Wazuh Security Events Dashboard is empty

[Jay]

Hi,

A couple of weeks ago we upgraded to Wazuh 4.3.4.  I didn't check after the upgrade, but it appears our Wazuh->Modules->Security events->Dashboard is showing empty since the upgrade.  I've been receiving event emails, and the alerts.log is active, but I don't see anything in the dashboard.

I tried upgrading to 4.3.5 thinking maybe it was a bug, but still no Security events are showing in the dashboard.

We are using the Wazuh Indexer. Where can I look to start troubleshooting what is going on?

Thanks,

Jay

[Agbeyemi Samuel Damilola]

Hello Jay, 

Thanks for using Wazuh. 

After installation have you tried to restart Wazuh indexer, manager, filebeat and dashboard?

If everything is fine from that end, have to tried to install Wazuh agent on the host with the right configuration? I mean the IP of the Wazuh manager?

If you have done that. Try to either Uninstall the agent and reinstall it back.

Here is also a link to help you.

https://documentation.wazuh.com/current/user-manual/wazuh-dashboard/troubleshooting.html

You can reach me for further assistance. 

[Jay]

Thanks for the response.

Yes, all services were restarted on my Wazuh server.

The agents have the right config, they all work fine.  I get email security alerts all day.  I'm not getting any data at all in my Security events dashboard.  I'm not sure why uninstalling the agent would help with that though.  Please clarify, as we have a lot of agents deployed.

Jay

[Jay]

Using that link I was able to determine an issue with Filebeat.  Reinstalled it, and alerts are slowly starting to show up now.  Thank you!

Jay