Wazuh upgrade from 4.7.5 to 4.11 failed

[Mr VR]

Hi Team,

I had recently tried to update wazuh from 4.7.5 to 4.11. The upgrade have failed.

I have attached the snapshot for your reference.

Request you to resolve the issue at the earliest.

Regards,

Vignesh

[Peter Santiago]

Adjust heap value to preferably half your system memory in  jvm.options file under the /etc/wazuh-indexer directory

--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/77f6f289-bf2a-46d2-a374-a18f62254a18n%40googlegroups.com.

[hasitha.u...@wazuh.com]

Hi Mr VR

Could you please confirm that you have followed all the steps in the upgrade guide correctly? While you address any issues raised?
Ref: https://documentation.wazuh.com/current/upgrade-guide/upgrading-central-components.html

Make sure that Wazuh manager and dashboard are up and running.
Wazuh manager status: systemctl status wazuh-manager -l
Wazuh dashboard status: systemctl status wazuh-dashboard -l

Try restarting the indexer again.
systemctl restart wazuh-indexer

If the indexer failed to start again, share the indexer logs to check further.
cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn"

Check all the components have been upgraded properly by checking the curentl versions.
Run the following commands on all Wazuh services to check the current version of the Wazuh services:
yum list installed wazuh-indexer
yum list installed wazuh-manager
yum list installed wazuh-dashboard
OR
apt list --installed wazuh-indexer
apt list --installed wazuh-manager
apt list --installed wazuh-dashboard

Let me know the update on this.

Regards,
Hasitha Upekshitha

[Mr VR]

Hi Team,

I'm receiving below error:

Request you to fix the issue at the earliest.

Regards,

Vignesh

[Mr VR]

Hi Team,

curl command also not working in from the provided above link wazuh

Regards,

Vignesh

[Mr VR]

Hi Team,

The dashboards are not running. exited code=1

Regards,

Vignesh

[hasitha.u...@wazuh.com]

Hi Mr VR

The main problem is that the Wazuh Indexer doesn't have enough Java heap memory, which is causing it to crash with "OutOfMemoryError." On top of that, the system is spending too much time on GC, taking too long to update the cluster state, and may also have issues with how shards are set up. All these things together are putting extra stress on the system.  

Could you please increase the the RAM and configure the heap memory accordingly.

Please start by checking your memory with and also share the output
free -h

Then, update the heap size in the /etc/wazuh-indexer/jvm.options file. For example, if your server has 16 GB of RAM, set the heap size to 8 GB as shown below:
-Xms8g
-Xmx8g
Here are some key points to keep in mind to configure heap memory:
Use no more than 50% of your available RAM.
Don’t set the heap size over 32 GB.
After making these changes, restart the Wazuh indexer for them to take effect:
systemctl restart wazuh-indexer
You can refer to this link for more details:
https://documentation.wazuh.com/current/user-manual/wazuh-indexer/wazuh-indexer-tuning.html#memory-locking

Let me know the update on this.

Regards,
Hasitha Upekshitha

[Mr VR]

Hi Team,

Regards,

Vignesh

[hasitha.u...@wazuh.com]

Hi Mr VR The issue with the Wazuh Indexer service failing is due to a "Java heap space" OutOfMemoryError, as seen in the systemctl status wazuh-indexer output. This indicates that the Java Virtual Machine (JVM) running the Wazuh Indexer does not have enough memory allocated. The free -h output shows 30Gi of total memory with 29Gi available, suggesting sufficient RAM, but the heap size configuration needs adjustment.

To resolve this:

1. Edit the /etc/wazuh-indexer/jvm.options file.
2. Set the heap size to approximately 50% of your available RAM. With 30Gi total and 29Gi available, a safe value would be around 14-15Gi. Update the lines to:
   -Xms14g -Xmx14g
   (Make sure the value does not exceed 32Gi and stays within 50% of total RAM.)
3. Save the file and restart the Wazuh Indexer service:
   systemctl restart wazuh-indexer
4. Verify the service status:
   systemctl status wazuh-indexer

If the issue persists, please share the latest cluster logs to check further.   cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn"

Let me know the update on this.

Regards,
Hasitha Upekshitha

[Mr VR]

Hi Team,

The issue has been resolved.

Thanks a lot for your support.

Regards,

Vignesh

[hasitha.u...@wazuh.com]

Hi Mr VR

I am glad that your issue has been resolved.

Regards,
Hasitha Upekshitha