Failed to reload ruleset via Dashboard (ERR_BAD_REQUEST)

[Michał]

Hi,

I’m running Wazuh in Docker and recently encountered an issue with the Dashboard: the “Reload” function for rules stopped working.

Scenario:

I wrote a new custom rule, saved it, then tried to reload via the Dashboard.

I get the following error (both as my user and admin with full privileges):

Failed to reload ruleset:

"""

Failed to reload ruleset:

{"message":"API error: ERR_BAD_REQUEST - Permission denied: Resource type: *:*","name":"AxiosError","stack":"AxiosError: Request failed with status code 500\n at settle (https://10.168.25.19:10443/413008/bundles/plugin/wazuh/wazuh.plugin.js:15:28164)\n at XMLHttpRequest.onloadend (https://10.168.25.19:10443/413008/bundles/plugin/wazuh/wazuh.plugin.js:15:36909)\n at Axios_Axios.request (https://10.168.25.19:10443/413008/bundles/plugin/wazuh/wazuh.plugin.js:15:51113)\n at async request (https://10.168.25.19:10443/413008/bundles/plugin/wazuh/wazuh.plugin.js:1:168088)\n at async WzRequest.genericReq (https://10.168.25.19:10443/413008/bundles/plugin/wazuh/wazuh.plugin.js:1:497655)\n at async WzRequest.apiReq (https://10.168.25.19:10443/413008/bundles/plugin/wazuh/wazuh.plugin.js:1:499797)\n at async reloadRuleset (https://10.168.25.19:10443/413008/bundles/plugin/wazuh/wazuh.chunk.2.js:1:3749351)\n at async reload_cluster_manager_callout_WzReloadClusterManagerCallout.reloadCluster (https://10.168.25.19:10443/413008/bundles/plugin/wazuh/wazuh.chunk.2.js:1:4057069)","config":{"transitional":{"silentJSONParsing":true,"forcedJSONParsing":true,"clarifyTimeoutError":false},"adapter":["xhr","http","fetch"],"transformRequest":[null],"transformResponse":[null],"timeout":20000,"xsrfCookieName":"XSRF-TOKEN","xsrfHeaderName":"X-XSRF-TOKEN","maxContentLength":-1,"maxBodyLength":-1,"env":{},"headers":{"Accept":"application/json, text/plain, */*","Content-Type":"application/json","osd-xsrf":"kibana"},"method":"post","url":"/api/request","data":"{\"method\":\"PUT\",\"path\":\"/manager/analysisd/reload\",\"body\":{},\"id\":\"1513629884013\"}","cancelToken":{"promise":{},"_listeners":[]},"allowAbsoluteUrls":true},"code":"ERR_BAD_RESPONSE","status":500}

""""

Regenerating certificates

Rebuilding the Docker environment

Adjusting various Wazuh config files

The only recent change to the environment is upgrading the Fedora host from version 41 to 42.

Some LLMs suggest this might be a Dashboard/API permission issue, but I’m not sure what to do. Has anyone seen this behavior after upgrading the host or with containerized Wazuh?

Any guidance or debugging tips would be appreciated.

[Franco Giovanolli]

Hello Michal,

If you try adding the custom rule directly to the file and restart the manager, does the manager start normally? Do you see errors in the ossec.log?

To be sure, I ask you: have you modified the admin user's permissions in any way?

In order to reproduce your problem, could you please tell me the version of Wazuh you are using and the rule you wish to add?

Regards,
Franco

[Michał]

Hi Franco, thank you for your response.

This issue occurred on our testing instance of Wazuh, and we eventually decided to shut it down and rebuild the environment from scratch. That resolved the problem, although we still don’t know the exact root cause.

For your information:
– I didn’t try adding the custom rule directly to the file — only through the Dashboard.
– I did not modify the admin user permissions in any way.
– The Wazuh version was 4.13, but the issue started right after upgrading the Fedora host from version 41 to 42. All Wazuh components were running on that Fedora system.

Since the new environment works correctly, we probably won’t be able to determine the original cause. You can close the case.

Thanks for your support.