Error Pattern Handler (getPatternList)

[Mxnita]

Hello everyone.

I am presenting this problem very consistently. I have a virtual machine where I did an all-in-one installation following the documentation (it is not the OVA that you download). I have started with version 4.5.3 and when new versions come out I have updated them without having problems. Now in the latest version (4.7.0) I have had several problems. I can log in without problems, but when I go to the security events module I receive this message:

Error Pattern Handler (getPatternList)

_callee$@https://my-server/47004/bundles/plugin/wazuh/wazuh.chunk.10.js:1:5818415 tryCatch@https://my-server/47004/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:786910 invoke@https://my-server/47004/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:790934 defineIteratorMethods/</<@https://my-server/47004/bundles/plugin/customImportMapDashboards/customImportMapDashboards.plugin.js:13:788105 pattern_handler_asyncGeneratorStep@https://my-server/47004/bundles/plugin/wazuh/wazuh.chunk.10.js:1:5816015 _throw@https://my-server/47004/bundles/plugin/wazuh/wazuh.chunk.10.js:1:5816477

If I click on the close button, a window appears indicating that something went wrong and in the detail it says Internal Server Error.

There are times that if I click the refresh button, it fixes itself. But on other occasions I must restart the virtual machine for this to be solved. My question is, is there any fix available to fix these problems (which occur daily) or is it some advanced configuration that I should fix?

I would greatly appreciate the help from all of you.

Regards.

[Leonardo Daniel Sancho]

Hello Mxnita, thanks for choosing Wazuh!

Everything points to a problem that occurred during the upgrade process, a good practice is to keep backups/snapshots in place for situations such as this. 

In the meantime could you check a couple of things for us?

First could you show us the status of your manager service? You can do so by typing systemctl status wazuh-manager.

Please also check the status of your dashboard service by typing systemctl status wazuh-dashboard.

Also, are you able to roll back these changes to a previous version?

You may find the compatibility matrix for updating Wazuh by visiting this link: https://documentation.wazuh.com/current/upgrade-guide/compatibility-matrix/index.html

I'll be waiting for your answer.

[Mxnita]

Hello everyone.
Thanks for the help.

I was able to solve this problem by following this manual: https://documentation.wazuh.com/current/user-manual/wazuh-indexer/wazuh-indexer-tuning.html


Regards.

[Cris Mead (FedaykinWolf)]

Thank you @Mxnita, this seemingly fixed the issue for me too, i'll post again if not ;)