WAZUH agent status active but NO RESULTS

[Defence Technology]

Good day Team,

I'm facing an issue with Wazuh manager. There a total 5 wazuh agents installed. All agents

status were Active but there is no results on Security Events and Integrity.

I've installed All-in-one deployment in Ubuntu 18.04.

It was working fine but suddenly there's no event were hit. There is no changes were made on networks/hosts.

When I run "curl -XGET https://localhost:9200/_cluster/health?pretty=true"

                     "curl -XGET https://localhost:9200'

There's shows the error with certificates. I have followed the exact steps from https://documentation.wazuh.com/current/user-manual/certificates.html?highlight=certificates, but still no event were hit.

I will attach the screenshot of curl output.

Please assist on this issue since we have been facing this past few weeks. 

[elw...@wazuh.com]

Hello,

I am assuming that by there is no results on Security Events and Integrity you are referring to the Wazuh UI; We have the interest to check the following:

• Are you receiving alerts? tail -f /var/ossec/logs/alerts/alerts.json
  
• Are the agents active ? /var/ossec/bin/agent_control -l
  
• Is Filebeat reading and forwarding the alerts?  lsof /var/ossec/logs/alerts/alerts.json then filebeat test output
  
• The curl requires the user credentials and `-k` parameter if the certificate is self-signed (https://documentation.wazuh.com/current/installation-guide/open-distro/all-in-one-deployment/all-in-one.html#certificates-creation) curl -XGET -u wazuh:mypassword -k  https://localhost:9200/_cluster/health?pretty=true"
  

 
Regards,
Wali