Wazuh-indexer failed to start due to java.lang.IllegalStateException: failed to load plugin opensearch-security-analytics due to jar hell

[Bhaskar Patel]

Hi All,

I have receive the error while starting the wazuh-indexer 4.6.0 error is below 

[2024-06-28T11:17:58,127][INFO ][o.o.p.c.c.PluginSettings ] [indexer] Config: metricsLocation: /dev/shm/performanceanalyzer/, metricsDeletionInterval: 1, httpsEnabled: false, cleanup-metrics-db-files: true, batch-metrics-retention-period-minutes: 7, rpc-port: 9650, webservice-port 9600
[2024-06-28T11:17:58,434][ERROR][o.o.b.Bootstrap          ] [indexer] Exception
java.lang.IllegalStateException: failed to load plugin opensearch-security-analytics due to jar hell

attached full log file for the detail information.

Please some please help on this.

--

Regard's

BHASKAR PATEL

[Rodolfo Arce Sannemann]

Hello Bhaskar

Can you please confirm a couple of questions:

• Was there an upgrade process, or was it during regular operation?
• Are you trying to manually install opensearch-security-analytics package?

Regards.. R

[Bhaskar Patel]

no action due to /var/log/audit partition space reached threshold and shutdown the server due to audit log related heardaning. after that restored the VM from the earliest backup.

then suddenly wazuh-indexer throws the error.

--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/01ad16f1-6556-4941-9cf7-45eade188c3en%40googlegroups.com.

--

Regard's

BHASKAR PATEL

M: +919998031132

M: +917990107408

E: dadu.bha...@gmail.com

[Rodolfo Arce Sannemann]

Hello Bhaskar:

Can you please confirm if the indexer service is up but showing errors? Or is the service down?

When you roll back to the backup, did you restore the whole VM or just the OS?

Have you made changes to the wazuh indexer configurations? Would you be able to share the indexer configuration?

Would you be able to list the Opensearch plugins? More info here. The working directory is: /usr/share/wazuh-indexer

Regards.. R