Wazuh Indexer Service Fails

[Monwabisi Sithaba]

Hi Guys 

Please can you assist I am installing Wazuh on Ubuntu and installing the components separately. 

After going through all the steps in the documentation installing the wazuh indexer, when I run the command systemctl start command I get the following error 

"Job for wazuh-indexer.service failed because the control process exited with error code.
See "systemctl status wazuh-indexer.service" and "journalctl -xeu wazuh-indexer.service" for details."

When I run thesystemctl status wazuh-indexer.service 

"× wazuh-indexer.service - Wazuh-indexer
     Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Fri 2023-04-14 13:47:49 UTC; 14min ago
       Docs: https://documentation.wazuh.com
    Process: 1789 ExecStart=/usr/share/wazuh-indexer/bin/systemd-entrypoint -p ${PID_DIR}/wazuh-indexer.pid --quiet (code=exited, status=1/FAILURE)
   Main PID: 1789 (code=exited, status=1/FAILURE)"

The config.yml and and opensearch files are configured with IP address 

[Pablo Ariel Gonzalez]

Hello msithaba, we will review your inquiry.

I understand that you are trying to install the Wazuh components on separate servers and you have started by installing Wazuh Indexer. Could you please confirm if you have used the assisted installation documentation or the step by step to do this?

Also, it would be very helpful if you could share the command you used to install Wazuh Indexer and the output of the following commands to see the logs of the process.

journalctl -xeu wazuh-indexer.service; cat /var/ossec/logs/ossec.log

Please remember to verify that the information you send us does not contain private information or access keys to your environment.

Thanks,

[Pablo Ariel Gonzalez]

Hi Msithaba, did you see my comment above?. Is there anything else we can help you with?

Thanks,

[Loyiso Nicholus Gawula]

hi All having the same error.

journalctl -xeu wazuh-indexer.service; cat /var/ossec/logs/ossec.log

Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at java.base/java.nio.file.Files.createFile(Files.java:658)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.env.NodeEnvironment.tryWriteTempFile(NodeEnvironment.java:1302)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.env.NodeEnvironment.assertCanWrite(NodeEnvironment.java:1268)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.env.NodeEnvironment.<init>(NodeEnvironment.java:355)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.node.Node.<init>(Node.java:464)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.node.Node.<init>(Node.java:361)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:242)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:242)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:404)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:180)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.bootstrap.OpenSearch.execute(OpenSearch.java:171)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:104)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.cli.Command.main(Command.java:101)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:137)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:103)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: For complete error details, refer to the log at /var/log/wazuh-indexer/wazuh-cluster.lo
lines 391-407/407 (END)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at java.base/java.nio.file.Files.createFile(Files.java:658)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.env.NodeEnvironment.tryWriteTempFile(NodeEnvironment.java:1302)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.env.NodeEnvironment.assertCanWrite(NodeEnvironment.java:1268)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.env.NodeEnvironment.<init>(NodeEnvironment.java:355)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.node.Node.<init>(Node.java:464)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.node.Node.<init>(Node.java:361)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:242)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:242)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:404)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:180)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.bootstrap.OpenSearch.execute(OpenSearch.java:171)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:104)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.cli.Command.main(Command.java:101)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:137)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:103)
Nov 06 09:16:05 wazuh-server systemd-entrypoint[848]: For complete error details, refer to the log at /var/log/wazuh-indexer/wazuh-cluster.log