ERROR3099 - Some Wazuh daemons are not ready yet in node "wazuh-manager-master" (wazuh-modulesd->failed)

[Chris Abel]

Environment:
Wazuh: 4.9.0
Kubernetes: v1.27.16
Ubuntu 22.04.4 LTS

I've followed the guide to install Wazuh with Kubernetes here: https://documentation.wazuh.com/current/deployment-options/deploying-with-kubernetes/kubernetes-deployment.html

After install, I am able to log into the dashboard initially, but after 10 or so minutes, I'm presented with the following:

INFO: Current API id [1513629884013] INFO: Checking current API id [1513629884013]... INFO: Current API id [1513629884013] has some problem: 3002 - Request failed with status code 400 INFO: Getting API hosts... INFO: API hosts found: 1 INFO: Checking API host id [1513629884013]... INFO: Could not connect to API id [1513629884013]: 3099 - ERROR3099 - Some Wazuh daemons are not ready yet in node "wazuh-manager-master" (wazuh-modulesd->failed) INFO: Removed [navigate] cookie ERROR: No API available to connect

Restarting Wazuh or redeploying the master node seems to fix the issue, but only temporarily.

Hoping someone can help me troubleshoot this.

Thanks!

[hasitha.u...@wazuh.com]

Hello  Chris,

According to your Wazuh Dashboard issues seem to be linked to the following:

wazuh-modulesd->failed: This daemon handles important Wazuh modules like Syscollector and Vulnerability Detector. If it's failing, it could indicate a configuration problem or an internal error.
Error 3099: This means some essential Wazuh services, like wazuh-modulesd, are not running properly on the node (wazuh-manager-master). If these key components aren’t active, the API won’t be able to connect as expected.

To troubleshoot further, please provide the output of the following commands:
cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn"
cat /var/ossec/logs/ossec.log | grep -i -E "error|warn"
journalctl -xeu wazuh-dashboard
cat /usr/share/wazuh-dashboard/data/wazuh/logs/wazuhapp.log | grep -i -E "error|warn"
cat /var/log/filebeat/filebeat | grep -i -E "error|warn"
 
And also try to restart pods.
If this still persist provide me the details of resources.
For example: Ram, CPU and Hard disk.

Ref: https://documentation.wazuh.com/current/user-manual/wazuh-dashboard/troubleshooting.html

Let me know the results!

Regards,
Hasitha Upekshitha