Wazuh-dashboard fails to start

[Gustavo Rodriguez]

Hello community,

I am having a problem with Wazuh Dashboard, as it crashes at startup. I am using Wazuh version v4.11.1 on Ubuntu 24.01.

When I try to start the dashboard with systemctl start wazuh-dashboard, it seems that the service tries to start but fails. When checking the logs with:

#:/home/wazuh# journalctl -u wazuh-dashboard -f
Apr 21 11:08:18 wazuh-VMware20-1 opensearch-dashboards[21358]: {"type":"log","@timestamp":"2025-04-21T14:08:18Z","tags":["info","savedobjects-service"],"pid":21358,"message":"Waiting until all OpenSearch nodes are compatible with OpenSearch Dashboards before starting saved objects migrations..."}
Apr 21 11:08:18 wazuh-VMware20-1 opensearch-dashboards[21358]: {"type":"log","@timestamp":"2025-04-21T14:08:18Z","tags":["info","savedobjects-service"],"pid":21358,"message":"Starting saved objects migrations"}
Apr 21 11:08:18 wazuh-VMware20-1 opensearch-dashboards[21358]: {"type":"log","@timestamp":"2025-04-21T14:08:18Z","tags":["error","opensearch","data"],"pid":21358,"message":"[circuit_breaking_exception]: [parent] Data too large, data for [<http_request>] would be [1067857632/1018.3mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1067857632/1018.3mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=0/0b, in_flight_requests=0/0b]"}
Apr 21 11:08:18 wazuh-VMware20-1 opensearch-dashboards[21358]: {"type":"log","@timestamp":"2025-04-21T14:08:18Z","tags":["warning","savedobjects-service"],"pid":21358,"message":"Unable to connect to OpenSearch. Error: circuit_breaking_exception: [circuit_breaking_exception] Reason: [parent] Data too large, data for [<http_request>] would be [1067857632/1018.3mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1067857632/1018.3mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=0/0b, in_flight_requests=0/0b]"}
Apr 21 11:08:18 wazuh-VMware20-1 opensearch-dashboards[21358]: {"type":"log","@timestamp":"2025-04-21T14:08:18Z","tags":["fatal","root"],"pid":21358,"message":"ResponseError: circuit_breaking_exception: [circuit_breaking_exception] Reason: [parent] Data too large, data for [<http_request>] would be [1067857632/1018.3mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1067857632/1018.3mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=0/0b, in_flight_requests=0/0b]\n    at onBody (/usr/share/wazuh-dashboard/node_modules/@opensearch-project/opensearch/lib/Transport.js:374:23)\n    at IncomingMessage.onEnd (/usr/share/wazuh-dashboard/node_modules/@opensearch-project/opensearch/lib/Transport.js:293:11)\n    at IncomingMessage.emit (node:events:529:35)\n    at IncomingMessage.emit (node:domain:489:12)\n    at endReadableNT (node:internal/streams/readable:1400:12)\n    at processTicksAndRejections (node:internal/process/task_queues:82:21) {\n  meta: {\n    body: { error: [Object], status: 429 },\n    statusCode: 429,\n    headers: {\n      'content-type': 'application/json; charset=UTF-8',\n      'content-length': '817'\n    },\n    meta: {\n      context: null,\n      request: [Object],\n      name: 'opensearch-js',\n      connection: [Object],\n      attempts: 0,\n      aborted: false\n    }\n  }\n}"}
Apr 21 11:08:18 wazuh-VMware20-1 opensearch-dashboards[21358]: {"type":"log","@timestamp":"2025-04-21T14:08:18Z","tags":["info","plugins-system"],"pid":21358,"message":"Stopping all plugins."}
Apr 21 11:08:18 wazuh-VMware20-1 opensearch-dashboards[21358]:  FATAL  {"error":{"root_cause":[{"type":"circuit_breaking_exception","reason":"[parent] Data too large, data for [<http_request>] would be [1067857632/1018.3mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1067857632/1018.3mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=0/0b, in_flight_requests=0/0b]","bytes_wanted":1067857632,"bytes_limit":1020054732,"durability":"TRANSIENT"}],"type":"circuit_breaking_exception","reason":"[parent] Data too large, data for [<http_request>] would be [1067857632/1018.3mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1067857632/1018.3mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=0/0b, in_flight_requests=0/0b]","bytes_wanted":1067857632,"bytes_limit":1020054732,"durability":"TRANSIENT"},"status":429}
Apr 21 11:08:18 wazuh-VMware20-1 systemd[1]: wazuh-dashboard.service: Main process exited, code=exited, status=1/FAILURE
Apr 21 11:08:18 wazuh-VMware20-1 systemd[1]: wazuh-dashboard.service: Failed with result 'exit-code'.
Apr 21 11:08:18 wazuh-VMware20-1 systemd[1]: wazuh-dashboard.service: Consumed 6.817s CPU time, 191.9M memory peak, 0B memory swap peak.

I have already tried restarting all services, adding memory to the server.

But it is still the same. Can you help me?

[Nicolas Zapata]

Hi Gustavo!

The issue seems to be related to the Indexer/OpenSearch heap size. The current heap memory limit is being exceeded, which causes the circuit breaker to trip and prevents the Wazuh Dashboard from starting.

You can follow this guide to increase the heap size for OpenSearch:
👉 https://documentation.wazuh.com/current/user-manual/wazuh-indexer/wazuh-indexer-tuning.html

Make sure the new heap size fits within the available system memory. After updating the heap settings, restart the Indexer service and then try starting the Wazuh Dashboard again.

Regards

[Gustavo Rodriguez]

Solved, add more memory to the server where wazuh is hosted.

And edit the /etc/wazuh-indexer/jvm.options file.

Editing the fields

-Xms7g
-Xmx7g

It is recommended to edit those values by 50% of the server ram, with that one everything is working.


Thanks community.