Wazuh Dashboard Not Showing Security Events

[Ivan Rios]

Hello,

My Wazuh dashboard stopped showing security related events even though the wazuh agent is still active and running on the endpoint side. I checked my Wazuh manager and it looks like the logs are still generating on there. What could be happening that I don't see the security events on the dashboard anymore?  

[Nico Brambilla]

Hello Ivan Rios, I've got a couple of questions for you:

1. What version of wazuh have you deployed?
2. Did you tried the command: systemctl restart wazuh-dashboard
   1. If YES, What is the output of that command ?
3. If your wazuh-dashboard is OK, could you check if you have any filters applied in your search?
4. Did you check if "security-events" are being generated on the wazuh-agents into the local files?
   - /var/ossec/logs/alerts/alerts.log
   

I think these links may be useful:

- Installation of Wazuh Dashboard 

- Troubleshooting Wazuh Dashboard

- Checking agent connection with the manager

- Wazuh Architecture

I'll be waiting for your answer.

Thanks for trusting in wazuh.

[Ivan Rios]

Hello Nico, the output of the command you recommended is "wazuh-dashboard.service not found". Why could this be? My dashboard has been working fine for a few months now. 

[Nico Brambilla]

Hello Ivan, could you provide me with the version of your wazuh stack? do you have an AiO deployment or cluster? 

please try to do at the manager:

/var/ossec/bin/wazuh-control stop
/var/ossec/bin/wazuh-control restart

/var/ossec/bin/wazuh-control status

In addition please could you provide your answers to the questions that I made it you? if you can provide me with logs and screenshots of your problem,  I will provide a more accurate answer to you.

Did you check the links that I shared with you ? 

Please check this one too : I do not see alerts in the Wazuh dashboard

Best regards, 

Nico B.