error start wazuh-agent linux

Jericko Ludo

unread,

Jun 30, 2021, 1:34:42 AM6/30/21

to Wazuh mailing list

j'ai cette erreur sur mon agent linux pouvez vous m'aider s'il vous plait .

job for wazuh-agent.service failed because the control process exited with error code. see "systemctl status wazuh-agent.service" and "jounalctl -xe" for details.

Jericko Ludo

unread,

Jun 30, 2021, 1:45:47 AM6/30/21

to Wazuh mailing list

waz.PNG

Jonathan Martín Valera

unread,

Jun 30, 2021, 3:31:18 AM6/30/21

to Wazuh mailing list

Hi,

For some reason, the wazuh-agent has not been able to start. Perhaps this is due to a configuration error.

To see the possible reason, I recommend that you run the following:

systemctl status wazuh-agent

And also take a look at the /var/ossec/logs/ossec.log to see what might be going on.

cat /var/ossec/logs/ossec.log

Or directly, try filtering for errors or warnings in ossec.log.

egrep -i "ERROR|WARNING" `/var/ossec/logs/ossec.log`

If you can’t find the reason and need help, share the content of the /var/ossec/logs/ossec.log file (removing sensitive information).

Regards.

Jericko Ludo

unread,

Jun 30, 2021, 7:38:46 AM6/30/21

to Wazuh mailing list

voilà les erreur dans l'ossec.log

Jonathan Martín Valera

unread,

Jun 30, 2021, 8:46:44 AM6/30/21

to Wazuh mailing list

Hi,

As shown in the error description, you have to enter the IP address of the wazuh-manager in the wazuh-agent /var/ossec/etc/ossec.conf file.

You have to replace the MANAGER_IP value of <address> tag by your wazuh-manager IP:

    <server>
      <address>MANAGER_IP</address>
      <port>1514</port>
      <protocol>tcp</protocol>
    </server>

and then restart the wazuh-agent:

systemctl restart wazuh-agent

It will start the automatic registration process (in case the agent was not previously connected to the
manager) and after a few seconds, the wazuh-agent will connect to the wazuh-manager.