Wazuh App Version vs Wazuh Kibana version mismatch

[Julián Restrepo]

Best regard,
In advance, thank you for the possible collaboration that you can offer us with the following query.

We have Wazuh standalone (no cluster) installed in Ubuntu to monitor around 25 agents.

A couple of months ago, we had an error when loading the website or when logging in, saying that the version of the App in the web browser does not correspond to the version installed in Kibana.

We have updated to the latest version 4.3.2, however it still seems to show version 4.2.5 for the App in the web browser.

Attached you will find the images of the error, and the versioning information.

We appreciate any help in correcting this problem.

Greetings.

[Mauricio Antonio Ceballos]

Hi julianda...@gmail.com

thanks for using Wazuh.

I will try to find the best solution with my team for the mismatched version issue between 4.3.2 and 4.2.5. and  I will try to write as soon as possible.

can you share with me the kibana version installed in your ubuntu?

Regard

[Julián Restrepo]

Hi!
Thank you for the response.

The Kibana version is 7.10.2

Regards!

[Mauricio Antonio Ceballos]

Hi julianda...@gmail.com

Are you using this docu to upgrade the version?

regards

[Julián Restrepo]

Hi, Mauricio,
Yeah, that guide was used to upgrade the version and troubleshoot.

Regards

[Mauricio Antonio Ceballos]

Hi julianda...@gmail.com

can you check the version you have in the "package,json" of the wazuh?

should be do
cat /usr/share/kibana/plugins/wazuh/package.json
the wazuh version on the package.json should be the same as the version displayed on the about module of the wazuh app.

if not, you can go to devtools on the browser and disable the cache and start again an incognito mode browser the wazuh app.

and check.

let me know if you can do it.

regards 

[Julián Restrepo]

Hello Mauricio,
Thank you for the reply. Please find below the screenshots about the versioning.

Also, we have tested disabling the cache and starting in incognito mode, also with new devices never connected, with no results.

We have also seen some errors displayed in the console, we will attach a screenshot of this as well.

Regards.

[Mauricio Antonio Ceballos]

Hi Julianda
after replacing the Wazuh plugin, you need to restart the Kibana service. Depeding on your service manager.

systemctl restart kibana
# or
 service kibana restart

please can you do this?

Could you share a screenshot of the Settings/About section of the Wazuh plugin? use the Wazuh menu to access to the Settings/About section

If you restarted the Kibana server after replacing the Wazuh plugin for Kibana. You don't have any reverse proxy or service that is serving the files of Kibana, then I think the problem is in the browser that is caching the files.It is required that you clean the files cache of your browser. You could try to follow the steps explained here: https://documentation.wazuh.com/current/user-manual/elasticsearch/troubleshooting.html#conflict-with-the-wazuh-app-version-error-is-displayed. If you don't clean the file cache of the browser, when accessing to Kibana, the browser could use the cached files instead to download the new files (related to the plugin of Wazuh 4.3.2)

The Disable cache option, in Chrome, only works if the browser dev tools is open. Did you refresh the page while the browser dev tools are open and you had the Disable cache option enabled? 

image.png 

regards!!

[Julián Restrepo]

Hi, Mauricio, thank you for the response
Yeah, the Kibana service had been restarted multiple times.

Also we have tried installing new browsers and accessing to the Wazuh, with the same error result... In this case the cache wouldn't be a problem because the new browser is supposed to be totally clean.

Regards!

[Mauricio Antonio Ceballos]

Hi Julianda

Are you using some reverse proxy or service that could be caching the files served by Kibana?

Regards!

[Julián Restrepo]

Hi Mauricio,

Sadly no. We're thinking maybe something is broken.

If we deploy another clean Wazuh on 4.3.2 and when all is running fine we configure the same IP that currently have the production Wazuh, all the agents will connect to the new Wazuh?

Regards and again, thank you for your help!