Wazuh Manager Installation Error

[Raa S]

Hi Team, 

We have created a test environment in Azure Cloud to test the Wazuh SIEM tool to collect and monitor the logs but we are getting the following error while installing Wazuh manager. 

Error Message: Preparing to unpack.../wazuh-manager 4.8.0-1 amd64.deb dpkg: error processing archive /var/cache/apt/archives/wazuh-manager 4.8.0-1 amd64.deb (--unpack): new wazuh-manager package pre-installation script subprocess returned error exit status 127 find: '/var/ossec/api/': No such file or directory dpkg: error while cleaning up: new wazuh-manager package post-removal script subprocess returned error exit status 1 Errors were encountered while processing: /var/cache/apt/archives/wazuh-manager 4.8.0-1 amd64.deb needrestart is being skipped since dpkg has failed E: Sub-process /usr/bin/dpkg returned an error code (1).

Could you please help us to resolve this issue?

Thanks,

Regards,

Rajendra.

[Cedrick Foko]

Hello Rajendra,

Apologies for the late reply.

The error you are getting while installing the wazuh-manager package indicates a problem with dpkg package installer. The problem may be due to a previous failed software installation.

While checking the screenshot provided, I could see that you ran apt-get -y install wazuh-manager but DPKG is trying to upgrade the package. This means the package has been installed previously and probably failed. 

You need to purge the previously installed package, then reconfigure DPKG database with sudo dpkg --configure -a command and try installing the package again.

You can find more information about this here: https://phoenixnap.com/kb/fix-sub-process-usr-bin-dpkg-returned-error-code-1

Regarding the error you get while trying to initialize the indexer cluster, the issue may be due to certificates not existing or incorrectly configured. Please make sure to generate the certificates as explained here and deploy them as explained here.

I hope this helps. Please let me know if you need any further assistance here.