wazuh-analysisd: INFO: Cannot connect to 'queue/db/wdb': Connection refused (111). Waiting 1 seconds to reconnect

[Isaac R San]

Hello wazuh community

Recently in a worker of my wazuh cluster deployment, errors have been presented with de module of wazuh-db, some hours after the wazuh-manager service have been restarted the wazuh-db fall down, and in /var/ossec/logs/ossec.log begin to appear the following logs.

I have enabled the second level on wazuh-db in the local_internal_options.conf file, but the only information that i can see is when the wazuh-db service is down.

These are the logs. Additionally i attach the logs in .txt file

[Javier Medeot]

Hello Isaac.

To investigate the cause of this error, I'd like to know what version have you got deployed. A bug in an older version looked similar to this problem. You can check this here: https://github.com/wazuh/wazuh/issues/11854#issuecomment-1017397527. What version for your agents? The Wazuh manager version can't be older than the agents version.

Looking forward to the details of your deployment. Thank you.

[Isaac R San]

Hello Javier

Thanks for the response. The version of wazuh manager is v4.3.4 and the agents integrated in the worker have the following versions:

Wazuh v4.2.5
Wazuh v4.3.10
Wazuh v4.4.4

Regards.

[Javier Medeot]

Alright, the Wazuh manager version shouldn't be earlier than the one of those agents as explained in the documentation

"Compatibility between the Wazuh agent and the Wazuh manager is guaranteed when the Wazuh manager version is later than or equal to that of the Wazuh agent."

• https://documentation.wazuh.com/current/installation-guide/wazuh-agent/index.html

I think your issue is due to having 4.4.4 connected to the 4.3.4 Wazuh server. Do you think this could the cause as well?

If upgrading your Wazuh deployment is an option for you, we have a guide in our docs for this:

• https://documentation.wazuh.com/current/upgrade-guide/index.html

Please, let me know if version incompatibility is the issue here. Thank you.

[Isaac R San]

Hello Javier

I will try upgrade Wazuh manager to the latest version and let you known if the problem solved.

Thanks a lot for the help. Best Regards.

[Isaac R San]

Hello Javier

Some days before, the wazuh-manager was upgraded and since the upgrade the problem in the worker was solved.

Thanks a lot for the help. Best Regards.