Wazuh Internal Error

[Tuaans Anh]

Hi,

I updated my wazuh to 4.8.0 last week, and I have a problem with server APIs connections like image blelow

I have setup my proxy to connect to Internet, but it still error.

I also checked my vulnerability detection and It still working fine

Can you help me for this?

Thanks all

[Md. Nazmur Sakib]

Hi Tuaans Anh,

Can you attach the image in the attachment? It is image is not visible in the mail. 

If you are getting this error: [API connection] No API available to connect.

When restarting the manager, the Wazuh API will wait until the Wazuh manager's modules are ready and the Wazuh Dashboard needs the Wazuh API to retrieve the status of the system as well as allowing you to modify the configuration from the web interface.

You may temporarily receive the error you're seeing under normal circumstances after a restart and retrying may resolve it.

Also, you can try this workaround.

At the end of this configuration file

/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml

hosts:

  - default:

      url: https://localhost

      port: 55000

      username: wazuh-wui

Try changing the
url: https://localhost

to

url: https://127.0.0.1

And restart the manager.

systemctl restart wazuh-manager

If you need further assistance on this please share the error screenshot in the attachment.

Let me know the update on the issue.

[Tuaans Anh]

Hi Sakib,

Sorry about error of image, I sent image again.

I changed localhost to 127.0.0.1, but it still not work

When I changed to my server IP (10.x.x.x), I got another error: Timeout executing API request

[Md. Nazmur Sakib]

This URL contains the IP address of the Wazuh manager. Typically it is an all-in-one deployment. Depleyeded by the assistance or following quickstart it is the localhost.

      url: https://<WAZUH_SERVER_IP_ADDRESS>

If it is a distributed deployment the ip is the Wazuh manager's ip.

I was wondering why the host section is empty in your screenshot.

What was the initial configuration on the IP?

Recheck the API configuration from /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml

Restart the Wazuh dashboard

Run this command from your dashboard server and chcek if you can make API request

curl -k -X GET "https://<IP_address>:55000/agents" -H "Authorization: Bearer $(curl -u wazuh-wui:<password> -k -X GET 'https://<IP_address>:55000/security/user/authenticate?raw=true')"

Use the IP, username, and password same as the wazuh.yml file

After restarting the Dashboard Clear your browser cache and cookies and try to access the server again.

Looking forward to your update on the issue.

[Tuaans Anh]

Hi  Sakib,

I just delete the IP, because it is business IP. You can understand that my wazuh server is 192.168.24.123 and I changed localhost to 192.168.24.123

I just run this curl command like your above. The result is "message": "All selected agents information was returned", "error": 0

[Tuaans Anh]

When I check App log message, I got somethings below

Jun 24, 2024 @ 09:19:46 ERROR connect ECONNREFUSED 127.0.0.1:55000 

Jun 24, 2024 @ 09:19:49 ERROR connect ECONNREFUSED 127.0.0.1:55000 

Jun 24, 2024 @ 09:19:52 ERROR connect ECONNREFUSED 127.0.0.1:55000 

Jun 24, 2024 @ 09:19:55 ERROR connect ECONNREFUSED 127.0.0.1:55000 

Jun 24, 2024 @ 09:19:58 ERROR {"dapi_errors":{"node01":{"error":"Some Wazuh daemons are not ready yet in node \"node01\" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)"}},"detail":"Some Wazuh daemons are not ready yet in node \"node01\" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)","error":1017,"title":"Bad Request"} 

Jun 26, 2024 @ 11:40:53 INFO Wazuh dashboard index: .kibana 

Jun 26, 2024 @ 11:40:53 INFO App revision: 12 

Jun 26, 2024 @ 11:40:53 INFO Total RAM: 40075MB 

Jun 26, 2024 @ 11:40:53 INFO Wazuh app revision or version changed, regenerating wazuh-registry.json. 

Jun 26, 2024 @ 11:40:53 INFO Migrated the registry file. 

Jun 26, 2024 @ 14:00:22 ERROR {"dapi_errors":{"node01":{"error":"Error in wazuhdb request: Cannot execute Global database query; near \")\": syntax error"}},"detail":"Error in wazuhdb request: Cannot execute Global database query; near \")\": syntax error","error":2003,"remediation":"Make sure the request is correct","title":"Bad Request"} 

Jun 26, 2024 @ 14:01:29 ERROR {"dapi_errors":{"node01":{"error":"Error in wazuhdb request: Cannot execute Global database query; near \")\": syntax error"}},"detail":"Error in wazuhdb request: Cannot execute Global database query; near \")\": syntax error","error":2003,"remediation":"Make sure the request is correct","title":"Bad Request"} 

Jun 26, 2024 @ 14:15:48 ERROR {"dapi_errors":{"node01":{"error":"Some Wazuh daemons are not ready yet in node \"node01\" (wazuh-modulesd->stopped, wazuh-analysisd->stopped, wazuh-execd->stopped, wazuh-db->stopped, wazuh-remoted->stopped)"}},"detail":"Some Wazuh daemons are not ready yet in node \"node01\" (wazuh-modulesd->stopped, wazuh-analysisd->stopped, wazuh-execd->stopped, wazuh-db->stopped, wazuh-remoted->stopped)","error":1017,"title":"Bad Request"} 

Jun 26, 2024 @ 14:15:48 ERROR Request failed with status code 400 

Jun 26, 2024 @ 14:15:48 ERROR Request failed with status code 400 

Jun 26, 2024 @ 14:54:57 ERROR {"dapi_errors":{"node01":{"error":"Some Wazuh daemons are not ready yet in node \"node01\" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)"}},"detail":"Some Wazuh daemons are not ready yet in node \"node01\" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)","error":1017,"title":"Bad Request"}