Wazuh dashboard server is not ready yet

[Funto Oladipupo]

Hi everyone, 

Initially, I was tasked to collect firewall logs to a syslog server which then forwards the logs to wazuh manager. 

So a new network interface was setup in the same azure vm server wazuh manaer is being hosted .(I have asked about this kind of setup on the group before and was told it would work out.) 

However, since the new NIC has been setup I have been unable to access wazuh web UI and right now the new NIC has been deleted by the sys admin and still same error on wazuh web UI. Meanwhile all services like filebeat, kibana, elasticsearch and wazuh-manager are running. So, please I need some clarification on what I might be missing that is causing the web UI not to come up. I'd really appreciate.

[Lucio Donda]

Hi funtosam (hope I get the name right), Thanks for using wazuh.
I'm trying to understand your issue, as Javier answered here you have configured everything in the same azure (ubuntu) VM server (manager and syslog server -rsyslog-) but once you have changed the network interface you couldn't access the wazuh UI. Not even when you have undone that Network Interface change, right?
I'll need some extra info, like:

•  which version of wazuh are you using.
  
• Is filebeat, kibana and elastic on the same ubuntu VM?
• Were you able to collect some logs on /var/ossec/log/ossec.log ?
  
• when you say that you were unable to access wazuh web UI, which error are you seeing? here's a simple check in order to see if the API is down.

With that info I hope that we could get a better picture on what's causing this issue. 

[Funto Oladipupo]

Hi Lucio

I haven't configured the syslog server in the same vm as wazuh manager. I was to do that not until wazuh web interface stopped responding with the prompt "Wazuh dashboard server is not ready yet".

However,  as of 2 hours ago, wazuh web interface wasn't running and all of wazuh services were running except wazuh-indexer. But as of now, wazuh-indexer is running and the web interface is responding but with a different interface than I used to interact with and my login details aren't working. 

I am using wazuh version 4.26 and yes filebeat, kibana and elastic is running on the same vm.

I am able to collect ossec logs and what I mean by I am unable to access wazuh web UI is I keep getting Wazuh dashboard server is not ready yet when I try to log in with my designated ip.

For the wazuh-indexer not working and web interface unresponsive, I asked my infrastructure admin to increase the disk space for the ubuntu vm wazuh is hosted on and I guess that was the problem all along.

My question now is:

1. How do I get or set login details so I can access wazuh dashboard? Or is there a way to list wazuh users and their password just like it was listed after setting up an unattended installation?

2. Is the new 60gb memory allocation for the vm enough and what do you recommend so an issue like this doesn't reoccur, because wazuh will be used to monitor quite a lot of servers, laptops, router and firewall.

3.The new network interface has been deleted, so do you recommend setting it up again or using the same vm and ip wazuh is using, to install and setup a syslog server so as to collect fortigate firewall logs to the syslog server and then forward them to wazuh manager. Will this work out please?

I'm really sorry my questions are quite much. Just trying to avoid further issues along the way. 

Thank you and Best regards.

[Lucio Donda]

Hi Funto,
There's something strange in what you're telling me, From version 4.3 we have wazuh-dashboard and wazuh-indexer, before that there was elasticSearch, filebeat and kibana. You can check the version of your Wazuh installation using:
/var/ossec/bin/wazuh-control -j info
And if the version of Wazuh is lower than 4.2 you could check the version in the /etc/ossec-init.conf file.
Have you upgraded the system recently?

Regarding questions:
1- If you're using the wzuh dashboard, you may find some info for setting users and roles. If not then you could modify kibana users from here
2- Always be aware of space requirements (quote: For example, for an environment with 80 workstations, 10 servers, and 10 network devices, the storage needed on the Wazuh server for 90 days of alerts is 6 GB.)
Besides that, the VM for testing purposes has 50Gb with these characteristics and here you may find space requirements depending on agents (bellow 25 agents you will be ok with 50Gb).
3- Regarding this point, I'll confirm what Javier answer to you previously but always analyze the hardware requirements stated above.

Hope this helps.

Have a great day!

[Funto Oladipupo]

Hello Lucio,

The wazuh installation is version 4.2.7. 

Regarding questions,

1. I had to uninstall and reinstall wazuh as changing user's passwords didn't work out as instructed here. Everything is working out fine now.

2. Your notice on space requirements is duly acknowledged. Thank you for the clarification.

3. Configuring rsyslog and wazuh in the same vm is a bit more complicated than I assumed but it is not something to bother the wazuh team with as it is more related to network configurations and rsyslog limitations.

I really appreciate your prompt response and sorry about my late reply.

Best regards.

[Lucio Donda]

Awesome!
Glad to be helpful! if there's anything else we could do please do not hesitate on writing us.
Have a great day!