Rebooted Wazuh server, now dashboard won't load

[Jamie Navarro]

Hello,

Super new to Wazuh here. Awesome product btw!

Anyway, I set up a test Wazuh server to play around with. It's in an Oracle VirtualBox virtual machine if that matters. The virtual machine has 4GB RAM, 2 CPUs, running on Ubuntu Desktop v22.04.

It's been working great for several days, but when I rebooted it this morning, I can't get the GUI / dashboard back up. When I go to the IP address in a web browser, I just get:

Wazuh dashboard server is not ready yet

If I do a: sudo systemctl status wazuh-dashboard

I get the following output:

● wazuh-dashboard.service - wazuh-dashboard
     Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)
     Active: active (running) since Tue 2023-02-14 05:25:09 PST; 2min 38s ago
   Main PID: 625 (node)
      Tasks: 11 (limit: 4611)
     Memory: 209.6M
        CPU: 20.457s
     CGroup: /system.slice/wazuh-dashboard.service
             └─625 /usr/share/wazuh-dashboard/bin/../node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/bin/../src/cli/dist -c /etc/wazuh-dashboard/opensearch_dashboards.yml

Feb 14 05:27:24 ubuntusrvwazuhtest1 opensearch-dashboards[625]: {"type":"log","@timestamp":"2023-02-14T13:27:24Z","tags":["error","opensearch","data"],"pid":625,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Feb 14 05:27:26 ubuntusrvwazuhtest1 opensearch-dashboards[625]: {"type":"log","@timestamp":"2023-02-14T13:27:26Z","tags":["error","opensearch","data"],"pid":625,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Feb 14 05:27:29 ubuntusrvwazuhtest1 opensearch-dashboards[625]: {"type":"log","@timestamp":"2023-02-14T13:27:29Z","tags":["error","opensearch","data"],"pid":625,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Feb 14 05:27:31 ubuntusrvwazuhtest1 opensearch-dashboards[625]: {"type":"log","@timestamp":"2023-02-14T13:27:31Z","tags":["error","opensearch","data"],"pid":625,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Feb 14 05:27:34 ubuntusrvwazuhtest1 opensearch-dashboards[625]: {"type":"log","@timestamp":"2023-02-14T13:27:34Z","tags":["error","opensearch","data"],"pid":625,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Feb 14 05:27:36 ubuntusrvwazuhtest1 opensearch-dashboards[625]: {"type":"log","@timestamp":"2023-02-14T13:27:36Z","tags":["error","opensearch","data"],"pid":625,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Feb 14 05:27:39 ubuntusrvwazuhtest1 opensearch-dashboards[625]: {"type":"log","@timestamp":"2023-02-14T13:27:39Z","tags":["error","opensearch","data"],"pid":625,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Feb 14 05:27:41 ubuntusrvwazuhtest1 opensearch-dashboards[625]: {"type":"log","@timestamp":"2023-02-14T13:27:41Z","tags":["error","opensearch","data"],"pid":625,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Feb 14 05:27:44 ubuntusrvwazuhtest1 opensearch-dashboards[625]: {"type":"log","@timestamp":"2023-02-14T13:27:44Z","tags":["error","opensearch","data"],"pid":625,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Feb 14 05:27:46 ubuntusrvwazuhtest1 opensearch-dashboards[625]: {"type":"log","@timestamp":"2023-02-14T13:27:46Z","tags":["error","opensearch","data"],"pid":625,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}

I tried: sudo systemctl restart wazuh-dashboard, but that didn't change anything. I have no idea what else to do/check as I mentioned, I'm super new to Wazuh.

Thank you,

Jamie

[Abdullah Al Rafi Fahim]

Hello Jamie,

The message "Wazuh dashboard server is not ready yet" usually appears when you just started or restarted wazuh dashboard. However, it can also be produced for one of the following reasons:

• Your service or dashboard configuration has some error that causes it to constantly reboot.
• Your wazuh indexer service is not up or has some error.
• Host resources are insufficient. We recommend that at least to host the wazuh indexer and wazuh dashboard service, you should dedicate 4 GB of RAM and 2 CPU cores.

You may check the status of the wazuh-indexer and wazuh-dashboard services. Also check if the hardware resources are sufficient

Wazuh Dashboard

- Check the status service:

systemctl status wazuh-dashboard -l

- Check the kibana logs

journalctl -u wazuh-dashboard | egrep -i "error"

cat /var/log/messages |grep -i "wazuh-dashboard"

Wazuh Indexer

- Check the status service:

systemctl status wazuh-indexer -l  

- Check the wazuh-indexer logs

egrep -i "error" /var/log/wazuh-indexer/wazuh-cluster.log

 

Note: replace wazuh-cluster.log if your wazuh-indexer cluster name is something different.

Please check if everything is OK. In case you still need help, you can share the output of all the above commands.