Wazuh Server Cluster - When nominating a new Master node

[Max]

Hi All,

Are there documentation or steps/procedures as to what would one do when:

- In a 3-node cluster (1 master, 2 workers)

- Initial Wazuh Manager Master Node is down

- Need to Nominate a new one (either of the workers)

What are the things I would need to take note of? 

What happens if I want to renominate the initial master node back as the Master

Thanks for any help or guidance on this matter

[Md. Nazmur Sakib]

Hi Max,

A few things I will share with you that will help you understand the architecture better and help you decide what you should do in this kind of situation.

Even when the manager node is down, the workers keep doing their core job. The running worker nodes continue receiving and processing events from agents and raising alerts, and agents auto-switch to a worker if they were configured with more than one server address. So log collection and detection don't stop.

The only problem you will face is that you will not be able to access the dashboard(web interface) when the master node is down, but you will not lose any data.

Once the master node is up and running. You will again be able to see everything in the dashboard(web ui).

So the first thing you need to do is try to fix the master node.

It is possible to change one of the worker nodes to the master node, but we do not have any official documentation on this. But this should be your last option in case of a situation like your master node’s server hardware crashing, you cannot access the server and you do not have any snapshot of that server.

Let me know if you need any further information on this.