After the update to 4.9.0 there are constant cluster errors

[Dmitry Mikheev]

After the update there are constant cluster errors and red indexes

# grep -iE "error|crit|fatal|warn" /var/log/wazuh-indexer/wazuh-cluster.log 

[2024-09-10T06:37:25,259][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2024-09-10T06:37:30,261][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2024-09-10T06:37:35,261][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])

The error occurs every 5 minutes!

Where is this cache set?

/etc/wazuh-indexer/opensearch-performance-analyzer/performance-analyzer.properties - not found

[Infosec homelab]

I have the same error, can't find any solution for it.

[Gonzalo Membrillo Solbes]

Hello,

This is a known problem that happens when upgrading to Opensearch version 2.13, which is what the indexer uses on 4.9.0:

https://github.com/opensearch-project/performance-analyzer/issues/644

To solve this, you will need to disable the performance analyzer plugin that comes built into Opensearch.
https://opensearch.org/docs/2.13/monitoring-your-cluster/pa/index/#disable-performance-analyzer

Regards,

Gonzalo

[Tismofied]

The proposed solution didn't work.

when running the first command, I get no reply from server

also, running the last cmd returned : no directory found 

[Simo Suomi]

In my case /etc/wazuh-indexer/jvm.options was overwritten by a package manager. Renaming an old conf file jvm.options-dpkg.old as jvm.options fixed the issue.