Plugin issue

202 views
Skip to first unread message

Jagatheesh Mani

unread,
Mar 5, 2024, 7:36:01 AM3/5/24
to Wazuh | Mailing List
Hi Team,

I'm facing the below mentioned issue, Can anyone please help me to fix the same.


FYI, I'm new to wazuh

Regards,
Jagatheesh M

Jagatheesh Mani

unread,
Mar 5, 2024, 7:36:01 AM3/5/24
to Wazuh | Mailing List
Hi Team,

Im facing the below mentioned issue. Can anyone pls help me to fix the same,


FYI, Im new to wazuh

Regards, Jagatheesh M

Roman Luna

unread,
Mar 5, 2024, 7:57:24 AM3/5/24
to Wazuh | Mailing List
Hi,

Could you provide more information on how you have got this error? As the error itself seems to be related to importing a dashboard. Also, what version of Wazuh are you running?

Thanks.

John Soliani

unread,
Mar 5, 2024, 7:58:38 AM3/5/24
to Wazuh | Mailing List
Hello Jagatheesh,

  I'm afraid I won't be able to help you with that information only.
  Could you elaborate further when the issue occurs? Which components are you using? When has the issue started? 

Regards,
John.-

Jagatheesh Mani

unread,
Mar 5, 2024, 10:12:41 AM3/5/24
to Wazuh | Mailing List
Hi,

Im facing this issue for the last 8 hours, It was working fine until then. I have not made any changes to the server. 

Wazuh version: 4.7.3

Kindly let me know what are all the logs I should attach for further troubleshooting

Thanks & Regards,
Jagatheesh M

Jagatheesh Mani

unread,
Mar 5, 2024, 10:16:38 AM3/5/24
to Wazuh | Mailing List
FYI, I'm getting below-mentioned error message also.

circuit_breaking_exception [parent] Data too large, data for [<reduce_aggs>] would be [1025842176/978.3mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1025842176/978.3mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=9171/8.9kb, in_flight_requests=3000/2.9kb] Error: Too Many Requests at Fetch._callee3$ (https://172.16.200.10/47302/bundles/core/core.entry.js:15:585158) at tryCatch (https://172.16.200.10/47302/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:786910) at Generator.invoke [as _invoke] (https://172.16.200.10/47302/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:790926) at Generator.next (https://172.16.200.10/47302/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:788105) at fetch_asyncGeneratorStep (https://172.16.200.10/47302/bundles/core/core.entry.js:15:578070) at _next (https://172.16.200.10/47302/bundles/core/core.entry.js:15:578386)

John Soliani

unread,
Mar 11, 2024, 8:54:28 AM3/11/24
to Wazuh | Mailing List

Hello Jagatheesh,

Thank you for the details.
This error starts when you run out of resources, specifically, RAM for Indexer/s. It means you don’t have enough RAM available to handle the database, you need to increase the heap memory for JAVA on all the indexer nodes. Elastic recommends having up to 50% of the physical RAM assigned to the heap memory, so, if you have 16 GB of RAM on those systems, edit the /etc/wazuh-indexer/jvm.options file and change the -Xms and -Xmx values to these:

  • -Xms8G
  • -Xmx8G

If you are already using 50% of the physical RAM for JAVA, you will need to add more RAM to the indexers or add another node to the cluster.

Then refresh the service and restart it:

  • systemctl daemon-reload
  • systemctl restart wazuh-indexer

This should solve the issue.

​
Reply all
Reply to author
Forward
0 new messages