Hello Aly,
What version of Wazuh are you using?
Also, What OS version is your Wazuh indexer/manager installed on?
Sometimes,
Error: Error Pattern Handler (getPatternList) could be due to a resource-related issue on the Wazuh indexer server, and you will need to review and ensure that you have enough resources (RAM, etc). It seems like wazuh-indexer was using most of the JVM heap configured, and the total memory required for all operations was superior to the memory available. Edit the
/etc/wazuh-indexer/jvm.options to increase the JVM heap size. The recommended value is half of the system RAM (reference). For example, set the size as follows for a system with 8 GB of RAM (
reference):
-Xms4g
-Xmx4g
Where the total heap space:
- -Xms4g - initial size is set to 4Gb of RAM.
- -Xmx4g - maximum size is to 4Gb of RAM
Restart the Wazuh indexer and dashboard service service:
- systemctl daemon-reload
- systemctl restart wazuh-indexer
- systemctl restart wazuh-dashboard
If the issue persists, kindly share the full output of the below commands:
Wazuh dashboard:
- journalctl -u wazuh-dashboard | grep -i -E "error|warn"
Wazuh indexer:
- cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn"
Let me know if this resolves your issue.
Best regards.