Failed to reload ruleset via Dashboard (ERR_BAD_REQUEST)

[Michał]

Hi,

I’m running Wazuh in Docker and recently encountered an issue with the Dashboard: the “Reload” function for rules stopped working.

Scenario:

I wrote a new custom rule, saved it, then tried to reload via the Dashboard.

I get the following error (both as my user and admin with full privileges):

Failed to reload ruleset:

"""

Failed to reload ruleset:

{"message":"API error: ERR_BAD_REQUEST - Permission denied: Resource type: *:*","name":"AxiosError","stack":"AxiosError: Request failed with status code 500\n at settle (https://10.168.25.19:10443/413008/bundles/plugin/wazuh/wazuh.plugin.js:15:28164)\n at XMLHttpRequest.onloadend (https://10.168.25.19:10443/413008/bundles/plugin/wazuh/wazuh.plugin.js:15:36909)\n at Axios_Axios.request (https://10.168.25.19:10443/413008/bundles/plugin/wazuh/wazuh.plugin.js:15:51113)\n at async request (https://10.168.25.19:10443/413008/bundles/plugin/wazuh/wazuh.plugin.js:1:168088)\n at async WzRequest.genericReq (https://10.168.25.19:10443/413008/bundles/plugin/wazuh/wazuh.plugin.js:1:497655)\n at async WzRequest.apiReq (https://10.168.25.19:10443/413008/bundles/plugin/wazuh/wazuh.plugin.js:1:499797)\n at async reloadRuleset (https://10.168.25.19:10443/413008/bundles/plugin/wazuh/wazuh.chunk.2.js:1:3749351)\n at async reload_cluster_manager_callout_WzReloadClusterManagerCallout.reloadCluster (https://10.168.25.19:10443/413008/bundles/plugin/wazuh/wazuh.chunk.2.js:1:4057069)","config":{"transitional":{"silentJSONParsing":true,"forcedJSONParsing":true,"clarifyTimeoutError":false},"adapter":["xhr","http","fetch"],"transformRequest":[null],"transformResponse":[null],"timeout":20000,"xsrfCookieName":"XSRF-TOKEN","xsrfHeaderName":"X-XSRF-TOKEN","maxContentLength":-1,"maxBodyLength":-1,"env":{},"headers":{"Accept":"application/json, text/plain, */*","Content-Type":"application/json","osd-xsrf":"kibana"},"method":"post","url":"/api/request","data":"{\"method\":\"PUT\",\"path\":\"/manager/analysisd/reload\",\"body\":{},\"id\":\"1513629884013\"}","cancelToken":{"promise":{},"_listeners":[]},"allowAbsoluteUrls":true},"code":"ERR_BAD_RESPONSE","status":500}

""""

Regenerating certificates

Rebuilding the Docker environment

Adjusting various Wazuh config files

The only recent change to the environment is upgrading the Fedora host from version 41 to 42.

Some LLMs suggest this might be a Dashboard/API permission issue, but I’m not sure what to do. Has anyone seen this behavior after upgrading the host or with containerized Wazuh?

Any guidance or debugging tips would be appreciated.

[Franco Giovanolli]

Hello Michal,

If you try adding the custom rule directly to the file and restart the manager, does the manager start normally? Do you see errors in the ossec.log?

To be sure, I ask you: have you modified the admin user's permissions in any way?

In order to reproduce your problem, could you please tell me the version of Wazuh you are using and the rule you wish to add?

Regards,
Franco