The Wazuh server refuse to start

[Julien Bard]

Hi,
For no apparent reason and out of the blue, my Wazuh server just crashed and refused to restart. I tried to reinstall it : no luck. I tried to upgrade it : still no luck. I tried to restore the previous B/U : same result the following day.
I'm running out of ideas and I would greatly appreciate any help.
For information I use the v 4.14.2 on Ubuntu 24.04.4 LTS.

Thanks in advance.

[Md. Nazmur Sakib]

Hi Julien, The screenshot shows that wazuh-manager start never finished, so systemd hit its start timeout.


Stop the service.
sudo systemctl stop wazuh-manager

Run this command to check if all the processes stopped.
ps aux | grep -i wazuh

Next, run this command to start the service again.
sudo systemctl start wazuh-manager

Wait for a few minutes.


Once the service fails to start, share the output of these commands.

Share the logs of the Wazuh manager.

sudo cat /var/ossec/logs/ossec.log | grep -i -E "error|warn"

sudo journalctl -u wazuh-manager -n 200 --no-pager

Also check the disk space and memory

df -h

free -h

I look forward to your update.

[Julien Bard]

Hi M. Sakib,

Thank you for looking into it.

I stopped the manager but nothing really changed :

root@h40mswazuh2:/home/jbard# systemctl stop wazuh-manager
root@h40mswazuh2:/home/jbard# systemctl status wazuh-manager
× wazuh-manager.service - Wazuh manager
     Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; preset: enabled)
     Active: failed (Result: timeout) since Tue 2026-06-30 07:41:02 UTC; 3h 35min ago
    Process: 61289 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=killed, signal=TERM)
        CPU: 58.533s

juin 30 07:40:38 h40mswazuh2 env[61343]: 2026/06/30 07:40:38 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
juin 30 07:40:38 h40mswazuh2 env[61343]: 2026/06/30 07:40:38 wazuh-modulesd:inventory-harvester: INFO: Loaded Inventory harvester module.
juin 30 07:40:40 h40mswazuh2 env[61289]: Starting Wazuh v4.14.2...
juin 30 07:41:02 h40mswazuh2 systemd[1]: wazuh-manager.service: start operation timed out. Terminating.
juin 30 07:41:02 h40mswazuh2 systemd[1]: wazuh-manager.service: Failed with result 'timeout'.
juin 30 07:41:02 h40mswazuh2 systemd[1]: wazuh-manager.service: Unit process 61362 (wazuh-control) remains running after unit stopped.
juin 30 07:41:02 h40mswazuh2 systemd[1]: wazuh-manager.service: Unit process 61363 (wazuh-logtest-l) remains running after unit stopped.
juin 30 07:41:02 h40mswazuh2 systemd[1]: wazuh-manager.service: Unit process 61364 (grep) remains running after unit stopped.
juin 30 07:41:02 h40mswazuh2 systemd[1]: Failed to start wazuh-manager.service - Wazuh manager.
juin 30 07:41:02 h40mswazuh2 systemd[1]: wazuh-manager.service: Consumed 43.694s CPU time, 319.7M memory peak, 0B memory swap peak.

Then the next command :

root@h40mswazuh2:/home/jbard# ps aux | grep -i wazuh
wazuh-d+     955  0.2  1.4 11573156 242752 ?     Ssl  juin29   2:51 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist
wazuh-i+     956  8.5 49.7 77519788 8140088 ?    SLsl juin29 102:05 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -XX:+ShowCodeDetailsInExceptionMessages -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dio.netty.allocator.numDirectArenas=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.security.manager=allow -Djava.locale.providers=SPI,COMPAT -Xms4g -Xmx4g -XX:+UseG1GC -XX:G1ReservePercent=25 -XX:InitiatingHeapOccupancyPercent=30 -Djava.io.tmpdir=/tmp/opensearch-2806764677233292239 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/lib/wazuh-indexer -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m -Djava.security.manager=allow --add-modules=jdk.incubator.vector -Djava.util.concurrent.ForkJoinPool.common.threadFactory=org.opensearch.secure_sm.SecuredForkJoinWorkerThreadFactory -Dclk.tck=100 -Djdk.attach.allowAttachSelf=true -Djava.security.policy=file:///etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy --add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED -XX:MaxDirectMemorySize=2147483648 -Dopensearch.path.home=/usr/share/wazuh-indexer -Dopensearch.path.conf=/etc/wazuh-indexer -Dopensearch.distribution.type=deb -Dopensearch.bundled_jdk=true -cp /usr/share/wazuh-indexer/lib/* org.opensearch.bootstrap.OpenSearch -p /run/wazuh-indexer/wazuh-indexer.pid --quiet
root       74511  0.0  0.0   6544  2480 pts/1    S+   11:17   0:00 grep --color=auto -i wazuh

And the restart :

root@h40mswazuh2:/home/jbard# systemctl start wazuh-manager
Job for wazuh-manager.service failed because a timeout was exceeded.
See "systemctl status wazuh-manager.service" and "journalctl -xeu wazuh-manager.service" for details.

root@h40mswazuh2:/home/jbard# cat /var/ossec/logs/ossec.log | grep -i -E "error|warn"

[...]

2026/06/30 11:23:02 wazuh-authd: ERROR: Error querying Wazuh DB to get the agent's 7 information.
2026/06/30 11:23:02 wazuh-authd: WARNING: Duplicate name 'H40MSWEC', rejecting enrollment. Failed to get agent-info for agent '007'
2026/06/30 11:23:32 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'.
2026/06/30 11:23:32 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'.
2026/06/30 11:23:32 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'
2026/06/30 11:23:32 wazuh-authd: ERROR: Error querying Wazuh DB to get the agent's 6 information.
2026/06/30 11:23:32 wazuh-authd: WARNING: Duplicate name 'h40mswec2', rejecting enrollment. Failed to get agent-info for agent '006'
2026/06/30 11:23:47 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'.
2026/06/30 11:23:47 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'.
2026/06/30 11:23:47 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'
2026/06/30 11:23:47 wazuh-authd: ERROR: Error querying Wazuh DB to get the agent's 4 information.
2026/06/30 11:23:47 wazuh-authd: WARNING: Duplicate name 'h40dswec', rejecting enrollment. Failed to get agent-info for agent '004'
2026/06/30 11:24:18 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'.
2026/06/30 11:24:18 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'.
2026/06/30 11:24:18 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'
2026/06/30 11:24:18 wazuh-authd: ERROR: Error querying Wazuh DB to get the agent's 7 information.
2026/06/30 11:24:18 wazuh-authd: WARNING: Duplicate name 'H40MSWEC', rejecting enrollment. Failed to get agent-info for agent '007'
2026/06/30 11:24:47 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'.
2026/06/30 11:24:47 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'.
2026/06/30 11:24:47 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'
2026/06/30 11:24:47 wazuh-authd: ERROR: Error querying Wazuh DB to get the agent's 6 information.
2026/06/30 11:24:47 wazuh-authd: WARNING: Duplicate name 'h40mswec2', rejecting enrollment. Failed to get agent-info for agent '006'
2026/06/30 11:25:03 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'.
2026/06/30 11:25:03 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'.
2026/06/30 11:25:03 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'
2026/06/30 11:25:03 wazuh-authd: ERROR: Error querying Wazuh DB to get the agent's 4 information.
2026/06/30 11:25:03 wazuh-authd: WARNING: Duplicate name 'h40dswec', rejecting enrollment. Failed to get agent-info for agent '004'
2026/06/30 11:25:33 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'.
2026/06/30 11:25:33 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'.
2026/06/30 11:25:33 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'
2026/06/30 11:25:33 wazuh-authd: ERROR: Error querying Wazuh DB to get the agent's 7 information.
2026/06/30 11:25:33 wazuh-authd: WARNING: Duplicate name 'H40MSWEC', rejecting enrollment. Failed to get agent-info for agent '007'
2026/06/30 11:26:03 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'.
2026/06/30 11:26:03 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'.
2026/06/30 11:26:03 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'
2026/06/30 11:26:03 wazuh-authd: ERROR: Error querying Wazuh DB to get the agent's 6 information.
2026/06/30 11:26:03 wazuh-authd: WARNING: Duplicate name 'h40mswec2', rejecting enrollment. Failed to get agent-info for agent '006'
2026/06/30 11:26:18 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'.
2026/06/30 11:26:18 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'.
2026/06/30 11:26:18 wazuh-authd: ERROR: Unable to connect to socket 'queue/db/wdb'
2026/06/30 11:26:18 wazuh-authd: ERROR: Error querying Wazuh DB to get the agent's 4 information.
2026/06/30 11:26:18 wazuh-authd: WARNING: Duplicate name 'h40dswec', rejecting enrollment. Failed to get agent-info for agent '004'

Nothing showed up for the journalctl command. Plus memory and disk space are fine.