Wazuh starting commands
KevinK Leung
Dear Team
I have my Wazuh installation success. But after the centOS reboot. It looks like the service is unable to restart.
Are there any scripts I have missed to install and register to the startup when the centOS restart? Thanks.
Kevin Leung
IT Security Specialist
Easy Great Technology Limited
KevinK Leung
Dear Wazuh Team,
Sorry, I just found the chkconfig list of commands. However, there are some errors occurred.
Kevin Leung
IT Security Specialist
Easy Great Technology Limited
Jonathan Martín Valera
Hi,
I see that the wazuh-indexer service is failing, let’s see what could be happening:
(1) - First of all, what kind of installation are you doing? all in one? (
wazuh-manager+filebeat+wazuh-indexer+wazuh-dashboardin the same host) or distributed (wazuh-managerandwazuh-indexer,wazuh-dashboardon separate hosts)(2) - What resources are available on the host where you are installing the components? Note that if there are not enough, the services will crash and restart to try again. Here you can find information about the recommended hardware resources for each of these components. In case they are installed on the same host, the recommended would be the sum of all of them.
wazuh-manager: https://documentation.wazuh.com/current/installation-guide/wazuh-server/index.html#hardware-requirementswazuh-indexer: https://documentation.wazuh.com/current/installation-guide/wazuh-indexer/index.html#hardware-recommendationswazuh-dashboard: https://documentation.wazuh.com/current/installation-guide/wazuh-server/index.html#hardware-requirementsDepending also on the usage it is possible to reduce a bit these recommended resources. For example, for my test environment I use 5GB of RAM and 3CPUs for an all in one installation, but making few API calls, few agents connected, few alerts generated… To start testing you can make use of these resources, but realize that they may be insufficient in the medium term,
(3) - What steps did you follow to perform the installation? Did you follow the step by step guide in the documentation? https://documentation.wazuh.com/current/installation-guide/wazuh-indexer/step-by-step.html
For example, if you want to perform an all-in-one installation quickly, you can also make use of the unattended installation https://documentation.wazuh.com/current/quickstart.html#installing-wazuh, where all components will be installed and configured in a couple of minutes automatically, although it can also be done perfectly step by step.
(4) - Let’s check the
wazuh-indexerlogs to see what could be the problem. To do this run the following commandjournalctl -u wazuh-indexerand share the logs obtained.
Answer (1), (2), (3) and (4), to get information about your environment and to understand what your problem may be.
Best regards.