i am trying to upgrade the docker deployment of multi node Wazuh from 4.7.4 to 4.8.1 and this is what i have done so far:
- Replaced "vulnerability-detector" with the new "
vulnerability-detection
":
<vulnerability-detection>
<enabled>yes</enabled>
<index-status>yes</index-status>
<feed-update-interval>60m</feed-update-interval>
</vulnerability-detection>
Every service seems to work fine apart from the Wazuh master container, which keeps restarting and outputs the following error:
2024-07-22T14:03:43.579Z INFO eslegclient/connection.go:99 elasticsearch url:
https://wazuh1.indexer:92002024-07-22T14:03:43.580Z INFO [publisher] pipeline/module.go:113 Beat name: wazuh.master
2024-07-22T14:03:43.582Z INFO beater/filebeat.go:117 Enabled modules/filesets: wazuh (alerts, archives), ()
2024-07-22T14:03:43.583Z INFO instance/beat.go:455 filebeat start running.
2024-07-22T14:03:43.583Z INFO [monitoring] log/log.go:118 Starting metrics logging every 30s
2024-07-22T14:03:43.584Z INFO memlog/store.go:119 Loading data file of '/var/lib/filebeat/registry/filebeat' succeeded. Active transaction id=22039148
runtime/cgo: pthread_create failed: Operation not permitted
SIGABRT: abort
PC=0x7f0e1e58553c m=8 sigcode=18446744073709551610
goroutine 0 [idle]:
runtime: unknown pc 0x7f0e1e58553c
stack: frame={sp:0x7f0ddfffe7a0, fp:0x0} stack=[0x7f0ddf7ff1e8,0x7f0ddfffede8)
00007f0ddfffe6a0: 0000000000000000 0000000000000000
00007f0ddfffe6b0: 0000000000000000 0000000000000000
00007f0ddfffe6c0: 0000000000000000 0000000000000000
00007f0ddfffe6d0: 0000000000000000 0000000000000000
00007f0ddfffe6e0: 0000000000000000 0000000000000000
00007f0ddfffe6f0: 0000000000000000 0000000000000000
00007f0ddfffe700: 0000000000000000 0000000000000000
00007f0ddfffe710: 0000000000000000 0000000000000000
00007f0ddfffe720: 0000000000000000 0000000000000000
00007f0ddfffe730: 0000000000000000 0000000000000000
00007f0ddfffe740: 0000000000000000 0000000000000000
00007f0ddfffe750: 0000000000000000 0000000000000000
00007f0ddfffe760: 0000000000000000 0000000000000000
00007f0ddfffe770: 0000000000000000 0000000000000000
00007f0ddfffe780: 0000000000000000 00007f0e1e592bb9
00007f0ddfffe790: 0000000000000000 00007f0e1e58552e
00007f0ddfffe7a0: <0000000000000130 0000000000000000
00007f0ddfffe7b0: 0000000000000120 0000000000000000
00007f0ddfffe7c0: 0000000000000013 0000000000000000
00007f0ddfffe7d0: 0000000000000000 0000000000000004
00007f0ddfffe7e0: 0000003400000013 00007f0e1e6332a1
00007f0ddfffe7f0: 00007f0ddf7fe640 00007f0ddfffeab0
00007f0ddfffe800: 00007f0ddfffe92e 00007f0ddfffe92f
00007f0ddfffe810: 00007f0ddf7fe640 00007f0e1e583425
00007f0ddfffe820: 00007f0dd4000020 1a293d270b805a00
00007f0ddfffe830: 00007f0ddffff640 0000000000000006
00007f0ddfffe840: 00007f0de0000c90 0000000000000000
00007f0ddfffe850: 0000000002cf0118 00007f0e1e538d26
00007f0ddfffe860: 00007f0e1e6dee70 00007f0e1e50c7f3
00007f0ddfffe870: 0000000000000020 0000000000000000
00007f0ddfffe880: 0000000000000000 00007f0e1e6229a4
00007f0ddfffe890: 00007f0ddeffe000 000000000000000d
runtime: unknown pc 0x7f0e1e58553c
stack: frame={sp:0x7f0ddfffe7a0, fp:0x0} stack=[0x7f0ddf7ff1e8,0x7f0ddfffede8)
00007f0ddfffe6a0: 0000000000000000 0000000000000000
00007f0ddfffe6b0: 0000000000000000 0000000000000000
00007f0ddfffe6c0: 0000000000000000 0000000000000000
00007f0ddfffe6d0: 0000000000000000 0000000000000000
00007f0ddfffe6e0: 0000000000000000 0000000000000000
00007f0ddfffe6f0: 0000000000000000 0000000000000000
00007f0ddfffe700: 0000000000000000 0000000000000000
00007f0ddfffe710: 0000000000000000 0000000000000000
00007f0ddfffe720: 0000000000000000 0000000000000000
00007f0ddfffe730: 0000000000000000 0000000000000000
00007f0ddfffe740: 0000000000000000 0000000000000000
00007f0ddfffe750: 0000000000000000 0000000000000000
00007f0ddfffe760: 0000000000000000 0000000000000000
00007f0ddfffe770: 0000000000000000 0000000000000000
00007f0ddfffe780: 0000000000000000 00007f0e1e592bb9
00007f0ddfffe790: 0000000000000000 00007f0e1e58552e
00007f0ddfffe7a0: <0000000000000130 0000000000000000
00007f0ddfffe7b0: 0000000000000120 0000000000000000
00007f0ddfffe7c0: 0000000000000013 0000000000000000
00007f0ddfffe7d0: 0000000000000000 0000000000000004
00007f0ddfffe7e0: 0000003400000013 00007f0e1e6332a1
00007f0ddfffe7f0: 00007f0ddf7fe640 00007f0ddfffeab0
00007f0ddfffe800: 00007f0ddfffe92e 00007f0ddfffe92f
00007f0ddfffe810: 00007f0ddf7fe640 00007f0e1e583425
00007f0ddfffe820: 00007f0dd4000020 1a293d270b805a00
00007f0ddfffe830: 00007f0ddffff640 0000000000000006
00007f0ddfffe840: 00007f0de0000c90 0000000000000000
00007f0ddfffe850: 0000000002cf0118 00007f0e1e538d26
00007f0ddfffe860: 00007f0e1e6dee70 00007f0e1e50c7f3
00007f0ddfffe870: 0000000000000020 0000000000000000
00007f0ddfffe880: 0000000000000000 00007f0e1e6229a4
00007f0ddfffe890: 00007f0ddeffe000 000000000000000d
goroutine 1 [runnable]:
syscall.Syscall(0x0, 0x7, 0xc00078f30e, 0x4f2, 0x4f2, 0x4f2, 0x0)
/usr/local/go/src/syscall/asm_linux_amd64.s:18 +0x5
syscall.read(0x7, 0xc00078f30e, 0x4f2, 0x4f2, 0x0, 0xc0004df6e0, 0xc00063e620)
/usr/local/go/src/syscall/zsyscall_linux_amd64.go:686 +0x5a
syscall.Read(...)
/usr/local/go/src/syscall/syscall_unix.go:189
internal/poll.(*FD).Read(0xc0004ea5a0, 0xc00078f30e, 0x4f2, 0x4f2, 0x0, 0x0, 0x0)
/usr/local/go/src/internal/poll/fd_unix.go:165 +0x133
os.(*File).read(...)
/usr/local/go/src/os/file_unix.go:263
os.(*File).Read(0xc000010a00, 0xc00078f30e, 0x4f2, 0x4f2, 0x2cef4c9, 0x0, 0xc00063e6a0)
/usr/local/go/src/os/file.go:116 +0x71
encoding/json.(*Decoder).refill(0xc0004df600, 0xc00083fa37, 0x0)
/usr/local/go/src/encoding/json/stream.go:165 +0xeb
encoding/json.(*Decoder).readValue(0xc0004df600, 0x0, 0x0, 0x27c56c0)
/usr/local/go/src/encoding/json/stream.go:140 +0x1e8
encoding/json.(*Decoder).Decode(0xc0004df600, 0x270e900, 0xc00083fa00, 0x0, 0x0)
/usr/local/go/src/encoding/json/stream.go:63 +0x79
github.com/elastic/beats/v7/libbeat/statestore/backend/memlog.readLogFile(0xc00078b3e0, 0x23, 0xc00063e818, 0x0, 0x0)
/go/src/
github.com/elastic/beats/libbeat/statestore/backend/memlog/diskstore.go:617 +0x248
github.com/elastic/beats/v7/libbeat/statestore/backend/memlog.loadLogFile(0xc00063e908, 0x1504b81, 0xc00078b3e0, 0x23, 0x2, 0x115, 0x0, 0xc00063e8b0)
/go/src/
github.com/elastic/beats/libbeat/statestore/backend/memlog/diskstore.go:565 +0x89
github.com/elastic/beats/v7/libbeat/statestore/backend/memlog.openStore(0xc00044c740, 0xc00078b3e0, 0x23, 0xc000000180, 0x1000, 0x203000, 0x2aedc50, 0xc0001dd1a0, 0x203000, 0x203000)
/go/src/
github.com/elastic/beats/libbeat/statestore/backend/memlog/store.go:123 +0x59d
github.com/elastic/beats/v7/libbeat/statestore/backend/memlog.(*Registry).Access(0xc0004ea1e0, 0x29fa2ec, 0x8, 0x0, 0x0, 0x0, 0x0)
/go/src/
github.com/elastic/beats/libbeat/statestore/backend/memlog/memlog.go:116 +0x1eb
github.com/elastic/beats/v7/libbeat/statestore.(*Registry).Get(0xc0007a0060, 0x29fa2ec, 0x8, 0x0, 0x0, 0x0)
/go/src/
github.com/elastic/beats/libbeat/statestore/registry.go:64 +0x1c9
github.com/elastic/beats/v7/filebeat/beater.(*filebeatStore).Access(0xc0004e9220, 0xc0004ea1e0, 0x0, 0x0)
/go/src/
github.com/elastic/beats/filebeat/beater/store.go:58 +0x40
github.com/elastic/beats/v7/filebeat/registrar.New(0x2d28000, 0xc0004e9220, 0x2d28040, 0xc000010998, 0x0, 0x6, 0xc000124370, 0xc)
/go/src/
github.com/elastic/beats/filebeat/registrar/registrar.go:77 +0x35
github.com/elastic/beats/v7/filebeat/beater.(*Filebeat).Run(0xc000793dd0, 0xc0000ce2c0, 0x0, 0x0)
/go/src/
github.com/elastic/beats/filebeat/beater/filebeat.go:349 +0x600
github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).launch(0xc0000ce2c0, 0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, ...)
/go/src/
github.com/elastic/beats/libbeat/cmd/instance/beat.go:461 +0x7d8
github.com/elastic/beats/v7/libbeat/cmd/instance.Run.func1(0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0xc00063fc30, 0xc000112900, 0x0, 0x0)
/go/src/
github.com/elastic/beats/libbeat/cmd/instance/beat.go:189 +0x55a
github.com/elastic/beats/v7/libbeat/cmd/instance.Run(0x29fa2ec, 0x8, 0x29fa2ec, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, ...)
/go/src/
github.com/elastic/beats/libbeat/cmd/instance/beat.go:190 +0x148
github.com/elastic/beats/v7/libbeat/cmd.genRunCmd.func1(0xc0000cedc0, 0xc0001871e0, 0x0, 0xb)
/go/src/
github.com/elastic/beats/libbeat/cmd/run.go:36 +0x9d
github.com/spf13/cobra.(*Command).execute(0xc0000cedc0, 0xc00004e0d0, 0xb, 0xb, 0xc0000cedc0, 0xc00004e0d0)
/go/pkg/mod/
github.com/spf13/co...@v0.0.5/command.go:830 +0x29d
github.com/spf13/cobra.(*Command).ExecuteC(0xc0000cedc0, 0xc0000cedc0, 0xffffffff, 0xc00009e058)
/go/pkg/mod/
github.com/spf13/co...@v0.0.5/command.go:914 +0x2fb
github.com/spf13/cobra.(*Command).Execute(...)
/go/pkg/mod/
github.com/spf13/co...@v0.0.5/command.go:864main.main()
/go/src/
github.com/elastic/beats/filebeat/main.go:36 +0x3d
goroutine 12 [chan receive]:
k8s.io/klog.(*loggingT).flushDaemon(0x4241ce0) /go/pkg/mod/
k8s.io/kl...@v1.0.0/klog.go:1010 +0x8b
created by
k8s.io/klog.init.0 /go/pkg/mod/
k8s.io/kl...@v1.0.0/klog.go:411 +0xd6
goroutine 43 [select]:
github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*bufferingEventLoop).run(0xc00012c3c0) /go/src/
github.com/elastic/beats/libbeat/publisher/queue/memqueue/eventloop.go:316 +0x1cf
github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue.func1(0xc0004535e0, 0x2d3ed60, 0xc00012c3c0)
/go/src/
github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:171 +0x5f
created by
github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue /go/src/
github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:169 +0x373
goroutine 44 [select]:
github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*ackLoop).run(0xc00011d810) /go/src/
github.com/elastic/beats/libbeat/publisher/queue/memqueue/ackloop.go:60 +0x107
github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue.func2(0xc0004535e0, 0xc00011d810)
/go/src/
github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:175 +0x59
created by
github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.NewQueue /go/src/
github.com/elastic/beats/libbeat/publisher/queue/memqueue/broker.go:173 +0x3a2
goroutine 45 [select]:
github.com/elastic/beats/v7/libbeat/publisher/queue/memqueue.(*consumer).Get(0xc000337300, 0x32, 0x0, 0x0, 0x0, 0x0)
/go/src/
github.com/elastic/beats/libbeat/publisher/queue/memqueue/consume.go:65 +0xe9
github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*eventConsumer).loop(0xc0000ae360, 0x2d3eda0, 0xc000337300)
/go/src/
github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:182 +0x19a
github.com/elastic/beats/v7/libbeat/publisher/pipeline.newEventConsumer.func1(0xc0000ae360, 0x2d3eda0, 0xc0003372e0)
/go/src/
github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:86 +0x6c
created by
github.com/elastic/beats/v7/libbeat/publisher/pipeline.newEventConsumer /go/src/
github.com/elastic/beats/libbeat/publisher/pipeline/consumer.go:84 +0x149
goroutine 46 [select]:
github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*retryer).loop(0xc0000ae480) /go/src/
github.com/elastic/beats/libbeat/publisher/pipeline/retry.go:135 +0x250
created by
github.com/elastic/beats/v7/libbeat/publisher/pipeline.newRetryer /go/src/
github.com/elastic/beats/libbeat/publisher/pipeline/retry.go:94 +0x158
goroutine 47 [select]:
github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run(0xc0000ae660) /go/src/
github.com/elastic/beats/libbeat/publisher/pipeline/output.go:127 +0xd1
created by
github.com/elastic/beats/v7/libbeat/publisher/pipeline.makeClientWorker /go/src/
github.com/elastic/beats/libbeat/publisher/pipeline/output.go:79 +0x194
goroutine 88 [select]:
github.com/elastic/beats/v7/libbeat/monitoring/report/log.(*reporter).snapshotLoop(0xc000793e00) /go/src/
github.com/elastic/beats/libbeat/monitoring/report/log/log.go:129 +0x3cb
github.com/elastic/beats/v7/libbeat/monitoring/report/log.MakeReporter.func1(0xc000793e00) /go/src/
github.com/elastic/beats/libbeat/monitoring/report/log/log.go:107 +0x50
created by
github.com/elastic/beats/v7/libbeat/monitoring/report/log.MakeReporter /go/src/
github.com/elastic/beats/libbeat/monitoring/report/log/log.go:105 +0x157
goroutine 89 [syscall]:
os/signal.signal_recv(0x0)
/usr/local/go/src/runtime/sigqueue.go:147 +0x9c
os/signal.loop()
/usr/local/go/src/os/signal/signal_unix.go:23 +0x22
created by os/signal.Notify.func1
/usr/local/go/src/os/signal/signal.go:127 +0x44
goroutine 91 [chan receive]:
github.com/elastic/beats/v7/libbeat/service.HandleSignals.func1(0xc000135f20, 0xc00044c420, 0xc00044c410, 0xc000057ee0, 0xc0004e9140)
/go/src/
github.com/elastic/beats/libbeat/service/service.go:50 +0x52
created by
github.com/elastic/beats/v7/libbeat/service.HandleSignals /go/src/
github.com/elastic/beats/libbeat/service/service.go:49 +0x172
rax 0x0
rbx 0x7f0ddffff640
rcx 0x7f0e1e58553c
rdx 0x6
rdi 0x509
rsi 0x51c
rbp 0x51c
rsp 0x7f0ddfffe7a0
r8 0x7f0ddfffe870
r9 0x7f0e1e5bbe40
r10 0x8
r11 0x246
r12 0x6
r13 0x0
r14 0x2cf0118
r15 0x0
rip 0x7f0e1e58553c
rflags 0x246
cs 0x33
fs 0x0
gs 0x0
Filebeat exited. code=2
Daniel D.