any custom rules break Docker Compose deployment.
306 views
Skip to first unread message
Remi Springer
Mar 1, 2023, 5:18:44 PM3/1/23
to Wazuh mailing list
Good Afternoon Friends.I'm attempting to set up Wazuh in Docker Compose in the multi-node setup. But I'm having some issues when I import any file to /var/ossec/etc/rules in my docker compose.I've pasted my compose file below:
When the compose file has the rules copy line (34 and 68) commented out everything works great.
When the rules copy on line 34 and 68 is in the file and not commented out. I get the error. ERROR in ossec.conf: Could not open file '/var/ossec/etc/shared/ar.conf' due to [(2)-(No such file or directory)]. I believe this rules out any ossec.conf misconfiguration, despite the text on the error.
When the ar.conf file is also copied in the same error applies.(line 39)
I have read far and wide regarding ar.conf, merged.conf, and agent.conf. I can't find a solution to this. But heres some of the thing I've tried.
Built my stack using the default wazuh_manager.conf file (which as far as I can tell becomes ossec.conf on the master node.)
Removed all files from the copied directory -- this allows it to boot. But one or more files immediately break it.
So TLDR for some reason if any files are put in /var/ossec/etc/rules the API fail to stand up.I am able to get to the dashboard Has anyone seen this before?I also have some follow up questions:
1. Where is ar.conf referenced on the managing server? I can't find it in any of my rules. It's not in ossec.conf, I'm not sure. I can't find it anywhere within the setup files of the server as well.
2. Why is ar.conf only being queried with the existance of ANY file in /var/ossec/etc/rules
3. Is there a different way I should be deploying my rules during up the standup of a new cluster
When the compose file has the rules copy line (34 and 68) commented out everything works great.
When the rules copy on line 34 and 68 is in the file and not commented out. I get the error. ERROR in ossec.conf: Could not open file '/var/ossec/etc/shared/ar.conf' due to [(2)-(No such file or directory)]. I believe this rules out any ossec.conf misconfiguration, despite the text on the error.
When the ar.conf file is also copied in the same error applies.(line 39)
I have read far and wide regarding ar.conf, merged.conf, and agent.conf. I can't find a solution to this. But heres some of the thing I've tried.
Built my stack using the default wazuh_manager.conf file (which as far as I can tell becomes ossec.conf on the master node.)
Removed all files from the copied directory -- this allows it to boot. But one or more files immediately break it.
So TLDR for some reason if any files are put in /var/ossec/etc/rules the API fail to stand up.I am able to get to the dashboard Has anyone seen this before?I also have some follow up questions:
1. Where is ar.conf referenced on the managing server? I can't find it in any of my rules. It's not in ossec.conf, I'm not sure. I can't find it anywhere within the setup files of the server as well.
2. Why is ar.conf only being queried with the existance of ANY file in /var/ossec/etc/rules
3. Is there a different way I should be deploying my rules during up the standup of a new cluster
Remi Springer
Mar 8, 2023, 11:16:30 AM3/8/23
to Wazuh mailing list
Poking this thread.
Carlos Ezequiel Bordon
Mar 9, 2023, 7:50:28 AM3/9/23
to Wazuh mailing list
Hello
For the execution of the wazuh/wazuh-manager image, in the case of wanting to mount a directory to maintain persistence, you should mount a Docker volume, as in the other directories that persist in the deployment:
You will have to declare that volume with all the volumes you have at the end of docker-compose.yml
- /home/ubuntu20/ts-docker-01-git/stack-wazuh-01/config/wazuh_cluster/ar.conf:/wazuh-config-mount/etc/shared/ar.conf
For the execution of the wazuh/wazuh-manager image, in the case of wanting to mount a directory to maintain persistence, you should mount a Docker volume, as in the other directories that persist in the deployment:
- worker-wazuh-api-configuration:/var/ossec/api/configuration
About mounting a file, inside the entrypoint there is a function that copies everything you mount inside the /wazuh-config-mount/ directory to the /var/ossec/ directory, so as not to generate file permission problems when mounting, an example This is the mounting of the ossec.conf file:
- /home/ubuntu20/ts-docker-01-git/stack-wazuh-01/config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
In the case of the ar.conf file, line 40 could look like this:
Reply all
Reply to author
Forward
0 new messages