Wazuh Dashboard server not ready yet

[Chittaranjan Poojari]

Hi,

I have recently updated Wazuh. The current version is  WAZUH_VERSION="v4.9.0" WAZUH_REVISION="40907" WAZUH_TYPE="server.

sudo tail -f /var/ossec/logs/ossec.log

2024/09/17 12:18:30 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-vulnerabilities-izt4nelmi14d3jeu2zq4dhz', retrying until the connection is successful.
2024/09/17 12:18:30 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2024/09/17 12:18:31 wazuh-modulesd:vulnerability-scanner: INFO: Vulnerability scanner module started.
2024/09/17 12:18:37 wazuh-syscheckd: INFO: (6009): File integrity monitoring scan ended.
2024/09/17 12:18:37 wazuh-syscheckd: INFO: FIM sync module started.
2024/09/17 12:18:40 sca: INFO: Evaluation finished for policy '/var/ossec/ruleset/sca/cis_ubuntu22-04.yml'
2024/09/17 12:18:40 sca: INFO: Security Configuration Assessment scan finished. Duration: 10 seconds.
2024/09/17 12:18:55 rootcheck: INFO: Ending rootcheck scan.
2024/09/17 13:18:31 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2024/09/17 13:18:41 wazuh-modulesd:syscollector: INFO: Evaluation finished.

when i run " cat /var/ossec/logs/ossec.log | grep -i -E "error|warn"

2024/09/17 12:18:17 wazuh-modulesd: WARNING: The 'vulnerability-detector' configuration is deprecated, please update your settings to use the new 'vulnerability-detection' instead (default values will be used based on your pr
evious configurations). See https://documentation.wazuh.com
2024/09/17 12:18:17 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
2024/09/17 12:18:17 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'min_full_scan_interval'.
2024/09/17 12:18:17 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'run_on_start'.
2024/09/17 12:18:17 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2024/09/17 12:18:17 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2024/09/17 12:18:29 wazuh-modulesd: WARNING: The 'vulnerability-detector' configuration is deprecated, please update your settings to use the new 'vulnerability-detection' instead (default values will be used based on your pr
evious configurations). See https://documentation.wazuh.com
2024/09/17 12:18:29 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'interval'.
2024/09/17 12:18:29 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'min_full_scan_interval'.
2024/09/17 12:18:29 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'run_on_start'.
2024/09/17 12:18:29 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2024/09/17 12:18:29 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2024/09/17 12:18:29 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.

2024/09/17 12:18:29 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2024/09/17 12:18:29 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2024/09/17 12:18:29 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
2024/09/17 12:18:30 wazuh-modulesd:database: WARNING: Removing dangling WDB DB file: 'queue/db/031.db'
2024/09/17 12:18:30 wazuh-modulesd:database: WARNING: Removing dangling WDB DB file: 'queue/db/037.db'
2024/09/17 12:18:30 wazuh-modulesd:database: WARNING: Removing dangling WDB DB file: 'queue/db/036.db'

2024/09/17 12:18:30 wazuh-modulesd:database: WARNING: Removing dangling WDB DB file: 'queue/db/023.db'
2024/09/17 12:18:30 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-vulnerabilities-xxxxxxxx', retrying until the connection is successful.

Please provide me the solution for the same .

Thank you 

Chittaranjan 

[Lamya Imam]

Hello  Chittaranjan Poojari,

As it is said in the logs, the Vulnerability Detector module has been deprecated, and now it is refactored to the Vulnerability Detection module. If you have upgraded to 4.9, it is expected the old Vulnerability Detector does not work. 

To solve this issue, we have dedicated documentation that explains how to migrate to this new module. Please, take a look to it and I would suggest you to configure it accordingly:
https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/configuring-scans.html#configuring-vulnerability-detection

Also, regarding the error:

2024/09/17 12:18:30 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-vulnerabilities-izt4nelmi14d3jeu2zq4dhz', retrying until the connection is successful.

I would suggest you to to add the credentials of the Wazuh indexer to the Wazuh manager keystore, by using the following command:
/var/ossec/bin/wazuh-keystore -f indexer -k username -v <INDEXER_USERNAME>
/var/ossec/bin/wazuh-keystore -f indexer -k password -v <INDEXER_PASSWORD>

For further reference, please check out this documentation:
https://documentation.wazuh.com/current/upgrade-guide/troubleshooting.html#troubleshooting

Let me know if you need further assistance on this!

[Chittaranjan Poojari]

Hello Lamya,

i have followed the document and made the necessary changes . 

i am still facing the same issue . wazuh dashboard server not ready yet. 

i have attached the error log .

kindly provide solution.

regards 

Chittaranjan

[Lamya Imam]

Hello  Chittaranjan Poojari,

I would suggest you to check the certificate names at /etc/filebeat/certs and ensure that it matches at /var/ossec/etc/ossec.conf file:
# ll -h /etc/filebeat/certs
# cat /var/ossec/etc/ossec.conf

Please check the screenshots for reference.

Let me know if this solves the issue! 

[Chittaranjan Poojari]

Hello Lamya,

We have checked and matched the certificate on both and its correct but still the same issue . Wazuh Dashboard Server is not ready yet . 

We have attached the logs. 

 

Thanks 

Chittaranjan 

[Lamya Imam]

Hello Chittaranjan Poojari,

I would suggest you to run the following command in the indexer server, and restart the Wazuh dashboard afterwards: 
# curl -X DELETE -u admin:password -k "https://localhost:9200/.kibana_*"
# systemctl restart wazuh-dashboard

Use the admin and password that you use to log into the dashboard. 

Let me know if this worked out for you!

[Erik-Jan Davids]

I had the same problem, and after trying many things your last suggestion did the trick. Thanks!

Op dinsdag 24 september 2024 om 13:23:33 UTC+2 schreef Lamya Imam: