Logs Errors

[Matias]

Hello, I am getting this error frequently, the files exist, I don't know why it is the error

2023/02/02 00:11:47 wazuh-monitord: ERROR: Unable to delete 'logs/alerts/2023/Feb/ossec-alerts-01.log' due to 'No such file or directory'
2023/02/02 00:11:50 wazuh-monitord: ERROR: Unable to delete 'logs/alerts/2023/Feb/ossec-alerts-01.log' due to 'No such file or directory'
2023/02/02 00:11:52 wazuh-monitord: ERROR: Unable to delete 'logs/alerts/2023/Feb/ossec-alerts-01.log' due to 'No such file or directory'
2023/02/02 00:11:56 wazuh-monitord: ERROR: Unable to delete 'logs/alerts/2023/Feb/ossec-alerts-01.log' due to 'No such file or directory'
2023/02/02 00:12:59 wazuh-monitord: ERROR: Unable to delete 'logs/alerts/2023/Feb/ossec-alerts-01.log' due to 'No such file or directory'
2023/02/02 00:17:22 wazuh-monitord: ERROR: Unable to delete 'logs/alerts/2023/Feb/ossec-alerts-01.json' due to 'No such file or directory'
2023/02/02 00:17:27 wazuh-monitord: ERROR: Unable to delete 'logs/alerts/2023/Feb/ossec-alerts-01.json' due to 'No such file or directory'
2023/02/02 00:17:27 wazuh-monitord: ERROR: Unable to delete 'logs/alerts/2023/Feb/ossec-alerts-01.json' due to 'No such file or directory'
2023/02/02 00:17:29 wazuh-monitord: ERROR: Unable to delete 'logs/alerts/2023/Feb/ossec-alerts-01.json' due to 'No such file or directory'
2023/02/02 00:17:54 wazuh-monitord: ERROR: Unable to delete 'logs/alerts/2023/Feb/ossec-alerts-01.json' due to 'No such file or directory'
2023/02/02 01:45:26 wazuh-analysisd: ERROR: The new permissions could not be added to the JSON alert.

[Eduardo Leon Aldazoro]

Hi, Thanks for using Wazuh!

Can you please provide the following information so I can look further into your problem:

- OS.

- Wazuh Version installed.

 

I'll be waiting for your response.

Best Regards,

[Matias]

Rocky linux 8

Wazuh 4.3.10

[Eduardo Leon Aldazoro]

Hi,

I can see you have 2 different errors, so we will address them both:

- Regarding the analysisd Error. This is a known issue that was first reported here and fixed here. It will be available in Wazuh version 4.5.0. This error is generated when Wazuh has a lot of stress applied to it and the events have a bad format in their permission.

I will keep looking into the monitord Error and will answers as soon as I have more information about it.

Best Regards 

[Eduardo Leon Aldazoro]

In the meantime can you restart the manager with the following command:

-systemctl restart wazuh-manager 

and tell me if monitord still can't find the file.

Will be waiting for your response as well.

Regards,