Wazuh agent versioning issue on Oracle Solaris

[Shashiduth Takoor]

Hello,

There seems to be an issue with the versioning of the Wazuh agent on Oracle Solaris after upgrading the manager and the agent to 4.1.2.

See below screenshots for additional information.

Image 01

Image 02

The are no specific events triggering this issue and restarting the Wazuh manager or the agent does not seem to resolve it. Please note that we have also tried uninstalling and reinstalling the agent on the Oracle Solaris system.

Kindly advise and assist.

Thanks and best regards,
Shashiduth

--

[Juan Ricci]

Hello Shashiduth, I hope you are doing it well.

Please let me know if I am understanding this issue well. The Agent version properly showed up on the Manager interface first (showing v4.1.2), but it changed back to the previous version (v4.0.4) after a while?   

[Shashiduth Takoor]

Hello Juan,

I am doing good, thanks for asking, hope you are as well.

Yes, after manually upgrading the Wazuh agent to the latest version 4.1.2 on Oracle Solaris, the version changes from 4.1.2 to 4.0.4 and vice versa.

Sometimes when restarting the Wazuh manager either via cmd or the WebUI, the agent version appears correctly i.e 4.1.2 and after a couple of minutes, it goes back to the initial version.

See below screenshot from the console. Agent 001 here is the issue.
On the left pane on tmux, Agent 001 is on version 4.0.4 and after restarting the manager and checking for the Agent 001's information on the right pane, it appears to be the correct latest version 4.1.2. Apologies for blurring some of the information but hope it helps to get a better picture.

We did not encounter this issue for other Linux distribution such as CentOS 8. The upgrade was performed remotely but with Oracle Solaris, remote upgrade or via API does not work due to the following error: Agent 001 upgrade failed. Status: Error 1816 - Agent information not found in database. I believe this is probably due to the missing syscollector module responsible for collecting the inventory data (a feature request was recently raised on Wazuh GitHub core team regarding that matter https://github.com/wazuh/wazuh/issues/7796).

Kindly advise.

Thanks and best regards,
Shashiduth

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/b1fc98f7-be33-45ab-a3b4-24e2a2deb3a0n%40googlegroups.com.

--

[Juan Ricci]

Hello Shashiduth,

Thanks for contacting us again and my apologies for the delay with responding.

I am currently trying to replicate this issue on a test environment. The idea is to figure out whether this is a bug, and to look for more data that could be useful for our development team to solve the issue.

Thank you for reporting this. I will contact you back as soon as possible with some news.

Best regards.

Juan

[Juan Ricci]

Hello Shashiduth,

I have created the following issue on our main GitHub repository in order to continue researching and looking for a solution to this problem: https://github.com/wazuh/wazuh/issues/7874. Also I am following up with this issue for any news and actively working on it along with our development team.

Once again, thanks for helping us by reporting this.

Best regards.

Juan

[Shashiduth Takoor]

Hello Juan,

Thank you for the prompt reply and assistance. Appreciate the hard work.

Best regards,
Shashiduth

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/dbb9c6be-3e64-496b-b7fa-432124b6f540n%40googlegroups.com.

--

[Tomas Turina]

Hi Shashiduth,

Remote upgrade via API and CLI is not compatible with Solaris agents. Currently, we only support this kind of upgrade only for Windows and Linux systems. This is why you can't upgrade it, not because of the lack of the syscollector module.

I've been also trying to reproduce your problem manually upgrading Wazuh agent in a Solaris 11.3 x86 system from 4.0.4 to 4.1.3 running the install.sh script. However, it is working for me and the version doesn't change after some time, as you reported.

Could you please verify if you still experience this issue by upgrading from 4.0.4 to 4.1.3?

Best regards.

Tomás Turina.

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/2dd9ad65-1778-3fe1-1a77-d5831ac0b377%40mns.mu.