Wazuh dashboard does not connect to Wazuh API after upgrade to 4.12 : Error: 3099 - ERROR3099
156 views
Skip to first unread message
Ranjith kk
Jun 13, 2025, 2:38:24 AM6/13/25
to Wazuh | Mailing List
Hello Team,
After upgrading Wazuh to 4.12, Wazuh dahsboard does not connect to API. It shows the error : 3099 - ERROR3099 - Some Wazuh daemons are not ready yet in node "node01" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting).
I see the same error in api.log as well. Meanwhile wazuh-control status shows all required services to be running
Wazuh-control status
root@elasticsearch:/var/ossec/logs# sudo /var/ossec/bin/wazuh-control status
wazuh-clusterd not running...
wazuh-modulesd is running...
wazuh-monitord is running...
wazuh-logcollector is running...
wazuh-remoted is running...
wazuh-syscheckd is running...
wazuh-analysisd is running...
wazuh-maild not running...
wazuh-execd is running...
wazuh-db is running...
wazuh-authd is running...
wazuh-agentlessd not running...
wazuh-integratord not running...
wazuh-dbd not running...
wazuh-csyslogd not running...
wazuh-apid is running...
api.log:
2025/06/12 14:25:00 ERROR: Some Wazuh daemons are not ready yet in node "node01" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)
2025/06/12 14:25:00 ERROR: Some Wazuh daemons are not ready yet in node "node01" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)
2025/06/12 14:25:00 INFO: wazuh-wui 127.0.0.1 "POST /security/user/authenticate" with parameters {} and body {} done in 0.025s: 500
2025/06/12 14:25:00 INFO: wazuh-wui 127.0.0.1 "POST /security/user/authenticate" with parameters {} and body {} done in 0.025s: 500
2025/06/12 14:27:08 ERROR: Some Wazuh daemons are not ready yet in node "node01" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)
2025/06/12 14:27:08 INFO: wazuh-wui 127.0.0.1 "POST /security/user/authenticate" with parameters {} and body {} done in 0.007s: 500
2025/06/12 14:28:27 ERROR: Some Wazuh daemons are not ready yet in node "node01" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)
2025/06/12 14:28:27 INFO: wazuh-wui 127.0.0.1 "POST /security/user/authenticate" with parameters {} and body {} done in 0.007s: 500
2025/06/12 14:30:00 ERROR: Some Wazuh daemons are not ready yet in node "node01" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)
2025/06/12 14:30:00 ERROR: Some Wazuh daemons are not ready yet in node "node01" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)
2025/06/12 14:30:00 ERROR: Some Wazuh daemons are not ready yet in node "node01" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)
2025/06/12 14:30:00 INFO: wazuh-wui 127.0.0.1 "POST /security/user/authenticate" with parameters {} and body {} done in 0.049s: 500
2025/06/12 14:30:00 INFO: wazuh-wui 127.0.0.1 "POST /security/user/authenticate" with parameters {} and body {} done in 0.049s: 500
root@elasticsearch:/var/ossec/logs# systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
Loaded: loaded (/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2025-06-12 14:21:09 UTC; 9min ago
Process: 177875 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=0/SUCCESS)
Tasks: 296 (limit: 38402)
Memory: 1.3G
CGroup: /system.slice/wazuh-manager.service
├─177959 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─177961 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─177962 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─177965 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─177968 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─178009 /var/ossec/bin/wazuh-authd
├─178025 /var/ossec/bin/wazuh-db
├─178050 /var/ossec/bin/wazuh-execd
├─178068 /var/ossec/bin/wazuh-analysisd
├─178081 /var/ossec/bin/wazuh-syscheckd
├─178259 /var/ossec/bin/wazuh-remoted
├─178260 /var/ossec/bin/wazuh-remoted
├─178294 /var/ossec/bin/wazuh-logcollector
├─178303 /var/ossec/bin/wazuh-monitord
└─178315 /var/ossec/bin/wazuh-modulesd
Jun 12 14:21:05 elasticsearch env[178313]: 2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
Jun 12 14:21:05 elasticsearch env[178313]: 2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
Jun 12 14:21:05 elasticsearch env[178313]: 2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
Jun 12 14:21:05 elasticsearch env[178313]: 2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
Jun 12 14:21:05 elasticsearch env[178313]: 2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
Jun 12 14:21:05 elasticsearch env[178313]: 2025/06/12 14:21:05 wazuh-modulesd:router: INFO: Loaded router module.
Jun 12 14:21:05 elasticsearch env[178313]: 2025/06/12 14:21:05 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
Jun 12 14:21:07 elasticsearch env[177875]: Started wazuh-modulesd...
Jun 12 14:21:09 elasticsearch env[177875]: Completed.
Jun 12 14:21:09 elasticsearch systemd[1]: Started Wazuh manager.
root@elasticsearch:/var/ossec/logs# systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2025-06-12 14:07:27 UTC; 23min ago
Main PID: 175949 (node)
Tasks: 11 (limit: 38402)
Memory: 259.5M
CGroup: /system.slice/wazuh-dashboard.service
└─175949 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist
Jun 12 14:30:32 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:30:32Z","tags":[],"pid":175949,"os":{"load":[19.4,21.75,21.65],"mem":{"total":33657593856,"free":20518318080},"uptime>
Jun 12 14:30:37 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:30:37Z","tags":[],"pid":175949,"os":{"load":[18.41,21.5,21.57],"mem":{"total":33657593856,"free":20531687424},"uptime>
Jun 12 14:30:42 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:30:42Z","tags":[],"pid":175949,"os":{"load":[17.82,21.33,21.52],"mem":{"total":33657593856,"free":20521512960},"uptim>
Jun 12 14:30:47 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:30:47Z","tags":[],"pid":175949,"os":{"load":[17.59,21.22,21.48],"mem":{"total":33657593856,"free":20527792128},"uptim>
Jun 12 14:30:52 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:30:52Z","tags":[],"pid":175949,"os":{"load":[17.86,21.22,21.48],"mem":{"total":33657593856,"free":20528865280},"uptim>
Jun 12 14:30:57 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:30:57Z","tags":[],"pid":175949,"os":{"load":[17.07,21,21.41],"mem":{"total":33657593856,"free":20531716096},"uptime":>
Jun 12 14:31:02 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:31:02Z","tags":[],"pid":175949,"os":{"load":[17.07,20.93,21.38],"mem":{"total":33657593856,"free":20533059584},"uptim>
Jun 12 14:31:07 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:31:07Z","tags":[],"pid":175949,"os":{"load":[16.34,20.72,21.31],"mem":{"total":33657593856,"free":20533518336},"uptim>
Jun 12 14:31:12 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:31:12Z","tags":[],"pid":175949,"os":{"load":[18.88,21.17,21.45],"mem":{"total":33657593856,"free":20528558080},"uptim>
Jun 12 14:31:17 elasticsearch opensearch-dashboards[175949]:
ossec.log:
2025/06/12 14:21:02 wazuh-syscheckd: INFO: (6207): Ignore 'file' sregex '.log$|.swp$'
2025/06/12 14:21:02 wazuh-syscheckd: INFO: (6004): No diff for file: '/etc/ssl/private.key'
2025/06/12 14:21:02 rootcheck: INFO: Starting rootcheck scan.
2025/06/12 14:21:02 wazuh-syscheckd: INFO: (6000): Starting daemon...
2025/06/12 14:21:02 wazuh-syscheckd: INFO: (6010): File integrity monitoring scan frequency: 43200 seconds
2025/06/12 14:21:02 wazuh-syscheckd: INFO: (6008): File integrity monitoring scan started.
2025/06/12 14:21:02 wazuh-analysisd: INFO: (7200): Logtest started
2025/06/12 14:21:02 wazuh-analysisd: INFO: EPS limit disabled
2025/06/12 14:21:03 wazuh-remoted: INFO: Remote syslog allowed from: '192.168.0.0/16'
2025/06/12 14:21:03 wazuh-remoted: INFO: Remote syslog allowed from: '10.0.0.0/8'
2025/06/12 14:21:03 wazuh-remoted: INFO: Started (pid: 178259). Listening on port 1514/TCP (secure).
2025/06/12 14:21:03 wazuh-remoted: INFO: Remote syslog allowed from: '172.0.0.0/8'
2025/06/12 14:21:03 wazuh-remoted: INFO: Started (pid: 178260). Listening on port 514/UDP (syslog).
2025/06/12 14:21:03 wazuh-remoted: INFO: (1410): Reading authentication keys file.
2025/06/12 14:21:04 wazuh-monitord: INFO: Started (pid: 178303).
2025/06/12 14:21:05 wazuh-modulesd: WARNING: The 'vulnerability-detector' configuration is deprecated, please update your settings to use the new 'vulnerability-detection' instead (default values will be used based on your previous configurations). See https://documentation.wazuh.com
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'min_full_scan_interval'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'run_on_start'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd:router: INFO: Loaded router module.
2025/06/12 14:21:05 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
2025/06/12 14:21:05 wazuh-modulesd: INFO: Started (pid: 178315).
2025/06/12 14:21:05 wazuh-modulesd:osquery: INFO: Module disabled. Exiting...
2025/06/12 14:21:05 sca: INFO: Module started.
2025/06/12 14:21:05 sca: INFO: Loaded policy '/var/ossec/ruleset/sca/cis_ubuntu20-04.yml'
2025/06/12 14:21:05 wazuh-modulesd:vulnerability-scanner: INFO: Starting vulnerability_scanner module.
2025/06/12 14:21:05 sca: INFO: Starting Security Configuration Assessment scan.
2025/06/12 14:21:05 wazuh-modulesd:router: INFO: Starting router module.
2025/06/12 14:21:05 wazuh-modulesd:content_manager: INFO: Starting content_manager module.
2025/06/12 14:21:05 wazuh-modulesd:download: INFO: Module started.
2025/06/12 14:21:05 wazuh-modulesd:control: INFO: Starting control thread.
2025/06/12 14:21:05 wazuh-modulesd:database: INFO: Module started.
2025/06/12 14:21:05 wazuh-modulesd:agent-upgrade: INFO: (8153): Module Agent Upgrade started.
2025/06/12 14:21:05 wazuh-modulesd:task-manager: INFO: (8200): Module Task Manager started.
2025/06/12 14:21:05 wazuh-modulesd:ciscat: INFO: Module disabled. Exiting...
2025/06/12 14:21:06 wazuh-modulesd:syscollector: INFO: Module started.
2025/06/12 14:21:06 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2025/06/12 14:21:06 sca: INFO: Starting evaluation of policy: '/var/ossec/ruleset/sca/cis_ubuntu20-04.yml'
2025/06/12 14:21:06 indexer-connector: WARNING: No username and password found in the keystore, using default values.
2025/06/12 14:21:06 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-vulnerabilities-elasticsearch', retrying until the connection is successful.
2025/06/12 14:21:06 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2025/06/12 14:21:07 wazuh-logcollector: INFO: Monitoring output of command(360): df -P
2025/06/12 14:21:07 wazuh-logcollector: INFO: Monitoring full output of command(360): netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d
2025/06/12 14:21:07 wazuh-logcollector: INFO: Monitoring full output of command(360): last -n 20
2025/06/12 14:21:07 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/ossec/logs/active-responses.log'.
2025/06/12 14:21:07 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/auth.log'.
2025/06/12 14:21:08 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/syslog'.
2025/06/12 14:21:08 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/dpkg.log'.
2025/06/12 14:21:08 wazuh-modulesd:vulnerability-scanner: INFO: Vulnerability scanner module started.
2025/06/12 14:21:10 wazuh-syscheckd: INFO: (6009): File integrity monitoring scan ended.
2025/06/12 14:21:10 wazuh-syscheckd: INFO: FIM sync module started.
2025/06/12 14:21:11 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/kern.log'.
2025/06/12 14:21:11 wazuh-logcollector: INFO: Started (pid: 178294).
2025/06/12 14:21:20 sca: INFO: Evaluation finished for policy '/var/ossec/ruleset/sca/cis_ubuntu20-04.yml'
2025/06/12 14:21:20 sca: INFO: Security Configuration Assessment scan finished. Duration: 15 seconds.
2025/06/12 14:23:44 rootcheck: INFO: Ending rootcheck scan.
root@elasticsearch:/var/ossec/logs# cat /var/ossec/logs/ossec.log | grep -i -E "error|warn"
2025/06/12 04:15:05 wazuh-analysisd: WARNING: Input queue is full.
2025/06/12 13:44:56 indexer-connector: WARNING: Failed to sync agent '009' with the indexer.
2025/06/12 13:44:56 indexer-connector: WARNING: Failed to sync agent '017' with the indexer.
2025/06/12 13:44:56 indexer-connector: WARNING: Failed to sync agent '014' with the indexer.
2025/06/12 13:44:56 indexer-connector: WARNING: Failed to sync agent '011' with the indexer.
2025/06/12 13:44:56 indexer-connector: WARNING: Failed to sync agent '005' with the indexer.
2025/06/12 13:44:56 indexer-connector: WARNING: Failed to sync agent '007' with the indexer.
2025/06/12 13:44:56 indexer-connector: WARNING: Failed to sync agent '018' with the indexer.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: The 'vulnerability-detector' configuration is deprecated, please update your settings to use the new 'vulnerability-detection' instead (default values will be used based on your previous configurations). See https://documentation.wazuh.com
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'min_full_scan_interval'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'run_on_start'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: The 'vulnerability-detector' configuration is deprecated, please update your settings to use the new 'vulnerability-detection' instead (default values will be used based on your previous configurations). See https://documentation.wazuh.com
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'min_full_scan_interval'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'run_on_start'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:22 indexer-connector: WARNING: No username and password found in the keystore, using default values.
2025/06/12 13:45:22 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-vulnerabilities-elasticsearch', retrying until the connection is successful.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: The 'vulnerability-detector' configuration is deprecated, please update your settings to use the new 'vulnerability-detection' instead (default values will be used based on your previous configurations). See https://documentation.wazuh.com
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'min_full_scan_interval'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'run_on_start'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: The 'vulnerability-detector' configuration is deprecated, please update your settings to use the new 'vulnerability-detection' instead (default values will be used based on your previous configurations). See https://documentation.wazuh.com
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'min_full_scan_interval'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'run_on_start'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 indexer-connector: WARNING: No username and password found in the keystore, using default values.
2025/06/12 14:07:14 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-vulnerabilities-elasticsearch', retrying until the connection is successful.
2025/06/12 14:20:47 indexer-connector: WARNING: Failed to sync agent '007' with the indexer.
2025/06/12 14:20:47 indexer-connector: WARNING: Failed to sync agent '011' with the indexer.
2025/06/12 14:20:47 indexer-connector: WARNING: Failed to sync agent '009' with the indexer.
2025/06/12 14:20:47 indexer-connector: WARNING: Failed to sync agent '018' with the indexer.
2025/06/12 14:20:47 indexer-connector: WARNING: Failed to sync agent '005' with the indexer.
2025/06/12 14:20:47 indexer-connector: WARNING: Failed to sync agent '017' with the indexer.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: The 'vulnerability-detector' configuration is deprecated, please update your settings to use the new 'vulnerability-detection' instead (default values will be used based on your previous configurations). See https://documentation.wazuh.com
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'min_full_scan_interval'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'run_on_start'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: The 'vulnerability-detector' configuration is deprecated, please update your settings to use the new 'vulnerability-detection' instead (default values will be used based on your previous configurations). See https://documentation.wazuh.com
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'min_full_scan_interval'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'run_on_start'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:06 indexer-connector: WARNING: No username and password found in the keystore, using default values.
2025/06/12 14:21:06 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-vulnerabilities-elasticsearch', retrying until the connection is successful.
After upgrading Wazuh to 4.12, Wazuh dahsboard does not connect to API. It shows the error : 3099 - ERROR3099 - Some Wazuh daemons are not ready yet in node "node01" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting).
I see the same error in api.log as well. Meanwhile wazuh-control status shows all required services to be running
Wazuh-control status
root@elasticsearch:/var/ossec/logs# sudo /var/ossec/bin/wazuh-control status
wazuh-clusterd not running...
wazuh-modulesd is running...
wazuh-monitord is running...
wazuh-logcollector is running...
wazuh-remoted is running...
wazuh-syscheckd is running...
wazuh-analysisd is running...
wazuh-maild not running...
wazuh-execd is running...
wazuh-db is running...
wazuh-authd is running...
wazuh-agentlessd not running...
wazuh-integratord not running...
wazuh-dbd not running...
wazuh-csyslogd not running...
wazuh-apid is running...
api.log:
2025/06/12 14:25:00 ERROR: Some Wazuh daemons are not ready yet in node "node01" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)
2025/06/12 14:25:00 ERROR: Some Wazuh daemons are not ready yet in node "node01" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)
2025/06/12 14:25:00 INFO: wazuh-wui 127.0.0.1 "POST /security/user/authenticate" with parameters {} and body {} done in 0.025s: 500
2025/06/12 14:25:00 INFO: wazuh-wui 127.0.0.1 "POST /security/user/authenticate" with parameters {} and body {} done in 0.025s: 500
2025/06/12 14:27:08 ERROR: Some Wazuh daemons are not ready yet in node "node01" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)
2025/06/12 14:27:08 INFO: wazuh-wui 127.0.0.1 "POST /security/user/authenticate" with parameters {} and body {} done in 0.007s: 500
2025/06/12 14:28:27 ERROR: Some Wazuh daemons are not ready yet in node "node01" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)
2025/06/12 14:28:27 INFO: wazuh-wui 127.0.0.1 "POST /security/user/authenticate" with parameters {} and body {} done in 0.007s: 500
2025/06/12 14:30:00 ERROR: Some Wazuh daemons are not ready yet in node "node01" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)
2025/06/12 14:30:00 ERROR: Some Wazuh daemons are not ready yet in node "node01" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)
2025/06/12 14:30:00 ERROR: Some Wazuh daemons are not ready yet in node "node01" (wazuh-modulesd->restarting, wazuh-analysisd->restarting, wazuh-execd->restarting, wazuh-db->restarting, wazuh-remoted->restarting)
2025/06/12 14:30:00 INFO: wazuh-wui 127.0.0.1 "POST /security/user/authenticate" with parameters {} and body {} done in 0.049s: 500
2025/06/12 14:30:00 INFO: wazuh-wui 127.0.0.1 "POST /security/user/authenticate" with parameters {} and body {} done in 0.049s: 500
root@elasticsearch:/var/ossec/logs# systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
Loaded: loaded (/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2025-06-12 14:21:09 UTC; 9min ago
Process: 177875 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=0/SUCCESS)
Tasks: 296 (limit: 38402)
Memory: 1.3G
CGroup: /system.slice/wazuh-manager.service
├─177959 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─177961 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─177962 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─177965 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─177968 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─178009 /var/ossec/bin/wazuh-authd
├─178025 /var/ossec/bin/wazuh-db
├─178050 /var/ossec/bin/wazuh-execd
├─178068 /var/ossec/bin/wazuh-analysisd
├─178081 /var/ossec/bin/wazuh-syscheckd
├─178259 /var/ossec/bin/wazuh-remoted
├─178260 /var/ossec/bin/wazuh-remoted
├─178294 /var/ossec/bin/wazuh-logcollector
├─178303 /var/ossec/bin/wazuh-monitord
└─178315 /var/ossec/bin/wazuh-modulesd
Jun 12 14:21:05 elasticsearch env[178313]: 2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
Jun 12 14:21:05 elasticsearch env[178313]: 2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
Jun 12 14:21:05 elasticsearch env[178313]: 2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
Jun 12 14:21:05 elasticsearch env[178313]: 2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
Jun 12 14:21:05 elasticsearch env[178313]: 2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
Jun 12 14:21:05 elasticsearch env[178313]: 2025/06/12 14:21:05 wazuh-modulesd:router: INFO: Loaded router module.
Jun 12 14:21:05 elasticsearch env[178313]: 2025/06/12 14:21:05 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
Jun 12 14:21:07 elasticsearch env[177875]: Started wazuh-modulesd...
Jun 12 14:21:09 elasticsearch env[177875]: Completed.
Jun 12 14:21:09 elasticsearch systemd[1]: Started Wazuh manager.
root@elasticsearch:/var/ossec/logs# systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2025-06-12 14:07:27 UTC; 23min ago
Main PID: 175949 (node)
Tasks: 11 (limit: 38402)
Memory: 259.5M
CGroup: /system.slice/wazuh-dashboard.service
└─175949 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist
Jun 12 14:30:32 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:30:32Z","tags":[],"pid":175949,"os":{"load":[19.4,21.75,21.65],"mem":{"total":33657593856,"free":20518318080},"uptime>
Jun 12 14:30:37 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:30:37Z","tags":[],"pid":175949,"os":{"load":[18.41,21.5,21.57],"mem":{"total":33657593856,"free":20531687424},"uptime>
Jun 12 14:30:42 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:30:42Z","tags":[],"pid":175949,"os":{"load":[17.82,21.33,21.52],"mem":{"total":33657593856,"free":20521512960},"uptim>
Jun 12 14:30:47 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:30:47Z","tags":[],"pid":175949,"os":{"load":[17.59,21.22,21.48],"mem":{"total":33657593856,"free":20527792128},"uptim>
Jun 12 14:30:52 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:30:52Z","tags":[],"pid":175949,"os":{"load":[17.86,21.22,21.48],"mem":{"total":33657593856,"free":20528865280},"uptim>
Jun 12 14:30:57 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:30:57Z","tags":[],"pid":175949,"os":{"load":[17.07,21,21.41],"mem":{"total":33657593856,"free":20531716096},"uptime":>
Jun 12 14:31:02 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:31:02Z","tags":[],"pid":175949,"os":{"load":[17.07,20.93,21.38],"mem":{"total":33657593856,"free":20533059584},"uptim>
Jun 12 14:31:07 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:31:07Z","tags":[],"pid":175949,"os":{"load":[16.34,20.72,21.31],"mem":{"total":33657593856,"free":20533518336},"uptim>
Jun 12 14:31:12 elasticsearch opensearch-dashboards[175949]: {"type":"ops","@timestamp":"2025-06-12T14:31:12Z","tags":[],"pid":175949,"os":{"load":[18.88,21.17,21.45],"mem":{"total":33657593856,"free":20528558080},"uptim>
Jun 12 14:31:17 elasticsearch opensearch-dashboards[175949]:
ossec.log:
2025/06/12 14:21:02 wazuh-syscheckd: INFO: (6207): Ignore 'file' sregex '.log$|.swp$'
2025/06/12 14:21:02 wazuh-syscheckd: INFO: (6004): No diff for file: '/etc/ssl/private.key'
2025/06/12 14:21:02 rootcheck: INFO: Starting rootcheck scan.
2025/06/12 14:21:02 wazuh-syscheckd: INFO: (6000): Starting daemon...
2025/06/12 14:21:02 wazuh-syscheckd: INFO: (6010): File integrity monitoring scan frequency: 43200 seconds
2025/06/12 14:21:02 wazuh-syscheckd: INFO: (6008): File integrity monitoring scan started.
2025/06/12 14:21:02 wazuh-analysisd: INFO: (7200): Logtest started
2025/06/12 14:21:02 wazuh-analysisd: INFO: EPS limit disabled
2025/06/12 14:21:03 wazuh-remoted: INFO: Remote syslog allowed from: '192.168.0.0/16'
2025/06/12 14:21:03 wazuh-remoted: INFO: Remote syslog allowed from: '10.0.0.0/8'
2025/06/12 14:21:03 wazuh-remoted: INFO: Started (pid: 178259). Listening on port 1514/TCP (secure).
2025/06/12 14:21:03 wazuh-remoted: INFO: Remote syslog allowed from: '172.0.0.0/8'
2025/06/12 14:21:03 wazuh-remoted: INFO: Started (pid: 178260). Listening on port 514/UDP (syslog).
2025/06/12 14:21:03 wazuh-remoted: INFO: (1410): Reading authentication keys file.
2025/06/12 14:21:04 wazuh-monitord: INFO: Started (pid: 178303).
2025/06/12 14:21:05 wazuh-modulesd: WARNING: The 'vulnerability-detector' configuration is deprecated, please update your settings to use the new 'vulnerability-detection' instead (default values will be used based on your previous configurations). See https://documentation.wazuh.com
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'min_full_scan_interval'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'run_on_start'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd:router: INFO: Loaded router module.
2025/06/12 14:21:05 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
2025/06/12 14:21:05 wazuh-modulesd: INFO: Started (pid: 178315).
2025/06/12 14:21:05 wazuh-modulesd:osquery: INFO: Module disabled. Exiting...
2025/06/12 14:21:05 sca: INFO: Module started.
2025/06/12 14:21:05 sca: INFO: Loaded policy '/var/ossec/ruleset/sca/cis_ubuntu20-04.yml'
2025/06/12 14:21:05 wazuh-modulesd:vulnerability-scanner: INFO: Starting vulnerability_scanner module.
2025/06/12 14:21:05 sca: INFO: Starting Security Configuration Assessment scan.
2025/06/12 14:21:05 wazuh-modulesd:router: INFO: Starting router module.
2025/06/12 14:21:05 wazuh-modulesd:content_manager: INFO: Starting content_manager module.
2025/06/12 14:21:05 wazuh-modulesd:download: INFO: Module started.
2025/06/12 14:21:05 wazuh-modulesd:control: INFO: Starting control thread.
2025/06/12 14:21:05 wazuh-modulesd:database: INFO: Module started.
2025/06/12 14:21:05 wazuh-modulesd:agent-upgrade: INFO: (8153): Module Agent Upgrade started.
2025/06/12 14:21:05 wazuh-modulesd:task-manager: INFO: (8200): Module Task Manager started.
2025/06/12 14:21:05 wazuh-modulesd:ciscat: INFO: Module disabled. Exiting...
2025/06/12 14:21:06 wazuh-modulesd:syscollector: INFO: Module started.
2025/06/12 14:21:06 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2025/06/12 14:21:06 sca: INFO: Starting evaluation of policy: '/var/ossec/ruleset/sca/cis_ubuntu20-04.yml'
2025/06/12 14:21:06 indexer-connector: WARNING: No username and password found in the keystore, using default values.
2025/06/12 14:21:06 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-vulnerabilities-elasticsearch', retrying until the connection is successful.
2025/06/12 14:21:06 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2025/06/12 14:21:07 wazuh-logcollector: INFO: Monitoring output of command(360): df -P
2025/06/12 14:21:07 wazuh-logcollector: INFO: Monitoring full output of command(360): netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d
2025/06/12 14:21:07 wazuh-logcollector: INFO: Monitoring full output of command(360): last -n 20
2025/06/12 14:21:07 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/ossec/logs/active-responses.log'.
2025/06/12 14:21:07 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/auth.log'.
2025/06/12 14:21:08 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/syslog'.
2025/06/12 14:21:08 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/dpkg.log'.
2025/06/12 14:21:08 wazuh-modulesd:vulnerability-scanner: INFO: Vulnerability scanner module started.
2025/06/12 14:21:10 wazuh-syscheckd: INFO: (6009): File integrity monitoring scan ended.
2025/06/12 14:21:10 wazuh-syscheckd: INFO: FIM sync module started.
2025/06/12 14:21:11 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/kern.log'.
2025/06/12 14:21:11 wazuh-logcollector: INFO: Started (pid: 178294).
2025/06/12 14:21:20 sca: INFO: Evaluation finished for policy '/var/ossec/ruleset/sca/cis_ubuntu20-04.yml'
2025/06/12 14:21:20 sca: INFO: Security Configuration Assessment scan finished. Duration: 15 seconds.
2025/06/12 14:23:44 rootcheck: INFO: Ending rootcheck scan.
root@elasticsearch:/var/ossec/logs# cat /var/ossec/logs/ossec.log | grep -i -E "error|warn"
2025/06/12 04:15:05 wazuh-analysisd: WARNING: Input queue is full.
2025/06/12 13:44:56 indexer-connector: WARNING: Failed to sync agent '009' with the indexer.
2025/06/12 13:44:56 indexer-connector: WARNING: Failed to sync agent '017' with the indexer.
2025/06/12 13:44:56 indexer-connector: WARNING: Failed to sync agent '014' with the indexer.
2025/06/12 13:44:56 indexer-connector: WARNING: Failed to sync agent '011' with the indexer.
2025/06/12 13:44:56 indexer-connector: WARNING: Failed to sync agent '005' with the indexer.
2025/06/12 13:44:56 indexer-connector: WARNING: Failed to sync agent '007' with the indexer.
2025/06/12 13:44:56 indexer-connector: WARNING: Failed to sync agent '018' with the indexer.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: The 'vulnerability-detector' configuration is deprecated, please update your settings to use the new 'vulnerability-detection' instead (default values will be used based on your previous configurations). See https://documentation.wazuh.com
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'min_full_scan_interval'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'run_on_start'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:11 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: The 'vulnerability-detector' configuration is deprecated, please update your settings to use the new 'vulnerability-detection' instead (default values will be used based on your previous configurations). See https://documentation.wazuh.com
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'min_full_scan_interval'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'run_on_start'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:21 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 13:45:22 indexer-connector: WARNING: No username and password found in the keystore, using default values.
2025/06/12 13:45:22 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-vulnerabilities-elasticsearch', retrying until the connection is successful.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: The 'vulnerability-detector' configuration is deprecated, please update your settings to use the new 'vulnerability-detection' instead (default values will be used based on your previous configurations). See https://documentation.wazuh.com
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'min_full_scan_interval'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'run_on_start'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:01 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: The 'vulnerability-detector' configuration is deprecated, please update your settings to use the new 'vulnerability-detection' instead (default values will be used based on your previous configurations). See https://documentation.wazuh.com
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'min_full_scan_interval'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'run_on_start'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:07:14 indexer-connector: WARNING: No username and password found in the keystore, using default values.
2025/06/12 14:07:14 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-vulnerabilities-elasticsearch', retrying until the connection is successful.
2025/06/12 14:20:47 indexer-connector: WARNING: Failed to sync agent '007' with the indexer.
2025/06/12 14:20:47 indexer-connector: WARNING: Failed to sync agent '011' with the indexer.
2025/06/12 14:20:47 indexer-connector: WARNING: Failed to sync agent '009' with the indexer.
2025/06/12 14:20:47 indexer-connector: WARNING: Failed to sync agent '018' with the indexer.
2025/06/12 14:20:47 indexer-connector: WARNING: Failed to sync agent '005' with the indexer.
2025/06/12 14:20:47 indexer-connector: WARNING: Failed to sync agent '017' with the indexer.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: The 'vulnerability-detector' configuration is deprecated, please update your settings to use the new 'vulnerability-detection' instead (default values will be used based on your previous configurations). See https://documentation.wazuh.com
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'min_full_scan_interval'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'run_on_start'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:20:54 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: The 'vulnerability-detector' configuration is deprecated, please update your settings to use the new 'vulnerability-detection' instead (default values will be used based on your previous configurations). See https://documentation.wazuh.com
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'min_full_scan_interval'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'run_on_start'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:05 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2025/06/12 14:21:06 indexer-connector: WARNING: No username and password found in the keystore, using default values.
2025/06/12 14:21:06 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-vulnerabilities-elasticsearch', retrying until the connection is successful.
Stuti Gupta
Jun 13, 2025, 3:21:53 AM6/13/25
to Wazuh | Mailing List
Hi
Ranjith
You are facing this issue because of the (1230): Invalid element in the configuration: 'provider'. Error. Form 4.8 the vulnerability detection configuration has changes, which means you need to remove the vulnerability-detector and provider configuration. Please make sure you have replaced the old configuration with the new one:
Edit the /var/ossec/etc/ossec.conf file to include the new <vulnerability-detection> block. Remove the old <vulnerability-detector> block if it exists. Please remove the old configuration, that is:
<vulnerability-detector>
<enabled>yes</enabled>
<interval>5m</interval>
<min_full_scan_interval>6h</min_full_scan_interval>
<run_on_start>yes</run_on_start>
<!-- Ubuntu OS vulnerabilities -->
<provider name="canonical">
<enabled>yes</enabled>
.....
<update_interval>1h</update_interval>
</provider>
</vulnerability-detector>
The new configuration should look like this (add if not present):
<vulnerability-detection>
<enabled>yes</enabled>
<index-status>yes</index-status>
<feed-update-interval>60m</feed-update-interval>
</vulnerability-detection>
<indexer>
<enabled>yes</enabled>
<hosts>
<host>https://0.0.0.0:9200</host>
</hosts>
<ssl>
<certificate_authorities>
<ca>/etc/filebeat/certs/root-ca.pem</ca>
</certificate_authorities>
<certificate>/etc/filebeat/certs/filebeat.pem</certificate>
<key>/etc/filebeat/certs/filebeat-key.pem</key>
</ssl>
</indexer>
Replace 0.0.0.0 with the IP address or hostname of your Wazuh indexer node. You can find this value in the Filebeat configuration file at /etc/filebeat/filebeat.yml.
output.elasticsearch.hosts:
- 127.0.0.1:9200
Ensure that the <certificate> and <key> names match the files located in /etc/filebeat/certs/. Check the certs name using the command:
ll /etc/filebeat/certs
Save the Wazuh indexer username and password into the Wazuh manager keystore using the Wazuh-keystore tool:
/var/ossec/bin/wazuh-keystore -f indexer -k username -v <INDEXER_USERNAME>
/var/ossec/bin/wazuh-keystore -f indexer -k password -v <INDEXER_PASSWORD>
By default, the username is admin, and the password is the same as you use to log in to the wazuh interface
Then make sure to restart the wazuh-manager: systemctl restart wazuh-manager
This should resolve the issue. In case if you still face the issue then please share the
/var/ossec/etc/ossec.conf
/var/ossec/etc/ossec.log
/var/ossec/etc/ossec.log
Refer to :
https://documentation.wazuh.com/current/upgrade-guide/troubleshooting.html#the-vulnerability-detector-configuration-is-deprecated
https://documentation.wazuh.com/current/upgrade-guide/upgrading-central-components.html#configuring-vulnerability-detection
You are facing this issue because of the (1230): Invalid element in the configuration: 'provider'. Error. Form 4.8 the vulnerability detection configuration has changes, which means you need to remove the vulnerability-detector and provider configuration. Please make sure you have replaced the old configuration with the new one:
Edit the /var/ossec/etc/ossec.conf file to include the new <vulnerability-detection> block. Remove the old <vulnerability-detector> block if it exists. Please remove the old configuration, that is:
<vulnerability-detector>
<enabled>yes</enabled>
<interval>5m</interval>
<min_full_scan_interval>6h</min_full_scan_interval>
<run_on_start>yes</run_on_start>
<!-- Ubuntu OS vulnerabilities -->
<provider name="canonical">
<enabled>yes</enabled>
.....
<update_interval>1h</update_interval>
</provider>
</vulnerability-detector>
The new configuration should look like this (add if not present):
<vulnerability-detection>
<enabled>yes</enabled>
<index-status>yes</index-status>
<feed-update-interval>60m</feed-update-interval>
</vulnerability-detection>
<indexer>
<enabled>yes</enabled>
<hosts>
<host>https://0.0.0.0:9200</host>
</hosts>
<ssl>
<certificate_authorities>
<ca>/etc/filebeat/certs/root-ca.pem</ca>
</certificate_authorities>
<certificate>/etc/filebeat/certs/filebeat.pem</certificate>
<key>/etc/filebeat/certs/filebeat-key.pem</key>
</ssl>
</indexer>
Replace 0.0.0.0 with the IP address or hostname of your Wazuh indexer node. You can find this value in the Filebeat configuration file at /etc/filebeat/filebeat.yml.
output.elasticsearch.hosts:
- 127.0.0.1:9200
Ensure that the <certificate> and <key> names match the files located in /etc/filebeat/certs/. Check the certs name using the command:
ll /etc/filebeat/certs
Save the Wazuh indexer username and password into the Wazuh manager keystore using the Wazuh-keystore tool:
/var/ossec/bin/wazuh-keystore -f indexer -k username -v <INDEXER_USERNAME>
/var/ossec/bin/wazuh-keystore -f indexer -k password -v <INDEXER_PASSWORD>
By default, the username is admin, and the password is the same as you use to log in to the wazuh interface
Then make sure to restart the wazuh-manager: systemctl restart wazuh-manager
This should resolve the issue. In case if you still face the issue then please share the
/var/ossec/etc/ossec.conf
/var/ossec/etc/ossec.log
/var/ossec/etc/ossec.log
Refer to :
https://documentation.wazuh.com/current/upgrade-guide/troubleshooting.html#the-vulnerability-detector-configuration-is-deprecated
https://documentation.wazuh.com/current/upgrade-guide/upgrading-central-components.html#configuring-vulnerability-detection
Reply all
Reply to author
Forward
0 new messages