Problems with indexer and /tmp directory

[Augusto Bruno]

Good evening!

I need your help. My wazuh after the update to version 4.12 is presenting several problems.
1 - the dashboard is reset as shown below

2 - after moving the log folder that was in /var/ossec/logs to /var/lib/wazuh-indexer/logs it is showing

-- Unit wazuh-indexer.service has begun starting up.
May 19 19:28:00 acvp-sec-wazuh-01 systemd-entrypoint[27604]: WARNING: java.io.tmpdir directory does not exist
May 19 19:28:00 acvp-sec-wazuh-01 systemd-entrypoint[27604]: WARNING: A terminally deprecated method in java.lang.System has been called
May 19 19:28:00 acvp-sec-wazuh-01 systemd-entrypoint[27604]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.19.1.jar)
May 19 19:28:00 acvp-sec-wazuh-01 systemd-entrypoint[27604]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
May 19 19:28:00 acvp-sec-wazuh-01 systemd-entrypoint[27604]: WARNING: System::setSecurityManager will be removed in a future release
May 19 19:28:01 acvp-sec-wazuh-01 systemd-entrypoint[27604]: ERROR: Temporary file directory [/var/lib/wazuh-indexer/tmp] does not exist or is not accessible
May 19 19:28:01 acvp-sec-wazuh-01 systemd[1]: wazuh-indexer.service: main process exited, code=exited, status=78/n/a
May 19 19:28:01 acvp-sec-wazuh-01 systemd[1]: Failed to start wazuh-indexer.
-- Subject: Unit wazuh-indexer.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit wazuh-indexer.service has failed.

After problem number 2. wazuh is no longer starting. Can anyone help? I've tried mounting /tmp but it still gives the same error.

[hasitha.u...@wazuh.com]

Hi  Augusto,

The error message indicates that the Wazuh Indexer is unable to access or find the temporary file directory at /var/lib/wazuh-indexer/tmp. This could prevent the Wazuh Indexer from functioning properly, as it relies on this directory for temporary file storage during operations.

First, check tmp folder exists in the /var/lib/wazuh-indexer directory by running this command.
ls -lh /var/lib/wazuh-indexer

If the file exist check the permission. Permission should look like this.

If the tmp folder does not exist, then create the tmp folder and provide the necessary permissions.
sudo mkdir /var/lib/wazuh-indexer/tmp

Set the folder permission 
sudo chmod 755 /var/lib/wazuh-indexer/tmp
sudo chown wazuh-indexer:wazuh-indexer /var/lib/wazuh-indexer/tmp

Then restart the Wazuh indexer.
systemctl restart wazuh-indexer

If the issue persists, please share the Wazuh indexer logs to check further.
cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn"

Let me know if you need further assistance on this.

Regards,
Hasitha Upekshitha

[hasitha.u...@wazuh.com]

Hi  Augusto

Could you please provide an update on this, so we can move forward with the issue?

Regards,
Hasitha Upekshitha