Slow Loading and Authentication Issue with Wazuh Dashboard

[Bhargav Uppalapati]

Dear Wazuh Support Team,

I am currently using Wazuh as my SIEM solution, deployed in the cloud. Recently, I encountered the following issues:

1. The authentication page is taking an unusually long time to load.
2. After entering the correct credentials, it takes some time to access the dashboard.
3. After some time, I encountered an error stating: "Application Not Found."

Once the dashboard does load, the system seems to function normally, but the initial delay and this error are concerning.

Could you please assist me in troubleshooting and resolving these issues? If there are any specific logs or configurations that I should check, kindly provide guidance.

Thank you in advance for your support. I look forward to your response.

Best regards,
Bhargav

[Stuti Gupta]

Hi Bhargav

If you encounter the message Application Not Found when accessing the Wazuh dashboard after upgrading, it might be that the configuration file /etc/wazuh-dashboard/opensearch_dashboards.yml wasn't overwritten with new changes. To resolve this issue, update the uiSettings.overrides.defaultRoute setting with the /app/wz-home value in the configuration file:

uiSettings.overrides.defaultRoute: /app/wz-home

If you are still encountering the error, please provide the following information:

Wazuh version and environment details: Is it an all-in-one setup or distributed?
You mentioned "cloud"—are you using Wazuh Cloud or another cloud provider?
Additionally, please share the following logs:

Wazuh cluster logs:
cat /var/log/wazuh-indexer/wazuh-cluster.log
Wazuh dashboard logs:
cat /usr/share/wazuh-dashboard/data/wazuh/logs/wazuhapp.log

Clear your browser cache and check if the error persists.
Check the cluster health using this command:
curl -XGET -k -u user:pass "https://localhost:9200/_cluster/health"
Ensure there is enough disk space and memory with the following commands:
df -h
free -h

Hope to hear from you soon 

[Bhargav Uppalapati]

Dear Wazuh Support Team,

Thank you for your response. To clarify, I have not updated Wazuh or made any changes to it recently. We are currently running Wazuh version v4.8.2 in an all-in-one setup. Our deployment is on a cloud provider, utilizing the Infrastructure as a Service (IaaS) model, not Wazuh Cloud.

The issue we are encountering is as follows:

• Slow application loading before login: The authentication page takes an unusually long time to load.
• Delay after entering credentials: After entering the correct username and password, it takes additional time to access the dashboard.
• Once logged in, the dashboard works normally and performs well.

I have attached the requested logs below:

• Wazuh Cluster logs: /var/log/wazuh-indexer/wazuh-cluster.log
• Wazuh Dashboard logs: /usr/share/wazuh-dashboard/data/wazuh/logs/wazuhapp.log

Please let me know if further details are needed. I would appreciate your assistance in resolving this issue.

Best regards,
Bhargav Uppalapati

[Bhargav Uppalapati]

Dear Wazuh Support Team,

I wanted to follow up on my previous message regarding the issues we are facing with our Wazuh deployment. We have been experiencing these problems for quite some time now, and they are affecting the overall user experience.

To reiterate, the main issues are:

• Slow application loading before login: The authentication page takes a long time to load.
• Delay after entering credentials: Once the correct username and password are provided, there is a noticeable delay before accessing the dashboard.

Once inside the dashboard, the system performs normally, but the initial delays remain a concern. We would appreciate your assistance in troubleshooting and resolving this issue as soon as possible.

Please let me know if you require any additional information.

Thank you in advance for your support.

Best regards,
Bhargav

[Stuti Gupta]

Hi  Bhargav

From this error it seems like a permission error
{"unknown-node":{"error":"Permission denied: Resource type: *:*"}},"detail":"Permission denied: Resource type: *:*","error":4000,"remediation":"Please, make sure you have permissions to execute the current request. For more information on how to set up permissions,
The error you share indicates that you do not have some permission required to perform that action.
Please ensure you are using an admin user to log into the Dashboard. For more details on setting up permissions, refer to the API documentation: https://documentation.wazuh.com/current/user-manual/api/rbac/how-it-works.html Or performed any other steps like multi-tenancy https://documentation.wazuh.com/current/user-manual/wazuh-dashboard/multi-tenancy.html 

Also, Please share the RAM usages using command:
top -h
Also share the output of Command:
GET /manager/daemons/stats?daemons_list=wazuh-analysisd

This command will give the detail information of EPS. This can be issue is due to a resource problem. The OS is ingesting more EPS than it can handle. 

Hope to hear from you soon