wazuh 4.8.1 dashboard error

[leon appel]

Hi 

I returned to office to find wazuh 4.8.1 dashboard has errors as below

I have updated the memory values xms6g and xmx6g /etc/wazuh-indexer/jvm.options as per article without improvement even after a reboot. This is running on ubuntu 22.04.

The wazuh-manager dont show errors however I get the following error on the wazuh-dashboard

● wazuh-dashboard.service - wazuh-dashboard
     Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2024-09-09 13:06:57 BST; 37min ago
   Main PID: 933 (node)
      Tasks: 11 (limit: 18984)
     Memory: 315.1M
        CPU: 29.237s
     CGroup: /system.slice/wazuh-dashboard.service
             └─933 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist

Sep 09 13:44:17 WAZUH opensearch-dashboards[933]: {"type":"log","@timestamp":"2024-09-09T12:44:17Z","tags":["error","opensearch","data"],"pid":933,"message":"[circuit_breaking_exception]: [parent] Data too large, data for [<http_request>] would be [1021126280/973.8mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1021126280/973.8mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=235548/230kb, in_flight_requests=0/0b]"}
Sep 09 13:44:19 WAZUH opensearch-dashboards[933]: {"type":"log","@timestamp":"2024-09-09T12:44:19Z","tags":["error","opensearch","data"],"pid":933,"message":"[circuit_breaking_exception]: [parent] Data too large, data for [<http_request>] would be [1037730184/989.6mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1037730184/989.6mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=235548/230kb, in_flight_requests=0/0b]"}
Sep 09 13:44:22 WAZUH opensearch-dashboards[933]: {"type":"log","@timestamp":"2024-09-09T12:44:22Z","tags":["error","opensearch","data"],"pid":933,"message":"[circuit_breaking_exception]: [parent] Data too large, data for [<http_request>] would be [1047167368/998.6mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1047167368/998.6mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=235548/230kb, in_flight_requests=0/0b]"}
Sep 09 13:44:24 WAZUH opensearch-dashboards[933]: {"type":"log","@timestamp":"2024-09-09T12:44:24Z","tags":["error","opensearch","data"],"pid":933,"message":"[circuit_breaking_exception]: [parent] Data too large, data for [<http_request>] would be [1032346184/984.5mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1032346184/984.5mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=235548/230kb, in_flight_requests=0/0b]"}
Sep 09 13:44:27 WAZUH opensearch-dashboards[933]: {"type":"log","@timestamp":"2024-09-09T12:44:27Z","tags":["error","opensearch","data"],"pid":933,"message":"[circuit_breaking_exception]: [parent] Data too large, data for [<http_request>] would be [1034443336/986.5mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1034443336/986.5mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=235548/230kb, in_flight_requests=0/0b]"}
Sep 09 13:44:34 WAZUH opensearch-dashboards[933]: {"type":"log","@timestamp":"2024-09-09T12:44:34Z","tags":["error","opensearch","data"],"pid":933,"message":"[circuit_breaking_exception]: [parent] Data too large, data for [<http_request>] would be [1037861288/989.7mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1037861288/989.7mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=235548/230kb, in_flight_requests=0/0b]"}
Sep 09 13:44:34 WAZUH opensearch-dashboards[933]: {"type":"log","@timestamp":"2024-09-09T12:44:34Z","tags":["error","savedobjects-service"],"pid":933,"message":"Unable to retrieve version information from OpenSearch nodes."}
Sep 09 13:44:39 WAZUH opensearch-dashboards[933]: {"type":"log","@timestamp":"2024-09-09T12:44:39Z","tags":["error","opensearch","data"],"pid":933,"message":"[circuit_breaking_exception]: [parent] Data too large, data for [<http_request>] would be [1020351096/973mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1020351096/973mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=235548/230kb, in_flight_requests=0/0b]"}
Sep 09 13:44:39 WAZUH opensearch-dashboards[933]: {"type":"log","@timestamp":"2024-09-09T12:44:39Z","tags":["error","savedobjects-service"],"pid":933,"message":"Unable to retrieve version information from OpenSearch nodes."}
Sep 09 13:44:42 WAZUH opensearch-dashboards[933]: {"type":"log","@timestamp":"2024-09-09T12:44:42Z","tags":["error","opensearch","data"],"pid":933,"message":"[circuit_breaking_exception]: [parent] Data too large, data for [<http_request>] would be [1021399672/974mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1021399672/974mb], new bytes reserved: [0/0b], usages [request=0/0b, fielddata=235548/230kb, in_flight_requests=0/0b]"}

Thanks in advance

[leon appel]

The Indexer is also a bit unwell

root@WAZUH:~# systemctl status wazuh-indexer
× wazuh-indexer.service - Wazuh-indexer
     Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
    Drop-In: /etc/systemd/system/wazuh-indexer.service.d
             └─wazuh-indexer.conf
     Active: failed (Result: exit-code) since Mon 2024-09-09 14:37:36 BST; 17s ago
       Docs: https://documentation.wazuh.com
    Process: 8597 ExecStart=/usr/share/wazuh-indexer/bin/systemd-entrypoint -p ${PID_DIR}/wazuh-indexer.pid --quiet (code=exited, status=1/FAILURE)
   Main PID: 8597 (code=exited, status=1/FAILURE)
        CPU: 5.742s

Sep 09 14:37:36 WAZUH systemd-entrypoint[8597]:         at org.opensearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:104)
Sep 09 14:37:36 WAZUH systemd-entrypoint[8597]:         at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
Sep 09 14:37:36 WAZUH systemd-entrypoint[8597]:         at org.opensearch.cli.Command.main(Command.java:101)
Sep 09 14:37:36 WAZUH systemd-entrypoint[8597]:         at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:137)
Sep 09 14:37:36 WAZUH systemd-entrypoint[8597]:         at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:103)
Sep 09 14:37:36 WAZUH systemd-entrypoint[8597]: For complete error details, refer to the log at /var/log/wazuh-indexer/wazuh-cluster.log
Sep 09 14:37:36 WAZUH systemd[1]: wazuh-indexer.service: Main process exited, code=exited, status=1/FAILURE
Sep 09 14:37:36 WAZUH systemd[1]: wazuh-indexer.service: Failed with result 'exit-code'.
Sep 09 14:37:36 WAZUH systemd[1]: Failed to start Wazuh-indexer.
Sep 09 14:37:36 WAZUH systemd[1]: wazuh-indexer.service: Consumed 5.742s CPU time.

[Samson Olugbenga Idowu]

Hello Leon,

Thank you fornchoosing Wazuh.
I have read through your logs and I can see that Wazuh indexer service has failed.
Please try to restart the service using sudo systemctl restart wazuh-indexer. This should make your dashboard service connect. Also, go to the dashboard url on a new browser tab. If the Wazuh indexer service fails to start, please share the error logs.
Also, are you running a single node or multi-node cluster?

Regards,
Samson.

[leon appel]

Hi Samson

I have upgraded to version 4.9 to try and overcome the issues however I have some new issues which I raised in another conversation Wazuh 4.9 dashboard errors (google.com) 

Many Thanks

Leon

[leon appel]

Hi

The issues is now resolved by updating the proxy config /etc/systemd/system/multi-user.target.wants/wazuh-manager.service and removing it from the OS. In version 4.8 I had to place it in the OS

    [Service] 

    Type=forking 

    EnvironmentFile=/etc/ossec-init.conf 

    Environment="https_proxy=http://<proxy_IP:port>" 

    Environment="http_proxy="http://<proxy_IP:port>" 

    LimitNOFILE=65536

Thanks

Leon

[Samson Olugbenga Idowu]

Hi Leon,

I am glad your issue is resolved.
Thank you for choosing Wazuh.

Regards,
Samson.