Error: 3002 - Request failed with status code 429

[Nhan Nguyen]

I have two Wazuh servers running on Linux; server 1 includes Wazuh Dashboard + Server, and server 2 includes Wazuh Indexer. Because I couldn't retrieve logs from the agent, I deleted the agent from the system and removed it from the database using the command:
rm -f /var/ossec/queue/db/*.db
rm -f /var/ossec/var/db/global.db
However, I didn't use the `systemctl stop wazuh-manager` command before deleting it. Therefore, when I accessed the dashboard again, the system reported an error:

Error: Error: 3002 - Request failed with status code 429

at WzRequest.genericReq (https://192.168.1.1/414204/bundles/plugin/wazuh/wazuh.plugin.js:1:501162)

at async WzAuthentication.login (https://192.168.1.1/414204/bundles/plugin/wazuh/wazuh.plugin.js:1:556304)

at async WzAuthentication.refresh (https://192.168.1.1/414204/bundles/plugin/wazuh/wazuh.plugin.js:1:556629)

And when Check API Connection, I get an error
INFO: Current API id [default]
INFO: Checking current API id [default]...
INFO: Current API id [default] has some problem: 3002 - Request failed with status code 429
INFO: Getting API hosts...
INFO: API hosts found: 1
INFO: Checking API host id [default]...
INFO: Could not connect to API id [default]: 3099 - ERROR3099 - Maximum number of requests per minute reached
INFO: Removed [navigate] cookies
ERROR: No API available to connect

Please help me fix this error

[Stuti Gupta]

Please allow me sometime I'm looking into this 

[Stuti Gupta]

Hi Nhan,

The error you are seeing (HTTP 429 / ERROR3099 – Maximum number of requests per minute reached) means the Wazuh API is receiving too many requests in a short time and is blocking them. In most cases this happens when the dashboard keeps trying to connect to the API, but the API is not responding correctly.

In your case, this likely started after the database files were removed while the Wazuh manager was still running. Those database files are used by the manager to store agent and internal information. If they are deleted while the service is running, the manager may continue running, but some internal data may be missing. Because of this, the API may fail to respond correctly, and the dashboard keeps retrying the request until the API rate limit is reached.

The first step is to restart the services and rebuild the database files correctly.

Stop the services:

sudo systemctl stop wazuh-dashboard
sudo systemctl stop wazuh-manager

Remove the database files again so the manager can recreate them:

sudo rm -f /var/ossec/queue/db/*.db
sudo rm -f /var/ossec/var/db/global.db

Start the manager again: sudo systemctl start wazuh-manager

After 20–30 seconds, the manager can rebuild the database, then start the dashboard: sudo systemctl start wazuh-dashboard

After that, check if the API is responding: curl -k -X GET "https://<api_url>:55000/?pretty=true" -H "Authorization: Bearer $(curl -u <api_user>:<api_password> -k -X POST 'https://<api_url>:55000/security/user/authenticate?raw=true')"

You can also confirm that the manager is running normally: systemctl status wazuh-manager

If the issue continues, please check the manager and API logs to see if there are errors.

Manager logs: cat /var/ossec/logs/ossec.log | grep -i -E "error|warn"
API logs: cat /var/ossec/logs/api.log | grep -i -E "error|warn"

You also mentioned that earlier, you could not retrieve logs from the agents. If logs were arriving before but are not arriving now, it may also be related to the storage or cluster health.

Check the disk space:
df -h
free -h

Check the indexer cluster health: curl -k -u admin:<password> https://<indexer_ip>:9200/_cluster/health?pretty

And review the indexer logs: cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn"

Additionally, deleting the DB will not delete the agents; the DB is data that is collected from the agents. Let me know if you want to remove the agent completely. 

 

[Nhan Nguyen]

Thank you for you support, I realized I just need to transfer permissions to wazuh using `chown -R wazuh:wazuh /var/ossec/etc/client.keys`. However, I encountered a new problem. When I checked the Agent list on the Dashboard, I didn't see any agents, but when I checked /var/ossec/bin/manage_agents, it showed 4 agents, but they were disconnected, with IDs that were the agents before I deleted them. Please help me find a solution to this problem; no agents are connected to wazuh.

[Stuti Gupta]

Hi Nhan Nguyen,

First, the correct ownership command should be: chown root:wazuh /var/ossec/etc/client.keys

After running this command, restart the manager: systemctl restart wazuh-manager

If the agent still does not appear as connected in the Wazuh dashboard, check the manager logs in: /var/ossec/logs/ossec.log

We should also check how the agent was removed from the manager. To remove an agent from the manager, you can use the following CLI command: /var/ossec/bin/manage_agents -r <WAZUH_AGENT_ID>

https://documentation.wazuh.com/current/user-manual/agent/agent-management/remove-agents/remove.html

If you want to completely remove the agent from the system, follow the uninstall steps here:
https://documentation.wazuh.com/current/installation-guide/uninstalling-wazuh/agent.html

Also, check the logs on the agent side for any errors or warnings.

I recommend creating a separate post for this issue since it is a different problem. This helps keep the discussion organized and makes it easier for others to follow and find the solution.