 17 11:03:03 rrgbbcwazuhprod systemd-entrypoint[6895]: WARNING: System::setSecurityManager will be removed in a future release
Sep 17 11:03:20 rrgbbcwazuhprod systemd[1]: Started wazuh-indexer.
Systemctl status wazuh-dashboard
Output:
wazuh-dashboard.service - wazuh-dashboard
Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; preset: disabled)
Active: active (running) since Tue 2024-09-17 11:09:32 CDT; 19min ago
Main PID: 7408 (node)
Tasks: 11 (limit: 4200)
Memory: 175.3M
CPU: 30.889s
CGroup: /system.slice/wazuh-dashboard.service
└─7408 /usr/share/wazuh-dashboard/node/bin/node /usr/share/wazuh-dashboard/src/cli/dist
Sep 17 11:28:23 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:23Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:24 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:24Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:26 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:26Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:27 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:27Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:29 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:29Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:30 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:30Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:32 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:32Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:33 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:33Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:35 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:35Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:36 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:36Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; preset: disabled)
Active: active (running) since Tue 2024-09-17 11:09:32 CDT; 19min ago
Main PID: 7408 (node)
Tasks: 11 (limit: 4200)
Memory: 175.3M
CPU: 30.889s
CGroup: /system.slice/wazuh-dashboard.service
└─7408 /usr/share/wazuh-dashboard/node/bin/node /usr/share/wazuh-dashboard/src/cli/dist
Sep 17 11:28:23 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:23Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:24 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:24Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:26 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:26Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:27 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:27Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:29 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:29Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:30 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:30Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:32 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:32Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:33 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:33Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:35 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:35Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Sep 17 11:28:36 rrgbbcwazuhprod opensearch-dashboards[7408]: {"type":"log","@timestamp":"2024-09-17T16:28:36Z","tags":["info","savedobjects-service"],"pid":7408,"message":"Detected mapping change in \"properties.homepage\""}
Maximiliano Ibarra
Sep 17, 2024, 4:07:46 PM9/17/24
to Wazuh | Mailing List
Hi Alejandro.
have you updated wazuh recently?
If so, can you tell me which version?
have you updated wazuh recently?
If so, can you tell me which version?
Alejandro Perez Reinoso
Sep 17, 2024, 4:37:33 PM9/17/24
to Wazuh | Mailing List
Hi good afternoon Maximiliano, it seems that someone on my team updated the Wazuh, but I can't confirm that.
This is the version of one of my servers that is having the issue.
WAZUH_VERSION="v4.9.0"
WAZUH_REVISION="40907"
WAZUH_TYPE="server"
WAZUH_TYPE="server"
I was doing some research on the internet and I followed the steps on this link Wazuh central components - Upgrade guide · Wazuh documentation
and the error persisted but
when I run systemctl status wazuh-dashboard this is output that I see
wazuh-dashboard.service - wazuh-dashboard
Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; preset: disabled)
Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; preset: disabled)
Active: active (running) since Tue 2024-09-17 14:34:53 CDT; 1h 2min ago
Main PID: 7800 (node)
Tasks: 11 (limit: 4200)
Memory: 185.8M
CPU: 59.378s
CGroup: /system.slice/wazuh-dashboard.service
└─7800 /usr/share/wazuh-dashboard/node/bin/node /usr/share/wazuh-dashboard/src/cli/dist
Sep 17 15:36:51 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:36:51Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:36:54 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:36:54Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:36:56 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:36:56Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:36:59 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:36:59Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:37:01 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:37:01Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:37:04 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:37:04Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:37:06 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:37:06Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:37:09 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:37:09Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:37:11 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:37:11Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:37:14 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:37:14Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Main PID: 7800 (node)
Tasks: 11 (limit: 4200)
Memory: 185.8M
CPU: 59.378s
CGroup: /system.slice/wazuh-dashboard.service
└─7800 /usr/share/wazuh-dashboard/node/bin/node /usr/share/wazuh-dashboard/src/cli/dist
Sep 17 15:36:51 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:36:51Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:36:54 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:36:54Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:36:56 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:36:56Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:36:59 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:36:59Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:37:01 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:37:01Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:37:04 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:37:04Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:37:06 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:37:06Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:37:09 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:37:09Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:37:11 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:37:11Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Sep 17 15:37:14 rrgbbcwazuhprod opensearch-dashboards[7800]: {"type":"log","@timestamp":"2024-09-17T20:37:14Z","tags":["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Aarif “linuxaarif” Khan
Sep 20, 2024, 8:33:27 AM9/20/24
to Wazuh | Mailing List
Hi Team,
Can I know if this was resolved I am stuck with exact same issue and either chatgpt or gemini or copilot isn't helping me.
Yes, I recently updated my wazuh and looks like everytime you update wazuh and because it is using opensearch there is always 1 or 2 issues and it takes ages to fix them and new update comes and it breaks.
journalctl -flu wazuh-dashboard
wazuh.remitone.com opensearch-dashboards[144300]: {"type":"log","@timestamp":"2024-09-20T10:24:11Z","tags":["info","savedobjects-service"],"pid":144300,"message":"Detected mapping change in \"properties.homepage\""}
Can I know if this was resolved I am stuck with exact same issue and either chatgpt or gemini or copilot isn't helping me.
Yes, I recently updated my wazuh and looks like everytime you update wazuh and because it is using opensearch there is always 1 or 2 issues and it takes ages to fix them and new update comes and it breaks.
journalctl -flu wazuh-dashboard
wazuh.remitone.com opensearch-dashboards[144300]: {"type":"log","@timestamp":"2024-09-20T10:24:11Z","tags":["info","savedobjects-service"],"pid":144300,"message":"Detected mapping change in \"properties.homepage\""}
Aarif “linuxaarif” Khan
Sep 20, 2024, 8:34:19 AM9/20/24
to Wazuh | Mailing List
I didn't notice there were two different logs.
The first one where it says ""Detected mapping change in \"properties.homepage\""}" you just need to delete .kibana_* check your wazuh-dashboard log for exact name
$ sudo curl -X DELETE -u admin:password -k "https://localhost:9200/.kibana_1"
Restart
$ sudo systemctl restart wazuh-dashboard
Check Logs
$ sudo journalctl -flu wazuh-dashboard
And for the 2nd logs "["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
" it mean you need to start wazuh-indexer you can check by doing:
Check for port 9200
$ sudo netstat -tnlp
if not open the start
$ systemctl start wazuh-indexer
now go back and check logs in wazuh-dashboard
$ sudo journalctl -flu wazuh-dashboard
The first one where it says ""Detected mapping change in \"properties.homepage\""}" you just need to delete .kibana_* check your wazuh-dashboard log for exact name
$ sudo curl -X DELETE -u admin:password -k "https://localhost:9200/.kibana_1"
Restart
$ sudo systemctl restart wazuh-dashboard
Check Logs
$ sudo journalctl -flu wazuh-dashboard
And for the 2nd logs "["error","opensearch","data"],"pid":7800,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
" it mean you need to start wazuh-indexer you can check by doing:
Check for port 9200
$ sudo netstat -tnlp
if not open the start
$ systemctl start wazuh-indexer
now go back and check logs in wazuh-dashboard
$ sudo journalctl -flu wazuh-dashboard
On Tuesday 17 September 2024 at 21:37:33 UTC+1 Alejandro Perez Reinoso wrote:
Maximiliano Ibarra
Sep 27, 2024, 4:03:56 PM9/27/24
to Wazuh | Mailing List
There is a problem updating to 4.9.0. I leave you some steps so you can solve your problem.
We published Wazuh dashboard revision 1 packages:
- wazuh-dashboard-4.9.0-1.deb
- wazuh-dashboard-4.9.0-1.rpm
These packages introduced a change in the keystore location to /usr/share/wazuh-dashboard/config, which caused issues when upgrading from previous versions, leading to the "Dashboard is not ready" error. Additionally, the kibanaserver user displayed failed authentication messages in the indexer logs.To resolve this, we have rolled out Wazuh dashboard revision 2 of these packages:
- wazuh-dashboard-4.9.0-2.deb
- wazuh-dashboard-4.9.0-2.rpm
Wazuh 4.x repositories are available again.Important: If you upgraded using wazuh-dashboard-4.9.0-1, follow these steps:
- Install the new Wazuh dashboard revision 2 packages.
- Backup your current keystore:
3. Backup the keystore from the new location:
4. Move the keystore to the correct location:
5. Restart the Wazuh dashboard
dmitri
Oct 18, 2024, 4:18:16 AM10/18/24
to Wazuh | Mailing List
Hello team,
I have same issue after upgrading from version 4.8.2 to 4.9.1:
I have same issue after upgrading from version 4.8.2 to 4.9.1:
Wazuh dashboard server is not ready yet
> journalctl -n 10 -u wazuh-dashboard | grep -iE 'err|warn'
Oct 18 11:16:23 ubuntu opensearch-dashboards[442]: {"type":"log","@timestamp":"2024-10-18T08:16:23Z","tags":["error","opensearch","data"],"pid":442,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Oct 18 11:16:26 ubuntu opensearch-dashboards[442]: {"type":"log","@timestamp":"2024-10-18T08:16:26Z","tags":["error","opensearch","data"],"pid":442,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Oct 18 11:16:28 ubuntu opensearch-dashboards[442]: {"type":"log","@timestamp":"2024-10-18T08:16:28Z","tags":["error","opensearch","data"],"pid":442,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Oct 18 11:16:31 ubuntu opensearch-dashboards[442]: {"type":"log","@timestamp":"2024-10-18T08:16:31Z","tags":["error","opensearch","data"],"pid":442,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Oct 18 11:16:33 ubuntu opensearch-dashboards[442]: {"type":"log","@timestamp":"2024-10-18T08:16:33Z","tags":["error","opensearch","data"],"pid":442,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Oct 18 11:16:36 ubuntu opensearch-dashboards[442]: {"type":"log","@timestamp":"2024-10-18T08:16:36Z","tags":["error","opensearch","data"],"pid":442,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Oct 18 11:16:23 ubuntu opensearch-dashboards[442]: {"type":"log","@timestamp":"2024-10-18T08:16:23Z","tags":["error","opensearch","data"],"pid":442,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Oct 18 11:16:26 ubuntu opensearch-dashboards[442]: {"type":"log","@timestamp":"2024-10-18T08:16:26Z","tags":["error","opensearch","data"],"pid":442,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Oct 18 11:16:28 ubuntu opensearch-dashboards[442]: {"type":"log","@timestamp":"2024-10-18T08:16:28Z","tags":["error","opensearch","data"],"pid":442,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Oct 18 11:16:31 ubuntu opensearch-dashboards[442]: {"type":"log","@timestamp":"2024-10-18T08:16:31Z","tags":["error","opensearch","data"],"pid":442,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Oct 18 11:16:33 ubuntu opensearch-dashboards[442]: {"type":"log","@timestamp":"2024-10-18T08:16:33Z","tags":["error","opensearch","data"],"pid":442,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Oct 18 11:16:36 ubuntu opensearch-dashboards[442]: {"type":"log","@timestamp":"2024-10-18T08:16:36Z","tags":["error","opensearch","data"],"pid":442,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Maximiliano Ibarra
Oct 18, 2024, 12:33:39 PM10/18/24
to Wazuh | Mailing List
Hi all.
The problem comes from the lack of an environment variable OSD_PATH_CONF in /etc/default/wazuh-dashboard
In 4.8 that file had the following line at the end of the file:
OSD_PATH_CONF="/etc/wazuh-dashboard"
This tells wazuh-dashboard where is the opensearch_dashboards.keystore which stores the credentials to connect to wazuh-indexer.
When upgrading from 4.8.x to 4.9.0, this variable is lost, and dashboard starts using the keystore present in /usr/share/wazuh-dashboard/config/ instead of the one which came from 4.8.x in /etc/wazuh-dashboard.
If you already changed the password, beware that if you add the missing env var missing, you need to copy your new keystore into the /etc/wazuh/dashboard, for example:
# cp /etc/wazuh-dashboard/opensearch_dashboards.keystore /etc/wazuh-dashboard/opensearch_dashboards.keystore.back
# cp /usr/share/wazuh-dashboard/config/opensearch_dashboards.keystore /etc/wazuh-dashboard/
Also, if you move your keystore again to /etc/wazuh-dashboard, you need to add the
OSD_PATH_CONF="/etc/wazuh-dashboard"
env var on your profile, so the keystore tool located in /usr/share/wazuh-dashboard/bin/opensearch-dashboard-keystore use the correct keystore.
The problem comes from the lack of an environment variable OSD_PATH_CONF in /etc/default/wazuh-dashboard
In 4.8 that file had the following line at the end of the file:
OSD_PATH_CONF="/etc/wazuh-dashboard"
This tells wazuh-dashboard where is the opensearch_dashboards.keystore which stores the credentials to connect to wazuh-indexer.
When upgrading from 4.8.x to 4.9.0, this variable is lost, and dashboard starts using the keystore present in /usr/share/wazuh-dashboard/config/ instead of the one which came from 4.8.x in /etc/wazuh-dashboard.
If you already changed the password, beware that if you add the missing env var missing, you need to copy your new keystore into the /etc/wazuh/dashboard, for example:
# cp /etc/wazuh-dashboard/opensearch_dashboards.keystore /etc/wazuh-dashboard/opensearch_dashboards.keystore.back
# cp /usr/share/wazuh-dashboard/config/opensearch_dashboards.keystore /etc/wazuh-dashboard/
Also, if you move your keystore again to /etc/wazuh-dashboard, you need to add the
OSD_PATH_CONF="/etc/wazuh-dashboard"
env var on your profile, so the keystore tool located in /usr/share/wazuh-dashboard/bin/opensearch-dashboard-keystore use the correct keystore.
Please, check these steps and tell me how it was.
dmitri
Oct 21, 2024, 3:24:32 AM10/21/24
to Wazuh | Mailing List
Hi Maximiliano,
After upgrade, this variable OSD_PATH_CONF="/etc/wazuh-dashboard" had not disappeared, it is still present in file /etc/default/wazuh-dashboard:
user="wazuh-dashboard"
group="wazuh-dashboard"
chroot="/"
chdir="/"
nice=""
KILL_ON_STOP_TIMEOUT=0
OSD_PATH_CONF="/etc/wazuh-dashboard"
group="wazuh-dashboard"
chroot="/"
chdir="/"
nice=""
KILL_ON_STOP_TIMEOUT=0
OSD_PATH_CONF="/etc/wazuh-dashboard"
Also, after upgrade there is NO any opensearch_dashboards.keystore file located in /usr/share/wazuh-dashboard/config/. This file is present in /etc/wazuh-dashboard.
Ivan Ralchev
Oct 22, 2024, 3:07:32 AM10/22/24
to Wazuh | Mailing List
Hi all!
[root@wazuh-server wazuh-dashboard]# systemctl status wazuh-dashboard.service -l
● wazuh-dashboard.service - wazuh-dashboard
Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: disabled)
Active: active (running) since Mon 2024-10-21 21:29:00 EEST; 10min ago
Main PID: 3037 (node)
CGroup: /system.slice/wazuh-dashboard.service
└─3037 /usr/share/wazuh-dashboard/node/fallback/bin/node /usr/share/wazuh-dashboard/src/cli/dist
Oct 21 21:39:16 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:16Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:18 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:18Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:19 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:19Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:21 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:21Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:22 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:22Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:24 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:24Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:25 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:25Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:27 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:27Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:28 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:28Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:30 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:30Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
I have the exact same issue and just like dmitri reports above, the opensearch_dashboards.keystore file is located in /etc/wazuh-dashboard and the OSD_PATH_CONF variable is correctly set to /etc/dashboard.
However, this is what I get for wazuh-dashboard.service:
● wazuh-dashboard.service - wazuh-dashboard
Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: disabled)
Active: active (running) since Mon 2024-10-21 21:29:00 EEST; 10min ago
Main PID: 3037 (node)
CGroup: /system.slice/wazuh-dashboard.service
└─3037 /usr/share/wazuh-dashboard/node/fallback/bin/node /usr/share/wazuh-dashboard/src/cli/dist
Oct 21 21:39:16 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:16Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:18 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:18Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:19 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:19Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:21 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:21Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:22 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:22Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:24 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:24Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:25 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:25Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:27 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:27Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:28 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:28Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
Oct 21 21:39:30 wazuh-server opensearch-dashboards[3037]: {"type":"log","@timestamp":"2024-10-21T18:39:30Z","tags":["info","savedobjects-service"],"pid":3037,"message":"Detected mapping change in \"properties.homepage\""}
And the Wazuh dashboard server is not ready yet...
Best,
Ivan
clsamc...@gmail.com
Oct 23, 2024, 9:48:54 AM10/23/24
to Wazuh | Mailing List
I have the same issue. I can also confirm the OSD_PATH_CONF variable is set in /etc/default/wazuh-dashboard. This issue occurred after upgrading from 4.8.0-1 to 4.9.1-1. I am running on Ubuntu server 20.04,6 LTS.
I have restored from a backup. It has cost me a few days of alerts and logs.
clsamc...@gmail.com
Oct 23, 2024, 10:51:14 AM10/23/24
to Wazuh | Mailing List
As an update, I restarted the updated server and discovered the issue is with OpenSearch. I see a large number of errors but I think this is the culprit:
[2024-10-23T10:34:48,482][ERROR][o.o.i.i.ManagedIndexCoordinator] [node-1] Failed to get ISM policies with templates: Failed to execute phase [query], all shards failed.
[2024-10-23T10:34:48,482][ERROR][o.o.i.i.ManagedIndexCoordinator] [node-1] Failed to get ISM policies with templates: Failed to execute phase [query], all shards failed.
Maha
Oct 24, 2024, 1:35:41 AM10/24/24
to Wazuh | Mailing List
Hi,
even I'm facing the same issue. any fixes ?
Reply all
Reply to author
Forward
0 new messages