ERROR: Cannot Connect to Wazuh Dashboard

[Gilson Junio]

Hello everyone, pleased to meet you. I am new here and got a problem when installing Wazuh dashboard.

I created three Ubuntu EC2 Instances on AWS for installing Wazuh, each one for a component, i made sure that all requirements are according to the recommended by Wazuh guide and proceeded with installation according to the assisted installation.

The indexer  and server installation went ok, no problems, i even used that command to verify if the indexer was running okay and it worked with no problems.

Indexer Output:
root@COOLIP:/home/ubuntu# curl -k -u admin:PASSWORD https://IP:9200
{
  "name" : "node-1",
  "cluster_name" : "wazuh-indexer-cluster",
  "cluster_uuid" : "2AeAbUh-RMWSav_koyisNQ",
  "version" : {
    "number" : "7.10.2",
    "build_type" : "deb",
    "build_hash" : "8f728199af83591b03e787621cb12b1e3437ae90",
    "build_date" : "2025-02-14T14:08:33.049199Z",
    "build_snapshot" : false,
    "lucene_version" : "9.11.1",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}

Then i copied the wazuh-install-files.tar from the indexer to the server and dashboard machines via scp and started the setup on them too. The installation on server gone as it should:

Server Output:

root@COOLIP:/home/ubuntu# bash wazuh-install.sh --wazuh-server wazuh-1
05/03/2025 12:10:25 INFO: Starting Wazuh installation assistant. Wazuh version: 4.11.0 (x86_64/AMD64)
05/03/2025 12:10:25 INFO: Verbose logging redirected to /var/log/wazuh-install.log
05/03/2025 12:10:32 INFO: Verifying that your system meets the recommended minimum hardware requirements.
05/03/2025 12:10:39 INFO: Wazuh repository added.
05/03/2025 12:10:39 INFO: --- Wazuh server ---
05/03/2025 12:10:39 INFO: Starting the Wazuh manager installation.
05/03/2025 12:11:43 INFO: Wazuh manager installation finished.
05/03/2025 12:11:43 INFO: Wazuh manager vulnerability detection configuration finished.
05/03/2025 12:11:43 INFO: Starting service wazuh-manager.
05/03/2025 12:12:02 INFO: wazuh-manager service started.
05/03/2025 12:12:02 INFO: Starting Filebeat installation.
05/03/2025 12:12:10 INFO: Filebeat installation finished.
05/03/2025 12:12:11 INFO: Filebeat post-install configuration finished.
05/03/2025 12:12:15 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password.
05/03/2025 12:12:38 INFO: Starting service filebeat.
05/03/2025 12:12:40 INFO: filebeat service started.
05/03/2025 12:12:40 INFO: Installation finished.

The problem comes when i run the installation on the dashboard i got the following output:

root@COOLIP:/home/ubuntu# bash wazuh-install.sh --wazuh-dashboard dashboard
05/03/2025 12:11:25 INFO: Starting Wazuh installation assistant. Wazuh version: 4.11.0 (x86_64/AMD64)
05/03/2025 12:11:25 INFO: Verbose logging redirected to /var/log/wazuh-install.log
05/03/2025 12:11:31 INFO: Verifying that your system meets the recommended minimum hardware requirements.
05/03/2025 12:11:31 INFO: Wazuh web interface port will be 443.
05/03/2025 12:11:39 INFO: Wazuh repository added.
05/03/2025 12:11:40 INFO: --- Wazuh dashboard ----
05/03/2025 12:11:40 INFO: Starting Wazuh dashboard installation.
^C
Do you want to remove the ongoing installation?[Y/N]y
05/03/2025 12:12:14 INFO: --- Removing existing Wazuh installation ---
05/03/2025 12:12:14 INFO: Removing Wazuh dashboard.
05/03/2025 12:12:23 INFO: Wazuh dashboard removed.
05/03/2025 12:12:24 INFO: Installation cleaned.
root@COOLIP:/home/ubuntu# bash wazuh-install.sh -v --wazuh-dashboard dashboard
05/03/2025 12:12:27 DEBUG: Checking root permissions.
05/03/2025 12:12:27 DEBUG: Checking sudo package.
05/03/2025 12:12:27 INFO: Starting Wazuh installation assistant. Wazuh version: 4.11.0 (x86_64/AMD64)
05/03/2025 12:12:27 INFO: Verbose logging redirected to /var/log/wazuh-install.log
05/03/2025 12:12:27 DEBUG: APT package manager will be used.
05/03/2025 12:12:27 DEBUG: Checking system distribution.
05/03/2025 12:12:27 DEBUG: Detected distribution name: ubuntu
05/03/2025 12:12:27 DEBUG: Detected distribution version: 24
05/03/2025 12:12:27 DEBUG: Installing check dependencies.
Hit:1 http://security.ubuntu.com/ubuntu noble-security InRelease
Hit:2 http://mx-central-1.ec2.archive.ubuntu.com/ubuntu noble InRelease
Hit:3 http://mx-central-1.ec2.archive.ubuntu.com/ubuntu noble-updates InRelease
Hit:4 http://mx-central-1.ec2.archive.ubuntu.com/ubuntu noble-backports InRelease
Reading package lists...
05/03/2025 12:12:32 DEBUG: Checking Wazuh installation.
05/03/2025 12:12:34 DEBUG: Checking system architecture.
05/03/2025 12:12:34 INFO: Verifying that your system meets the recommended minimum hardware requirements.
05/03/2025 12:12:34 DEBUG: CPU cores detected: 2
05/03/2025 12:12:34 DEBUG: Free RAM memory detected: 3836
05/03/2025 12:12:34 DEBUG: Checking previous certificate existence.
05/03/2025 12:12:34 INFO: Wazuh web interface port will be 443.
05/03/2025 12:12:35 DEBUG: Checking ports availability.
Hit:1 http://mx-central-1.ec2.archive.ubuntu.com/ubuntu noble InRelease
Hit:2 http://mx-central-1.ec2.archive.ubuntu.com/ubuntu noble-updates InRelease
Hit:3 http://mx-central-1.ec2.archive.ubuntu.com/ubuntu noble-backports InRelease
Hit:4 http://security.ubuntu.com/ubuntu noble-security InRelease
Reading package lists...
05/03/2025 12:12:37 DEBUG: Installing prerequisites dependencies.
05/03/2025 12:12:40 DEBUG: Checking curl tool version.
05/03/2025 12:12:40 DEBUG: Adding the Wazuh repository.
gpg: keyring '/usr/share/keyrings/wazuh.gpg' created
gpg: key 96B3EE5F29111145: public key "Wazuh.com (Wazuh Signing Key) <sup...@wazuh.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main
Get:1 https://packages.wazuh.com/4.x/apt stable InRelease [17.3 kB]
Hit:2 http://mx-central-1.ec2.archive.ubuntu.com/ubuntu noble InRelease
Hit:3 http://security.ubuntu.com/ubuntu noble-security InRelease
Hit:4 http://mx-central-1.ec2.archive.ubuntu.com/ubuntu noble-updates InRelease
Hit:5 http://mx-central-1.ec2.archive.ubuntu.com/ubuntu noble-backports InRelease
Get:6 https://packages.wazuh.com/4.x/apt stable/main amd64 Packages [43.5 kB]
Fetched 60.8 kB in 1s (107 kB/s)
Reading package lists...
05/03/2025 12:12:42 INFO: Wazuh repository added.
05/03/2025 12:12:42 DEBUG: Extracting Wazuh configuration.
05/03/2025 12:12:42 DEBUG: Reading configuration file.
05/03/2025 12:12:42 DEBUG: Checking if 172.31.10.70 is private.
05/03/2025 12:12:42 DEBUG: Checking if 172.31.12.161 is private.
05/03/2025 12:12:42 DEBUG: Checking if 172.31.7.164 is private.
05/03/2025 12:12:42 DEBUG: Checking node names in the configuration file.
05/03/2025 12:12:42 INFO: --- Wazuh dashboard ----
05/03/2025 12:12:42 INFO: Starting Wazuh dashboard installation.
Reading package lists... Building dependency tree... Reading state information... The following NEW packages will be installed: wazuh-dashboard 0 upgraded, 1 newly installed, 0 to remove and 130 not upgraded. Running kernel seems to be up-to-date. Restarting services... Service restarts being deferred: /etc/needrestart/restart.d/dbus.service systemctl restart ge...@tty1.service systemctl restart networkd-dispatcher.service systemctl restart serial...@ttyS0.service systemctl restart systemd-logind.service systemctl restart unattended-upgrades.service No containers need to be restarted. User sessions running outdated binaries: ubuntu @ session #2: sshd[1084,1194], su[1312] ubuntu @ user manager service: systemd[1089] No VM guests are running outdated hypervisor (qemu) binaries on this host.
05/03/2025 12:13:13 DEBUG: Checking Wazuh installation.
05/03/2025 12:13:15 DEBUG: There are Wazuh dashboard remaining files.
05/03/2025 12:13:15 INFO: Wazuh dashboard installation finished.
05/03/2025 12:13:15 DEBUG: Configuring Wazuh dashboard.
05/03/2025 12:13:15 DEBUG: Copying Wazuh dashboard certificates.
05/03/2025 12:13:15 DEBUG: Wazuh dashboard certificate setup finished.
05/03/2025 12:13:15 INFO: Wazuh dashboard post-install configuration finished.
05/03/2025 12:13:15 INFO: Starting service wazuh-dashboard.
Created symlink /etc/systemd/system/multi-user.target.wants/wazuh-dashboard.service → /etc/systemd/system/wazuh-dashboard.service.
05/03/2025 12:13:16 INFO: wazuh-dashboard service started.
05/03/2025 12:13:16 DEBUG: Setting Wazuh indexer cluster passwords.
05/03/2025 12:13:16 DEBUG: Checking Wazuh installation.
05/03/2025 12:13:18 DEBUG: There are Wazuh dashboard remaining files.
05/03/2025 12:13:20 DEBUG: Restarting wazuh-dashboard service...
05/03/2025 12:13:24 DEBUG: wazuh-dashboard started.
05/03/2025 12:13:24 DEBUG: Changing API passwords.
05/03/2025 12:14:24 INFO: Initializing Wazuh dashboard web application.
05/03/2025 12:14:34 DEBUG: Retrying Wazuh dashboard connection...
05/03/2025 12:14:44 DEBUG: Retrying Wazuh dashboard connection...
05/03/2025 12:14:54 DEBUG: Retrying Wazuh dashboard connection...
05/03/2025 12:15:04 DEBUG: Retrying Wazuh dashboard connection...
05/03/2025 12:15:14 DEBUG: Retrying Wazuh dashboard connection...
05/03/2025 12:15:24 DEBUG: Retrying Wazuh dashboard connection...
05/03/2025 12:15:34 DEBUG: Retrying Wazuh dashboard connection...
05/03/2025 12:15:44 DEBUG: Retrying Wazuh dashboard connection...
05/03/2025 12:15:55 DEBUG: Retrying Wazuh dashboard connection...
05/03/2025 12:16:05 DEBUG: Retrying Wazuh dashboard connection...
05/03/2025 12:16:15 DEBUG: Retrying Wazuh dashboard connection...
05/03/2025 12:16:25 DEBUG: Retrying Wazuh dashboard connection...
05/03/2025 12:16:25 ERROR: Cannot connect to Wazuh dashboard.
05/03/2025 12:30:17 INFO: If you want to install Wazuh dashboard without waiting for the Wazuh indexer cluster, use the -fd option
05/03/2025 12:30:17 INFO: --- Removing existing Wazuh installation ---
05/03/2025 12:30:17 INFO: Removing Wazuh dashboard.
Reading package lists...
Building dependency tree...
Reading state information...
The following packages will be REMOVED:
  wazuh-dashboard*
0 upgraded, 0 newly installed, 1 to remove and 130 not upgraded.
                                                                After this operation, 957 MB disk space will be freed.
(Reading database ... 166053 files and directories currently installed.)                                              (Reading database ...
Removing wazuh-dashboard (4.11.0-1) ...
Stopping wazuh-dashboard service... OK
Deleting PID directory... OK
Deleting installation directory... OK
(Reading database ... 78127 files and directories currently installed.)
Purging configuration files for wazuh-dashboard (4.11.0-1) ...
 OK
05/03/2025 12:30:27 INFO: Wazuh dashboard removed.
05/03/2025 12:30:27 DEBUG: Removing GPG key from system.
05/03/2025 12:30:27 INFO: Installation cleaned. Check the /var/log/wazuh-install.log file to learn more about the issue.

Well, i used cat on that path but the output is the same as above.

If anyone could lend me a hand on this i'd be very grateful.

Thanks in advance,

Gilson Junio

[Olusegun Adenrele Oyebo]

Hello Gilson,

It seems the issue you're having is due to the fact the Wazuh dashboard was trying to connect to the indexer server but couldn't:

05/03/2025 12:16:25 ERROR: Cannot connect to Wazuh dashboard.
05/03/2025 12:30:17 INFO: If you want to install Wazuh dashboard without waiting for the Wazuh indexer cluster, use the -fd option

Can you try to initiate the installation again with the command bash wazuh-install.sh --wazuh-dashboard dashboard -fd?

Let me know the outcome of this.

Best regards.

[Olusegun Adenrele Oyebo]

Hello Gilson,

I'm glad to hear that your issue has been resolved. Also, please ensure you always do a reply all to your mails. This will also be beneficial to other users to see how your query was resolved.

We remain attentive to your queries.

Best regards.

On Thu, Mar 6, 2025 at 1:09 PM Gilson Junio <gilso...@gmail.com> wrote:

Hello! Thank you so much for replying my message.

Well, i don't know if you received my previous reply due to a electrical shortage that happened yesterday at my home right 

after i responded to you , but i did as you asked and it was indeed a connection issue. The security group from my machines

didn't allow connections to port 9200, then i allowed connections to that port and it worked right away.

I really appreciate you from taking some of your time to help me, thank you very much.