Wazuh dashboard is not ready

[masara]

Hey @everyone

I am getting this error  of wazuh server is not ready . The error came about after I did a reset on an internal user password  and threw this error on the dashboard. 

{"error":{"root_cause":[{"type":"json_generation_exception","reason":"Can not start an object, expecting field name (context: Object)"}],"type":"json_generation_exception","reason":"Can not start an object, expecting field name (context: Object)"},"status":500} Version: 2.8.0 Build: 47502 Error at Fetch._callee3$ (https://mydomain/47502/bundles/core/core.entry.js:15:585158) at tryCatch (https://mydomain/47502/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:786910) at Generator.invoke [as _invoke] (https://mydomain/47502/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:790926) at Generator.next (https://mydomain/47502/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:788105) at fetch_asyncGeneratorStep (https://mydomain/47502/bundles/core/core.entry.js:15:578070) at _next (https://mydomain/47502/bundles/core/core.entry.js:15:578386) 


After restarting all the services the dashboard, manager and indexer i now get the error on 
wazuh dashboard is not ready 
from my research the error comes when the dashboard is not communicating  with indexer .
journalctl -u wazuh-dashboard |grep -i -E "$(date +%F).*(error|warn)"

Feb 21 08:54:09 WazuhMSS opensearch-dashboards[2007566]: {"type":"log","@timestamp":"2025-02-21T08:54:09Z","tags":["error","opensearch","data"],"pid":2007566,"message":"[ResponseError]: Response Error"}
Feb 21 08:54:12 WazuhMSS opensearch-dashboards[2007566]: {"type":"log","@timestamp":"2025-02-21T08:54:12Z","tags":["error","opensearch","data"],"pid":2007566,"message":"[ResponseError]: Response Error"}
Feb 21 08:54:14 WazuhMSS opensearch-dashboards[2007566]: {"type":"log","@timestamp":"2025-02-21T08:54:14Z","tags":["error","opensearch","data"],"pid":2007566,"message":"[ResponseError]: Response Error"}
Feb 21 08:54:17 WazuhMSS opensearch-dashboards[2007566]: {"type":"log","@timestamp":"2025-02-21T08:54:17Z","tags":["error","opensearch","data"],"pid":2007566,"message":"[ResponseError]: Response Error"}
Feb 21 08:54:19 WazuhMSS opensearch-dashboards[2007566]: {"type":"log","@timestamp":"2025-02-21T08:54:19Z","tags":["error","opensearch","data"],"pid":2007566,"message":"[ResponseError]: Response Error"}
Feb 21 08:54:22 WazuhMSS opensearch-dashboards[2007566]: {"type":"log","@timestamp":"2025-02-21T08:54:22Z","tags":["error","opensearch","data"],"pid":2007566,"message":"[ResponseError]: Response Error"}
Feb 21 08:54:24 WazuhMSS opensearch-dashboards[2007566]: {"type":"log","@timestamp":"2025-02-21T08:54:24Z","tags":["error","opensearch","data"],"pid":2007566,"message":"[ResponseError]: Response Error"}
Feb 21 08:54:27 WazuhMSS opensearch-dashboards[2007566]: {"type":"log","@timestamp":"2025-02-21T08:54:27Z","tags":["error","opensearch","data"],"pid":2007566,"message":"[ResponseError]: Response Error"}
Feb 21 08:54:29 WazuhMSS opensearch-dashboards[2007566]: {"type":"log","@timestamp":"2025-02-21T08:54:29Z","tags":["error","opensearch","data"],"pid":2007566,"message":"[ResponseError]: Response Error"}
Feb 21 08:54:32 WazuhMSS opensearch-dashboards[2007566]: {"type":"log","@timestamp":"2025-02-21T08:54:32Z","tags":["error","opensearch","data"],"pid":2007566,"message":"[ResponseError]: Response Error"}
Feb 21 08:54:34 WazuhMSS opensearch-dashboards[2007566]: {"type":"log","@timestamp":"2025-02-21T08:54:34Z","tags":["error","opensearch","data"],"pid":2007566,"message":"[ResponseError]: Response Error"}
Feb 21 08:54:37 WazuhMSS opensearch-dashboards[2007566]: {"type":"log","@timestamp":"2025-02-21T08:54:37Z","tags":["error","opensearch","data"],"pid":2007566,"message":"[ResponseError]: Response Error"}


Note i dont  to use opensearch .
Thank you in advence

[Olusegun Adenrele Oyebo]

Hello Masara,

The error "Wazuh dashboard is not ready yet" normally indicates an issue in communication between Wazuh dashboard and Wazuh indexer. May I know the exact internal user password you changed? Also, do you have an all-in-one architecture or you're using distributed architecture?

For example, if you change the kibanaserver user password from the indexer server, you will also need to update the Wazuh dashboard keystore with the new password:

• echo <KIBANASERVER_PASSWORD> | /usr/share/wazuh-dashboard/bin/opensearch-dashboards-keystore --allow-root add -f --stdin opensearch.password

Restart the Wazuh dashboard service:

• systemctl restart wazuh-dashboard

For an all-in-one architecture, it automatically updates the passwords where necessary. You can also check the below link for more information:

• https://documentation.wazuh.com/current/user-manual/user-administration/password-management.html

If the issue persists after verifying the above, kindly share the full output of the below commands:

• cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn|crit|fatal"
• systemctl status wazuh-indexer

Let me know if this helps to resolve your issue.

Best regards.

[masara]

Hi Olusegun,

Sorry for the late reply .
For clarification, I am not using the all-in-one deployment for Wazuh. Regarding the internal user, I changed the password for an account I had created to allow a team member to access the Wazuh tool

Here is the error log from the this command

cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn|crit|fatal"

[2025-02-23T20:33:11,215][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [node-1] Failure No shard available for [org.opensearch.action.get.MultiGetShardRequest@10bf23b5] retrieving configuration for [INTERNALUSERS, ACTIONGROUPS, CONFIG, ROLES, ROLESMAPPING, TENANTS, NODESDN, WHITELIST, ALLOWLIST, AUDIT] (index=.opendistro_security)
[2025-02-23T20:33:11,215][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [node-1] Failure No shard available for [org.opensearch.action.get.MultiGetShardRequest@10bf23b5] retrieving configuration for [INTERNALUSERS, ACTIONGROUPS, CONFIG, ROLES, ROLESMAPPING, TENANTS, NODESDN, WHITELIST, ALLOWLIST, AUDIT] (index=.opendistro_security)
[2025-02-23T20:33:11,215][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [node-1] Failure No shard available for [org.opensearch.action.get.MultiGetShardRequest@10bf23b5] retrieving configuration for [INTERNALUSERS, ACTIONGROUPS, CONFIG, ROLES, ROLESMAPPING, TENANTS, NODESDN, WHITELIST, ALLOWLIST, AUDIT] (index=.opendistro_security)
[2025-02-23T20:33:11,215][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [node-1] Failure No shard available for [org.opensearch.action.get.MultiGetShardRequest@10bf23b5] retrieving configuration for [INTERNALUSERS, ACTIONGROUPS, CONFIG, ROLES, ROLESMAPPING, TENANTS, NODESDN, WHITELIST, ALLOWLIST, AUDIT] (index=.opendistro_security)
[2025-02-23T20:33:11,345][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
[2025-02-23T20:33:11,346][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
[2025-02-23T20:33:11,347][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
[2025-02-23T20:33:11,347][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
[2025-02-23T20:33:13,848][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
[2025-02-23T20:33:13,848][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
[2025-02-23T20:33:13,849][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)

[masara]

Maybe i should also clarify that I have intergrated elasticsearch whereby i  use logstash to send the logs to elasticsearch. which is running and i receive all logs there.

[Olusegun Adenrele Oyebo]

Hello Masara,

Thanks for the information.

May I know the procedures/commands you used to change this password?

Did you check the status of my Wazuh indexer service to know if it's active or not, based on my previous response?

Kindly confirm that you're sharing the full log output of cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn|crit|fatal" and not just part of it.

Also, I can see the error [ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin), you can try to run the initialization script on the indexer node by running the below command:

• /usr/share/wazuh-indexer/bin/indexer-security-init.sh

Restart the Wazuh indexer service:

• systemctl restart wazuh-indexer

Let me know if this works for you or if it persists.

Best regards.

[masara]

Hello Olusegun,

Thank you for your response.

I changed the password through Stack Management > Security > Internal Users, where I navigated to change the password.

Yes, I have checked the Wazuh indexer service, and it is up and running.

Additionally, I have executed the provided commands:

/usr/share/wazuh-indexer/bin/indexer-security-init.sh 

systemctl restart wazuh-indexer

However, I am still encountering the same error:
[ERROR][o.o.s.a.BackendRegistry ] [node-1] Not yet initialized (you may need to run securityadmin).

Please let me know if there are any further steps I should take to resolve this.

Best regards.

[Olusegun Adenrele Oyebo]

Hello Masara,

Are you still having this issue?

Kindly share with me fresh logs from your Wazuh indexer server with the below command. Ensure that you're sending the full output log and not just part of the logs:

• cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn|crit|fatal"

Also, you can share the Wazuh dashboard logs:

• journalctl -u wazuh-dashboard | grep -i -E "error|warn|crit|fatal"

Will be expecting your feedback.

Best regards.

[masara]

Hi Olusegun,

I was able to sort the issue by unistalling and reinstalling the wazuh-indexer and wazuh dashboard
Thank you

[Olusegun Adenrele Oyebo]

Hi Masara,

Thanks for the feedback.

We remain attentive to your queries.

Best regards.