Issue loading Endpoints "Stats" page

[Gokul Suresh]

Hi Team,

I’m facing an issue where I’m unable to access the “Stats” page for some agents, while at the same time I can access the stats page for other agents.

The environment is Wazuh version 4.10.1.

Could you please help investigate this issue?

[Marc Christian Pernesita Gregorio]

Hi Gokul,

Based on the screenshot you shared, it seems like a connection timeout issue. If not, it could also be related to an internal error.

First, let’s confirm that the core components are running properly. Have you tried restarting the Wazuh services?

We can also check whether the agents are connected to the Wazuh manager. Please run the following command:

/var/ossec/bin/agent_control -l    #This will list all registered agents and show their connection status. 

https://documentation.wazuh.com/current/user-manual/reference/tools/agent-control.html#agent-control

Could you also share the API, manager, and dashboard logs? You can look for errors using:

grep -ie "error" /var/ossec/logs/api.log 

grep -ie "error" /var/ossec/logs/ossec.log 

grep -ie "error" /var/log/opensearch_dashboards/opensearch_dashboards.log

Please also check for any timeout-related errors in those logs.

If we confirm that this is a connection timeout issue, we can increase the API timeout in:

/var/ossec/api/configuration/api.yaml

Update the request_timeout value to increase the maximum API response time. 

https://documentation.wazuh.com/current/user-manual/api/getting-started.html#understanding-the-wazuh-server-api-request-and-response

It would also be good to increase the dashboard timeout from 20000 ms to 60000 ms (or higher if needed). This setting can be found in:

/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml

https://documentation.wazuh.com/current/user-manual/wazuh-dashboard/settings.html#timeout

Let us know what you find in the logs so we can proceed accordingly.

Thanks!

[Marc Christian Pernesita Gregorio]

Hi Gokul,

My apologies. Here is the correct documentation link for configuring the maximum API response time:
https://documentation.wazuh.com/current/user-manual/api/configuration.html#intervals

Also, you can check the dashboard logs using the following commands:

journalctl -u wazuh-dashboard
cat /usr/share/wazuh-dashboard/data/wazuh/logs/wazuhapp.log | grep -i -E "error|warn"

For live troubleshooting, you can add <debug>2</debug> under the <logging> section in /var/ossec/etc/ossec.conf, then restart the wazuh-manager service. After that, you can monitor the API log in real time to help identify the issue:

tail -f /var/ossec/logs/api.log

lastly, are you experiencing this issue with multiple agents or just one?

Thanks!

[Gokul Suresh]

Hi Marc ,
Thanks for your response.
I do not believe this is a timeout issue.
The “Stats” page is functioning correctly for all agents except one or two. The error appears immediately when I click on the Stats page for those agents.
All agents are running the same version, and their operating systems are similar (Ubuntu 24.x versions).

[Marc Christian Pernesita Gregorio]

Hi Gokul,

Thank you for confirming the number of agents affected.

Since this is happening to only one or two agents, it’s less likely to be a timeout issue. Could you please verify the agent’s connection status from the manager using:

/var/ossec/bin/agent_control -i <agent_id>

Also, from the dashboard host, can you try querying the API stats for the affected agent directly?

curl -u <user>:<pass> -k -X GET "https://<manager_ip>:55000/agents/<agent_id>/stats/logcollector?pretty=true"

Let’s check if this returns a 500 error.

https://documentation.wazuh.com/current/user-manual/api/reference.html#tag/Agents/operation/api.controllers.agent_controller.get_component_stats

It would also help if you monitor the logs while running the command or while accessing the agent stats from the dashboard:

tail -f /var/ossec/logs/ossec.log /var/ossec/logs/api.log

Please share the results from the logs so we can get more context and determine the next steps.

Thanks!