Wazuh installer fails: "ERROR: The Wazuh API user wazuh does not exist"

[J J Sloan]

I'm installing Wazuh on a server which previously had an earlier version

When launching the all-in-one wazuh-install.sh, everything seems to be going well, but then the installer dies with an error:

...
5/06/2024 13:25:48 INFO: Starting Wazuh dashboard installation.
05/06/2024 13:33:12 INFO: Wazuh dashboard installation finished.
05/06/2024 13:33:12 INFO: Wazuh dashboard post-install configuration finished.
05/06/2024 13:33:12 INFO: Starting service wazuh-dashboard.
05/06/2024 13:33:14 INFO: wazuh-dashboard service started.
05/06/2024 13:33:36 ERROR: The Wazuh API user wazuh does not exist
05/06/2024 13:33:36 ERROR: The Wazuh API user wazuh-wui does not exist
05/06/2024 13:33:50 ERROR: User  is not registered in Wazuh API
05/06/2024 13:33:50 INFO: --- Removing existing Wazuh installation ---
05/06/2024 13:33:50 INFO: Removing Wazuh manager.
05/06/2024 13:34:48 INFO: Wazuh manager removed.
05/06/2024 13:34:48 INFO: Removing Wazuh indexer.
05/06/2024 13:34:56 INFO: Wazuh indexer removed.
05/06/2024 13:34:56 INFO: Removing Filebeat.
05/06/2024 13:35:00 INFO: Filebeat removed.
05/06/2024 13:35:00 INFO: Removing Wazuh dashboard.
05/06/2024 13:35:35 INFO: Wazuh dashboard removed.
05/06/2024 13:35:35 INFO: Installation cleaned.

Any ideas how to get past this? Isn't the installer supposed to create any necessary users?

Jake

[Stuti Gupta]

Hi team!
Please allow me some time. I'm looking into this query and will update you with an appropriate answer. 

[Stuti Gupta]

Hi J J Sloan

You need to remove the wazuh component one at a time using the following document https://documentation.wazuh.com/current/installation-guide/uninstalling-wazuh/central-components.html   This command: sudo bash wazuh-install.sh --uninstall doesn't remove all the wazuh related files. After running this command you can see many wearing logs in /var/log/wazuh-install.log, like:
dpkg: warning: while removing filebeat, directory '/etc/filebeat' not empty so not removed
dpkg: warning: while removing filebeat, directory '/usr/share/filebeat/module' not empty so not removed
dpkg: warning: while removing wazuh-indexer, directory '/usr/lib/systemd/system' not empty so not removed
dpkg: warning: while removing wazuh-indexer, directory '/var/log/wazuh-indexer' not empty so not removed
dpkg: warning: while removing wazuh-indexer, directory '/var/lib/wazuh-indexer' not empty so not removed
So you need to remove these files and directories, try to remove files and directories that are not deleted using rm -rf command. You need to remove the previous installation certs also for that remove this zip folder wazuh-install-files.tar and the cache before reinstalling wazuh on the same server

Hope this helps 

[J J Sloan]

Thanks Stuti,

I've built a new machine, installed Wazuh there, and everything is fine now.

Jake