Upgraded wazuh 4.7.5 to 4.8 and broke dashboard

[Jeremy Sellars]

INFO: No current API selected INFO: Getting API hosts... INFO: API hosts found: 1 INFO: Checking API host id [default]... INFO: Could not connect to API id [default]: 3099 - ERROR3099 - Wazuh not ready yet INFO: Removed [navigate] cookie ERROR: No API available to connect

no errors in any logs, just a dead API.

wazuh was running the canned version in linode, 4.7.5 i upgraded it to 4.8 and the dashboard stopped.

any advice would be greatly appreciated.

ironically everything is still working as im getting alerts emailed to me, just cant use the dashboard.

[Stuti Gupta]

Hi Jeremy Sellars,

Could you please verify that the configuration file `/etc/wazuh-dashboard/opensearch_dashboards.yml` has been updated with the following setting:
uiSettings.overrides.defaultRoute: /app/wz-home
https://documentation.wazuh.com/current/upgrade-guide/troubleshooting.html

If this setting has been updated, please follow these steps:

1. Clear the browser cache.
2. Restart the Wazuh Manager and Wazuh Indexer using the following commands:
systemctl restart wazuh-indexer
systemctl restart wazuh-manager
3. Try to log in again.

If the issue persists, please check the error in the API log and wazuh-indexer by running:
cat /var/ossec/logs/api.log

Hope to hear from you soon

[Jeremy Sellars]

ok made the change you mentioned. it broke the manager service, i have since got it going again, the line is there that you stated earlier. now im getting a indexer error. 

Jun 17 14:14:50****************** opensearch-dashboards[19508]: {"type":"log","@timestamp":"2024-06-17T14:14:50Z","tags":["error","opensearch","data"],"pid":19508,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}
Jun 17 14:14:52******************  opensearch-dashboards[19508]: {"type":"log","@timestamp":"2024-06-17T14:14:52Z","tags":["error","opensearch","data"],"pid":19508,"message":"[ConnectionError]: connect ECONNREFUSED ::1:9200"}

So Now it seems as if it cannot connect to opensearch. I have verified opensearch is running and listening on port 9200. open search runs on the same node. this is a single node unit.

[Stuti Gupta]

Please check the status of the wazuh-indexer and make sure it is active:
systemctl status wazuh-indexer

Also, check indexer logs for any error or warning:
cat /var/log/wazuh-indexer/wazuh-cluster.log

As you mentioned making the changes manually, please ensure you carefully follow all the steps to upgrade Wazuh from 4.7.5 to 4.8 as outlined here: (https://documentation.wazuh.com/current/upgrade-guide/upgrading-central-components.html).

Hope to hear from you soon