Docker upgrade from 4.7.4 to 4.8.1 issue

158 views
Skip to first unread message

Daniel D'Angeli

unread,
Jul 22, 2024, 10:07:45 AM7/22/24
to Wazuh | Mailing List
Hi,

i am trying to upgrade the docker deployment of multi node Wazuh from 4.7.4 to 4.8.1 and this is what i have done so far:

- Replaced "vulnerability-detector" with the new " vulnerability-detection ":
<vulnerability-detection>
  <enabled>yes</enabled>
  <index-status>yes</index-status>
  <feed-update-interval>60m</feed-update-interval>
</vulnerability-detection>

- Added the new indexer blocked and configured as per the documentation:
  <indexer>
    <enabled>yes</enabled>
    <hosts>
      <host>https://wazuh1.indexer:9200</host>
      <host>https://wazuh2.indexer:9200</host>
      <host>https://wazuh3.indexer:9200</host>
    </hosts>
    <ssl>
      <certificate_authorities>
        <ca>/etc/ssl/root-ca.pem</ca>
      </certificate_authorities>
      <certificate>/etc/ssl/filebeat.pem</certificate>
      <key>/etc/ssl/filebeat.key</key>
    </ssl>
  </indexer>

Every service seems to work fine apart from the Wazuh master container, which keeps restarting and outputs the following error:

2024-07-22T14:03:43.579Z        INFO    eslegclient/connection.go:99    elasticsearch url: https://wazuh1.indexer:9200
2024-07-22T14:03:43.580Z        INFO    [publisher]     pipeline/module.go:113  Beat name: wazuh.master
2024-07-22T14:03:43.582Z        INFO    beater/filebeat.go:117  Enabled modules/filesets: wazuh (alerts, archives),  ()
2024-07-22T14:03:43.583Z        INFO    instance/beat.go:455    filebeat start running.
2024-07-22T14:03:43.583Z        INFO    [monitoring]    log/log.go:118  Starting metrics logging every 30s
2024-07-22T14:03:43.584Z        INFO    memlog/store.go:119     Loading data file of '/var/lib/filebeat/registry/filebeat' succeeded. Active transaction id=22039148
runtime/cgo: pthread_create failed: Operation not permitted
SIGABRT: abort
PC=0x7f0e1e58553c m=8 sigcode=18446744073709551610

goroutine 0 [idle]:
runtime: unknown pc 0x7f0e1e58553c
stack: frame={sp:0x7f0ddfffe7a0, fp:0x0} stack=[0x7f0ddf7ff1e8,0x7f0ddfffede8)
00007f0ddfffe6a0:  0000000000000000  0000000000000000
00007f0ddfffe6b0:  0000000000000000  0000000000000000
00007f0ddfffe6c0:  0000000000000000  0000000000000000
00007f0ddfffe6d0:  0000000000000000  0000000000000000
00007f0ddfffe6e0:  0000000000000000  0000000000000000
00007f0ddfffe6f0:  0000000000000000  0000000000000000
00007f0ddfffe700:  0000000000000000  0000000000000000
00007f0ddfffe710:  0000000000000000  0000000000000000
00007f0ddfffe720:  0000000000000000  0000000000000000
00007f0ddfffe730:  0000000000000000  0000000000000000
00007f0ddfffe740:  0000000000000000  0000000000000000
00007f0ddfffe750:  0000000000000000  0000000000000000
00007f0ddfffe760:  0000000000000000  0000000000000000
00007f0ddfffe770:  0000000000000000  0000000000000000
00007f0ddfffe780:  0000000000000000  00007f0e1e592bb9
00007f0ddfffe790:  0000000000000000  00007f0e1e58552e
00007f0ddfffe7a0: <0000000000000130  0000000000000000
00007f0ddfffe7b0:  0000000000000120  0000000000000000
00007f0ddfffe7c0:  0000000000000013  0000000000000000
00007f0ddfffe7d0:  0000000000000000  0000000000000004
00007f0ddfffe7e0:  0000003400000013  00007f0e1e6332a1
00007f0ddfffe7f0:  00007f0ddf7fe640  00007f0ddfffeab0
00007f0ddfffe800:  00007f0ddfffe92e  00007f0ddfffe92f
00007f0ddfffe810:  00007f0ddf7fe640  00007f0e1e583425
00007f0ddfffe820:  00007f0dd4000020  1a293d270b805a00
00007f0ddfffe830:  00007f0ddffff640  0000000000000006
00007f0ddfffe840:  00007f0de0000c90  0000000000000000
00007f0ddfffe850:  0000000002cf0118  00007f0e1e538d26
00007f0ddfffe860:  00007f0e1e6dee70  00007f0e1e50c7f3
00007f0ddfffe870:  0000000000000020  0000000000000000
00007f0ddfffe880:  0000000000000000  00007f0e1e6229a4
00007f0ddfffe890:  00007f0ddeffe000  000000000000000d
runtime: unknown pc 0x7f0e1e58553c
stack: frame={sp:0x7f0ddfffe7a0, fp:0x0} stack=[0x7f0ddf7ff1e8,0x7f0ddfffede8)
00007f0ddfffe6a0:  0000000000000000  0000000000000000
00007f0ddfffe6b0:  0000000000000000  0000000000000000
00007f0ddfffe6c0:  0000000000000000  0000000000000000
00007f0ddfffe6d0:  0000000000000000  0000000000000000
00007f0ddfffe6e0:  0000000000000000  0000000000000000
00007f0ddfffe6f0:  0000000000000000  0000000000000000
00007f0ddfffe700:  0000000000000000  0000000000000000
00007f0ddfffe710:  0000000000000000  0000000000000000
00007f0ddfffe720:  0000000000000000  0000000000000000
00007f0ddfffe730:  0000000000000000  0000000000000000
00007f0ddfffe740:  0000000000000000  0000000000000000
00007f0ddfffe750:  0000000000000000  0000000000000000
00007f0ddfffe760:  0000000000000000  0000000000000000
00007f0ddfffe770:  0000000000000000  0000000000000000
00007f0ddfffe780:  0000000000000000  00007f0e1e592bb9
00007f0ddfffe790:  0000000000000000  00007f0e1e58552e
00007f0ddfffe7a0: <0000000000000130  0000000000000000
00007f0ddfffe7b0:  0000000000000120  0000000000000000
00007f0ddfffe7c0:  0000000000000013  0000000000000000
00007f0ddfffe7d0:  0000000000000000  0000000000000004
00007f0ddfffe7e0:  0000003400000013  00007f0e1e6332a1
00007f0ddfffe7f0:  00007f0ddf7fe640  00007f0ddfffeab0
00007f0ddfffe800:  00007f0ddfffe92e  00007f0ddfffe92f
00007f0ddfffe810:  00007f0ddf7fe640  00007f0e1e583425
00007f0ddfffe820:  00007f0dd4000020  1a293d270b805a00
00007f0ddfffe830:  00007f0ddffff640  0000000000000006
00007f0ddfffe840:  00007f0de0000c90  0000000000000000
00007f0ddfffe850:  0000000002cf0118  00007f0e1e538d26
00007f0ddfffe860:  00007f0e1e6dee70  00007f0e1e50c7f3
00007f0ddfffe870:  0000000000000020  0000000000000000
00007f0ddfffe880:  0000000000000000  00007f0e1e6229a4
00007f0ddfffe890:  00007f0ddeffe000  000000000000000d

goroutine 1 [runnable]:
syscall.Syscall(0x0, 0x7, 0xc00078f30e, 0x4f2, 0x4f2, 0x4f2, 0x0)
        /usr/local/go/src/syscall/asm_linux_amd64.s:18 +0x5
syscall.read(0x7, 0xc00078f30e, 0x4f2, 0x4f2, 0x0, 0xc0004df6e0, 0xc00063e620)
        /usr/local/go/src/syscall/zsyscall_linux_amd64.go:686 +0x5a
syscall.Read(...)
        /usr/local/go/src/syscall/syscall_unix.go:189
internal/poll.(*FD).Read(0xc0004ea5a0, 0xc00078f30e, 0x4f2, 0x4f2, 0x0, 0x0, 0x0)
        /usr/local/go/src/internal/poll/fd_unix.go:165 +0x133
os.(*File).read(...)
        /usr/local/go/src/os/file_unix.go:263
os.(*File).Read(0xc000010a00, 0xc00078f30e, 0x4f2, 0x4f2, 0x2cef4c9, 0x0, 0xc00063e6a0)
        /usr/local/go/src/os/file.go:116 +0x71
encoding/json.(*Decoder).refill(0xc0004df600, 0xc00083fa37, 0x0)
        /usr/local/go/src/encoding/json/stream.go:165 +0xeb
encoding/json.(*Decoder).readValue(0xc0004df600, 0x0, 0x0, 0x27c56c0)
        /usr/local/go/src/encoding/json/stream.go:140 +0x1e8
encoding/json.(*Decoder).Decode(0xc0004df600, 0x270e900, 0xc00083fa00, 0x0, 0x0)
        /usr/local/go/src/encoding/json/stream.go:63 +0x79
github.com/elastic/beats/v7/libbeat/statestore/backend/memlog.readLogFile(0xc00078b3e0, 0x23, 0xc00063e818, 0x0, 0x0)
        /go/src/github.com/elastic/beats/libbeat/statestore/backend/memlog/diskstore.go:617 +0x248
github.com/elastic/beats/v7/libbeat/statestore/backend/memlog.loadLogFile(0xc00063e908, 0x1504b81, 0xc00078b3e0, 0x23, 0x2, 0x115, 0x0, 0xc00063e8b0)
        /go/src/github.com/elastic/beats/libbeat/statestore/backend/memlog/diskstore.go:565 +0x89
github.com/elastic/beats/v7/libbeat/statestore/backend/memlog.openStore(0xc00044c740, 0xc00078b3e0, 0x23, 0xc000000180, 0x1000, 0x203000, 0x2aedc50, 0xc0001dd1a0, 0x203000, 0x203000)
        /go/src/github.com/elastic/beats/libbeat/statestore/backend/memlog/store.go:123 +0x59d
github.com/elastic/beats/v7/libbeat/statestore/backend/memlog.(*Registry).Access(0xc0004ea1e0, 0x29fa2ec, 0x8, 0x0, 0x0, 0x0, 0x0)
        /go/src/github.com/elastic/beats/libbeat/statestore/backend/memlog/memlog.go:116 +0x1eb
github.com/elastic/beats/v7/libbeat/statestore.(*Registry).Get(0xc0007a0060, 0x29fa2ec, 0x8, 0x0, 0x0, 0x0)
        /go/src/github.com/elastic/beats/libbeat/statestore/registry.go:64 +0x1c9
github.com/elastic/beats/v7/filebeat/beater.(*filebeatStore).Access(0xc0004e9220, 0xc0004ea1e0, 0x0, 0x0)
        /go/src/github.com/elastic/beats/filebeat/beater/store.go:58 +0x40
github.com/elastic/beats/v7/filebeat/registrar.New(0x2d28000, 0xc0004e9220, 0x2d28040, 0xc000010998, 0x0, 0x6, 0xc000124370, 0xc)
        /go/src/github.com/elastic/beats/filebeat/registrar/registrar.go:77 +0x35
github.com/elastic/beats/v7/filebeat/beater.(*Filebeat).Run(0xc000793dd0, 0xc0000ce2c0, 0x0, 0x0)
        /go/src/github.com/elastic/beats/filebeat/beater/filebeat.go:349 +0x600
github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).launch(0xc0000ce2c0, 0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, ...)
        /go/src/github.com/elastic/beats/libbeat/cmd/instance/beat.go:461 +0x7d8
github.com/elastic/beats/v7/libbeat/cmd/instance.Run.func1(0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0xc00063fc30, 0xc000112900, 0x0, 0x0)
        /go/src/github.com/elastic/beats/libbeat/cmd/instance/beat.go:189 +0x55a
github.com/elastic/beats/v7/libbeat/cmd/instance.Run(0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, ...)
        /go/src/github.com/elastic/beats/libbeat/cmd/instance/beat.go:190 +0x148
github.com/elastic/beats/v7/libbeat/cmd.genRunCmd.func1(0xc0000cedc0, 0xc0001871e0, 0x0, 0xb)
        /go/src/github.com/elastic/beats/libbeat/cmd/run.go:36 +0x9d
github.com/spf13/cobra.(*Command).execute(0xc0000cedc0, 0xc00004e0d0, 0xb, 0xb, 0xc0000cedc0, 0xc00004e0d0)
        /go/pkg/mod/github.com/spf13/co...@v0.0.5/command.go:830 +0x29d
github.com/spf13/cobra.(*Command).ExecuteC(0xc0000cedc0, 0xc0000cedc0, 0xffffffff, 0xc00009e058)
        /go/pkg/mod/github.com/spf13/co...@v0.0.5/command.go:914 +0x2fb
github.com/spf13/cobra.(*Command).Execute(...)
        /go/pkg/mod/github.com/spf13/co...@v0.0.5/command.go:864
main.main()
        /go/src/github.com/elastic/beats/filebeat/main.go:36 +0x3d

goroutine 12 [chan receive]:
k8s.io/klog.(*loggingT).flushDaemon(0x4241ce0)
        /go/pkg/mod/k8s.io/kl...@v1.0.0/klog.go:1010 +0x8b
created by k8s.io/klog.init.0
        /go/pkg/mod/k8s.io/kl...@v1.0.0/klog.go:411 +0xd6

goroutine 43 [select]:
github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*bufferingEventLoop).run(0xc00012c3c0)
        /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/eventloop.go:316 +0x1cf
github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue.func1(0xc0004535e0, 0x2d3ed60, 0xc00012c3c0)
        /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:171 +0x5f
created by github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue
        /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:169 +0x373

goroutine 44 [select]:
github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*ackLoop).run(0xc00011d810)
        /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/ackloop.go:60 +0x107
github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue.func2(0xc0004535e0, 0xc00011d810)
        /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:175 +0x59
created by github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue
        /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:173 +0x3a2

goroutine 45 [select]:
github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*consumer).Get(0xc000337300, 0x32, 0x0, 0x0, 0x0, 0x0)
        /go/src/github.com/elastic/beats/libbeat/publisher/queue/memqueue/consume.go:65 +0xe9
github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*eventConsumer).loop(0xc0000ae360, 0x2d3eda0, 0xc000337300)
        /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:182 +0x19a
github.com/elastic/beats/v7/libbeat/publisher/pipeline.newEventConsumer.func1(0xc0000ae360, 0x2d3eda0, 0xc0003372e0)
        /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:86 +0x6c
created by github.com/elastic/beats/v7/libbeat/publisher/pipeline.newEventConsumer
        /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:84 +0x149

goroutine 46 [select]:
github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*retryer).loop(0xc0000ae480)
        /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/retry.go:135 +0x250
created by github.com/elastic/beats/v7/libbeat/publisher/pipeline.newRetryer
        /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/retry.go:94 +0x158

goroutine 47 [select]:
github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run(0xc0000ae660)
        /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/output.go:127 +0xd1
created by github.com/elastic/beats/v7/libbeat/publisher/pipeline.makeClientWorker
        /go/src/github.com/elastic/beats/libbeat/publisher/pipeline/output.go:79 +0x194

goroutine 88 [select]:
github.com/elastic/beats/v7/libbeat/monitoring/report/log.(*reporter).snapshotLoop(0xc000793e00)
        /go/src/github.com/elastic/beats/libbeat/monitoring/report/log/log.go:129 +0x3cb
github.com/elastic/beats/v7/libbeat/monitoring/report/log.MakeReporter.func1(0xc000793e00)
        /go/src/github.com/elastic/beats/libbeat/monitoring/report/log/log.go:107 +0x50
created by github.com/elastic/beats/v7/libbeat/monitoring/report/log.MakeReporter
        /go/src/github.com/elastic/beats/libbeat/monitoring/report/log/log.go:105 +0x157

goroutine 89 [syscall]:
os/signal.signal_recv(0x0)
        /usr/local/go/src/runtime/sigqueue.go:147 +0x9c
os/signal.loop()
        /usr/local/go/src/os/signal/signal_unix.go:23 +0x22
created by os/signal.Notify.func1
        /usr/local/go/src/os/signal/signal.go:127 +0x44

goroutine 91 [chan receive]:
github.com/elastic/beats/v7/libbeat/service.HandleSignals.func1(0xc000135f20, 0xc00044c420, 0xc00044c410, 0xc000057ee0, 0xc0004e9140)
        /go/src/github.com/elastic/beats/libbeat/service/service.go:50 +0x52
created by github.com/elastic/beats/v7/libbeat/service.HandleSignals
        /go/src/github.com/elastic/beats/libbeat/service/service.go:49 +0x172

rax    0x0
rbx    0x7f0ddffff640
rcx    0x7f0e1e58553c
rdx    0x6
rdi    0x509
rsi    0x51c
rbp    0x51c
rsp    0x7f0ddfffe7a0
r8     0x7f0ddfffe870
r9     0x7f0e1e5bbe40
r10    0x8
r11    0x246
r12    0x6
r13    0x0
r14    0x2cf0118
r15    0x0
rip    0x7f0e1e58553c
rflags 0x246
cs     0x33
fs     0x0
gs     0x0
Filebeat exited. code=2

Any tips?

Regards,
Daniel D.

Delfina Lizarralde Bressan

unread,
Jul 22, 2024, 10:29:31 AM7/22/24
to Wazuh | Mailing List
Hi Daniel,
Thanks for using wazuh!

This is a Filebeat error, as discussed here: https://github.com/wazuh/wazuh-packages/issues/1665#issuecomment-1165698879

An alternative solution is proposed, add the following lines in filebeat.yml:
seccomp: default_action: allow syscalls: - action: allow names: - rseq

Could you apply this, and confirm how it works?

Daniel D'Angeli

unread,
Jul 22, 2024, 11:06:06 AM7/22/24
to Wazuh | Mailing List
Hi,

it seems to have worked but now there is an issue with the Wazuh Dashboard:
{"type":"log","@timestamp":"2024-07-22T15:04:11Z","tags":["warning","config","deprecation"],"pid":53,"message":"\"opensearch.requestHeadersWhitelist\" is deprecated and has been replaced by \"opensearch.requestHeadersAllowlist\""}
{"type":"log","@timestamp":"2024-07-22T15:04:11Z","tags":["info","plugins-system"],"pid":53,"message":"Setting up [48] plugins: [usageCollection,opensearchDashboardsUsageCollection,opensearchDashboardsLegacy,mapsLegacy,share,opensearchUiShared,legacyExport,embeddable,expressions,data,home,apmOss,savedObjects,reportsDashboards,dashboard,visualizations,visTypeVega,visTypeTimeline,visTypeTable,visTypeMarkdown,visBuilder,visAugmenter,alertingDashboards,tileMap,regionMap,customImportMapDashboards,inputControlVis,ganttChartDashboards,visualize,indexManagementDashboards,notificationsDashboards,management,indexPatternManagement,advancedSettings,console,dataExplorer,charts,visTypeVislib,visTypeTimeseries,visTypeTagcloud,visTypeMetric,discover,savedObjectsManagement,securityDashboards,wazuhCore,wazuhCheckUpdates,wazuh,bfetch]"}
{"type":"log","@timestamp":"2024-07-22T15:04:12Z","tags":["info","savedobjects-service"],"pid":53,"message":"Waiting until all OpenSearch nodes are compatible with OpenSearch Dashboards before starting saved objects migrations..."}
{"type":"log","@timestamp":"2024-07-22T15:04:12Z","tags":["info","savedobjects-service"],"pid":53,"message":"Starting saved objects migrations"}
{"type":"log","@timestamp":"2024-07-22T15:04:12Z","tags":["info","savedobjects-service"],"pid":53,"message":"Detected mapping change in \"properties.augment-vis\""}
{"type":"log","@timestamp":"2024-07-22T15:04:12Z","tags":["info","savedobjects-service"],"pid":53,"message":"Creating index .kibana_5."}
{"type":"log","@timestamp":"2024-07-22T15:04:12Z","tags":["error","opensearch","data"],"pid":53,"message":"[resource_already_exists_exception]: index [.kibana_5/jEoJEoxRQYGC84n5PbL8uA] already exists"}
{"type":"log","@timestamp":"2024-07-22T15:04:12Z","tags":["warning","savedobjects-service"],"pid":53,"message":"Unable to connect to OpenSearch. Error: resource_already_exists_exception: [resource_already_exists_exception] Reason: index [.kibana_5/jEoJEoxRQYGC84n5PbL8uA] already exists"}
{"type":"log","@timestamp":"2024-07-22T15:04:12Z","tags":["warning","savedobjects-service"],"pid":53,"message":"Another OpenSearch Dashboards instance appears to be migrating the index. Waiting for that migration to complete. If no other OpenSearch Dashboards instance is attempting migrations, you can get past this message by deleting index .kibana_5 and restarting OpenSearchDashboards."}
{"type":"log","@timestamp":"2024-07-22T15:04:12Z","tags":["info","savedobjects-service"],"pid":53,"message":"Detected mapping change in \"properties.augment-vis\""}

It seems like its trying to create a different index on Wazuh indexer for its settings but failing? And why should it do it?

Regards,
Daniel D.
Message has been deleted

Delfina Lizarralde Bressan

unread,
Jul 22, 2024, 1:17:14 PM7/22/24
to Wazuh | Mailing List
Hi Daniel,
Sorry for the late response.


You can check the indexes with this command:

If you see that the index kibana_5 already exists, check the alias with this command and verify where it is pointing to:
curl -X GET "https://localhost:9200/_cat/aliases?pretty" -u user:pass -k
Check if kibana_5 has documents.

We want to check that the alias of kibana_5 is pointing to another kibana or not, then we need to check if kibana_5 has documents, in case it doesn't we can delete it, then restart wazuh-dashboard, and this will solve the problem, because wazuh-dashboard will recreate the Kibana_5, copy the objects from other kibana  and finally change the Alias to Kibana_5.

If you want to delete the index, run the following command:
curl -X DELETE -k -u <user>:<password> https://<wazuh-indexer-ip>:9200/.kibana_5

Then restart the wazuh dashboard:
systemctl restart wazuh-dashboard

Wait for few minutes and try to access the dashboard.

Let me know if this helps you.

Daniel D'Angeli

unread,
Jul 23, 2024, 10:33:36 AM7/23/24
to Wazuh | Mailing List
Hi,

it seems to have worked but now there is another issue. When i login it says Application not found in the /app/wazuh URI.

Any tips?

Regards,
Daniel D.

Screenshot 2024-07-23 163206.png

Delfina Lizarralde Bressan

unread,
Jul 23, 2024, 10:43:11 AM7/23/24
to Wazuh | Mailing List
The message Application Not Found when accessing the wazuh dashboard after upgrading might be that the configuration file /etc/wazuh-dashboard/opensearch_dashboards.yml wasn't overwritten with new changes.

To resolve this issue, update the uiSettings.overrides.default route setting with the /app/wz-home value in the configuration file /etc/wazuh-dashboard/opensearch_dashboards.yml :
uiSettings.overrides.defaultRoute: /app/wz-home

Restart the wazuh-dashboard using the command:
systemctl restart wazuh-dashboard

Refer to https://documentation.wazuh.com/current/upgrade-guide/troubleshooting.html

Delfina Lizarralde Bressan

unread,
Jul 23, 2024, 10:43:54 AM7/23/24
to Wazuh | Mailing List
If this does not work, please share the output of these commands:
# tail /etc/wazuh-dashboard/opensearch_dashboards.yml
# cat /var/ossec/logs/ossec.log | grep -i -E "error|warn"

Daniel D'Angeli

unread,
Jul 23, 2024, 10:53:56 AM7/23/24
to Wazuh | Mailing List
Now everything seems up and running, thank you very much!

Delfina Lizarralde Bressan

unread,
Jul 23, 2024, 11:08:06 AM7/23/24
to Wazuh | Mailing List
I'm glad to hear that. 
If you have any other questions, please ask on any of our channels.

Reply all
Reply to author
Forward
0 new messages