After changing time of Wazuh manager (docker) whole env no longer working

[Markus Dubois]

Hi,

My single node cluster was one hour behind, so to solve this I have changed the time on the  manager via the usual solutions available to change the time of containers.

But afterwards the indexer or the dashboard are complaining and the infrastructure no longer works.

The indexer and the dashboard are still one hour behind…,,

Should the time also changed in those containers.

The GitHub issue around timezone stuff isn’t clear about that.

Best regards

[Jose Camargo]

Hi Markus,

Yes, please set all components to have the same time, to avoid these issues.

I'll be awaiting your comments.

Regards,

Jose Camargo

[Markus Dubois]

Hi,

okay. But whats the correct approach here? In wazuh-manager we have the localtime file in /var/ossec/etc

The is no such thing in wazuh-indexer, wazuh-dashboard.

should i mount /etc/localtime from host into the container or are there other ways which you prefer?

[Markus Dubois]

after digging into it, on all three components manager, indexer, dashboar there is no /usr/share/zoneinfo available, so as the image is based on ubuntu 20.04,. it seems the package tzdata isn't installed (correctly).

So how will the container know they should rely on /etc(timezone or /etc/localtime?

linking the files from the host didn't worked

[Jose Camargo]

Hi Markus,

You can try redeploying your cluster, which should return to the default settings. It's ok that your logs have a different time zone than yours, as when you see the events in the Dashboard, they will show your Browser's time zone and not the one on the cluster.
To modify this you can check these settings:

I'll be awaiting your comments.