error

[stetnt4]

Wazuh dashboard server is not ready yet

[stetnt4]

пятница, 15 сентября 2023 г. в 17:20:05 UTC+3, stetnt4:

[stetnt4]

пятница, 15 сентября 2023 г. в 17:41:59 UTC+3, stetnt4:

[Olusegun Adenrele Oyebo]

Hello,

Thank you for using Wazuh.

What changes did you make on your Wazuh environment before encountering this error?

Kindly run the below commands on your Wazuh components and revert with the output:

• journalctl -u wazuh-dashboard
• journalctl -u wazuh-indexer
• cat /var/log/filebeat/filebeat | grep -i -E "error|warn"
• cat /var/ossec/logs/ossec.log | grep -i -E "error|warn"
• cat /usr/share/wazuh-dashboard/data/wazuh/logs/wazuhapp.log | grep -i -E "error|warn"

Can you also run the below commands on your Wazuh components to restart the services and check if that resolves the issue

• systemctl restart wazuh-indexer
• systemctl restart wazuh-manager
• systemctl restart filebeat
• systemctl restart wazuh-dashboard.

You can also check the link on more troubleshooting steps for your perusal.

Will be expecting your feedback so as to assist you further.

Best regards

[stetnt4]

пятница, 15 сентября 2023 г. в 18:35:07 UTC+3, Olusegun Adenrele Oyebo:

[Olusegun Adenrele Oyebo]

Hello,

Thank you for your response.

It seems some of the logs/information requested are missing:

• Was there any change(s) made in your environment prior to this error?
• The output of journalctl -u wazuh-dashboard
• The output of journalctl -u wazuh-indexer

Did you also try to restart the services as advised? I can see that the Wazuh indexer service failed to start and also kindly run the command below to do a filebeat test:

• filebeat test output

Kindly run the commands below to check for resource utilization on your Wazuh server:

• df -h (free disk space)
• top (memory and CPU utilization)

What version of Wazuh are you running and What is your current architecture? All-in-one or distributed.

Will be expecting your feedback so as to assist you further.

Best regards.

[stetnt4]

Hello!All-in-one installation

суббота, 16 сентября 2023 г. в 18:48:38 UTC+3, Olusegun Adenrele Oyebo:

[Olusegun Adenrele Oyebo]

Hello,

Thanks for your response.

What steps did you follow to install your Wazuh central components? We have an official documentation on step by step installation and also a Quickstart that guides on the installation steps. Kindly confirm that was what you used as guide.

I can see that there seems to be some certificate related issues from your filebeat test output you shared "Error x509: certificate signed by unknown authority". Can you confirm that you have the wazuh server certificates in the directory /etc/filebeat/certs/ and also confirm that they have the Wazuh server node certificate name as specified in the config.yml when you were creating the certificates. Here is a section that describes how to deploy the certificates to the filebeat directory. You can also check this link on more information on how to create and deploy certificates.

Also from the Wazuh indexer logs you shared, there is this line "exception in thread main settingsexception failed to load settings from opensearch.yml". This error could be as a result of a misconfiguration in your /etc/wazuh-indexer/opensearch.yml file. Can you review it again and make sure that all configurations are in place. You can use this guide which should assist you on the necessary configurations to make in the file.

I hope this was helpful. Do not hesitate to get back to us again if you're still facing the issue or you have any other query.

[stetnt4]

Hello!Looks like I made a mistake with the certificates

воскресенье, 17 сентября 2023 г. в 16:58:21 UTC+3, Olusegun Adenrele Oyebo:

[stetnt4]

I redid the certificates, but filebeat does not connect to elasticsearch, Failed to connect to backoff(elasticsearch(https://127.0.0.1:9200)).wazuh-indexer does not start

воскресенье, 17 сентября 2023 г. в 17:51:12 UTC+3, stetnt4:

[stetnt4]

воскресенье, 17 сентября 2023 г. в 18:52:03 UTC+3, stetnt4:

[stetnt4]

понедельник, 18 сентября 2023 г. в 10:55:25 UTC+3, stetnt4:

[Olusegun Adenrele Oyebo]

Hello,

It seems there actually is some certificate related issue with your filebeat. Kindly confirm that your filebeat config file /etc/filebeat/filebeat.yml has the paths to where the filebeat certificate files are and also you have the necessary certificate files in the directory when you run the command ls -al /etc/filebeat/certs/. Screenshots are attached for your reference and guide.

Also the guide gives more insight on how to go about it. You can also check the deploying certificates section.

I can see that you shared the service status for both Wazuh indexer and elasticsearch. Are you running both on one server?

Let us know the feedback after verifying and in case you'll need any other help.

Best regards.

[stetnt4]

Thank you! I already figured it out

четверг, 21 сентября 2023 г. в 13:36:21 UTC+3, Olusegun Adenrele Oyebo:

[Olusegun Adenrele Oyebo]

Hello,

I trust you're doing well.

This is good news. It will also be nice if you're able to revert back to us how you were able to resolve the issue.

Will be expecting your feedback. In case you need any other assistance going forward, do not hesitate to reach out.

Best regards.