Wazuh-dashboard failing

[Gokul Suresh]

Hi team,

1.I am facing an issue starting wazuh-dashboard -

opensearch-dashboards[1356769]: Error: read ETIMEDOUT
 opensearch-dashboards[1356769]:     at TLSWrap.onStreamRead (node:internal/stream_base_commons:217:20)

 systemd[1]: wazuh-dashboard.service: Main process exited, code=exited, status=1/FAILURE
 systemd[1]: wazuh-dashboard.service: Failed with result 'exit-code'.
 systemd[1]: wazuh-dashboard.service: Consumed 1h 24min 57.847s CPU time.

Operating system - Ubuntu 22
version of Wazuh - 4.7
Deployment -  Distributed wazuh- dashboard and indexer on node 1
Memory, storage, cluster health  are all fine.

This issue is being faced quite often. I would like to know the root cause and fix for this issue.
I have been looking for this for a while but could not get a valid answer.

2. I would also like to know -  How to enable wazuh-dashboard logs or debug ?

[hasitha.u...@wazuh.com]

Hi Gokul,

Please check the resource usage of your environment indexer and dashboard instance.
df -h
free -h
top

Then share me the output of those commands.

Check Wazuh Indexer Status
Verify that the Wazuh indexer is running and healthy:
sudo systemctl status wazuh-indexer

If it’s not running, start it:
sudo systemctl restart wazuh-indexer

Check the indexer logs for errors:
cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn"

Test Connectivity Between Dashboard and Indexer
Since both services are on Node 1, test connectivity to the indexer (default port 9200):
curl -k -u <INDEXER_USERNAME>:<INDEXER_PASSWORD> https://localhost:9200

Replace <INDEXER_USERNAME> and <INDEXER_PASSWORD> with your credentials (e.g., admin and its password). If this fails or times out, there’s a connectivity or indexer issue.

Review Wazuh Dashboard Configuration
Open the dashboard configuration file:
sudo nano /etc/wazuh-dashboard/opensearch_dashboards.yml

Ensure opensearch.hosts points to the correct indexer address (e.g., https://IndexerIP:9200 since they’re on the same node) and that SSL settings (certificates, verification mode) are correct.
Example:
opensearch.hosts: ["https://indexerIP:9200"]
opensearch.ssl.verificationMode: certificate
opensearch.username: "kibanaserver"
opensearch.password: "<your_password>"

Check Dashboard Logs for More Details
Look at the systemd logs for additional context:
journalctl -u wazuh-dashboard
cat /usr/share/wazuh-dashboard/data/wazuh/logs/wazuhapp.log

Let me know the update on this.

Regards,
Hasitha Upekshitha