Cluster Not Online

[Seetha Ram B]

Dear Team,

Could you please help me with the below.

[root@wz01 etc]# /var/ossec/bin/cluster_control -l
ERROR: Cluster is not running.

[root@wz02 ~]# /var/ossec/bin/cluster_control -l
ERROR: Error 3023 - Worker node is not connected to master

/var/ossec/etc/ossec.conf on Wazuh Master

<cluster>
    <name>wazuh-prod-cluster</name>
    <node_name>wz01</node_name>
    <node_type>master</node_type>
    <key>4126b51facc67525c2824724fdb69355</key>
    <port>1516</port>
    <bind_addr>0.0.0.0</bind_addr>
    <nodes>
        <node>wz01</node>
    </nodes>
    <hidden>no</hidden>
    <disabled>yes</disabled>
  </cluster>

/var/ossec/etc/ossec.conf on Wazuh worker




<cluster>
    <name>wazuh-prod-cluster</name>
    <node_name>wz02</node_name>
    <node_type>worker</node_type>
    <key>4126b51facc67525c2824724fdb69355</key>
    <port>1516</port>
    <bind_addr>0.0.0.0</bind_addr>
    <nodes>
        <node>wz01</node>
    </nodes>
    <hidden>no</hidden>
    <disabled>no</disabled>
</cluster>


Regards,
Seetha

[Santiago David Vendramini]

Hi! Thanks for using wazuh!

Based on your master configuration you should change <disabled>yes</disabled> to <disabled>no</disabled>
Then on both nodes you need to specify master IP addres or DNS  (https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/cluster.html#cluster-nodes)

    <nodes>
        <node>MASTER-ADDRESS</node>
    </nodes>

Also you can check our documentation about cluster configuration :
https://documentation.wazuh.com/current/user-manual/configuring-cluster/index.html

I hope this solves your need.
Let me know if you need anything else!
Regards.