After Ubuntu 24.04 upgrade wazuh-dashboard service fails

60 views

Skip to first unread message

Odail Della Niesi Junior

unread,

Mar 7, 2025, 2:49:10 PM3/7/25

to Wazuh | Mailing List

Dear Colleagues,

After updating Ubuntu 24.04 it is no longer possible to connect to the dashboard and troubleshooting was unsuccessful. The wazuh-dashboard service fails. As shown below:

root@srv-wazuh:/home/wazuh# systemctl status wazuh-dashboard.service
× wazuh-dashboard.service - wazuh-dashboard
Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; disabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Fri 2025-03-07 14:33:56 -03; 12min ago
Process: 5738 ExecStart=/usr/share/wazuh-dashboard/bin/opensearch-dashboards (code=exited, status=1/FAILURE)
Main PID: 5738 (code=exited, status=1/FAILURE)
CPU: 7.235s
Mar 07 14:33:56 srv-wazuh opensearch-dashboards[5738]: {"type":"log","@timestamp":"2025-03-07T17:33:56Z","tags":["info","savedobjects-service"],"pid":5738,"message":"Detected mapping change in \"properties.homepage\""}
Mar 07 14:33:56 srv-wazuh opensearch-dashboards[5738]: {"type":"log","@timestamp":"2025-03-07T17:33:56Z","tags":["info","savedobjects-service"],"pid":5738,"message":"Creating index .kibana_2."}
Mar 07 14:33:56 srv-wazuh opensearch-dashboards[5738]: {"type":"log","@timestamp":"2025-03-07T17:33:56Z","tags":["error","opensearch","data"],"pid":5738,"message":"[cluster_block_exception]: index [.kibana_2] blocked by: [TOO_MANY_REQUESTS/12/disk usage exceeded flood-stage waterm>
Mar 07 14:33:56 srv-wazuh opensearch-dashboards[5738]: {"type":"log","@timestamp":"2025-03-07T17:33:56Z","tags":["warning","savedobjects-service"],"pid":5738,"message":"Unable to connect to OpenSearch. Error: cluster_block_exception: [cluster_block_exception] Reason: index [.kiban>
Mar 07 14:33:56 srv-wazuh opensearch-dashboards[5738]: {"type":"log","@timestamp":"2025-03-07T17:33:56Z","tags":["fatal","root"],"pid":5738,"message":"ResponseError: cluster_block_exception: [cluster_block_exception] Reason: index [.kibana_2] blocked by: [TOO_MANY_REQUESTS/12/disk>
Mar 07 14:33:56 srv-wazuh opensearch-dashboards[5738]: {"type":"log","@timestamp":"2025-03-07T17:33:56Z","tags":["info","plugins-system"],"pid":5738,"message":"Stopping all plugins."}
Mar 07 14:33:56 srv-wazuh opensearch-dashboards[5738]: FATAL {"error":{"root_cause":[{"type":"cluster_block_exception","reason":"index [.kibana_2] blocked by: [TOO_MANY_REQUESTS/12/disk usage exceeded flood-stage watermark, index has read-only-allow-delete block];"}],"type":"clu>
Mar 07 14:33:56 srv-wazuh systemd[1]: wazuh-dashboard.service: Main process exited, code=exited, status=1/FAILURE
Mar 07 14:33:56 srv-wazuh systemd[1]: wazuh-dashboard.service: Failed with result 'exit-code'.
Mar 07 14:33:56 srv-wazuh systemd[1]: wazuh-dashboard.service: Consumed 7.235s CPU time.

root@srv-wazuh:/home/wazuh#

Certain that I can count on your attention, I thank you in advance.

Odail - São Pedro/SP - Brazil.

Dennis Ariel Gamboa Veliz

unread,

Mar 10, 2025, 3:15:53 PM3/10/25

to Wazuh | Mailing List

Hi Odail Della Niesi Junior,

This issue was reported some time ago: issue.
This error means that a data node is critically low on disk space and has reached the flood-stage disk usage threshold, which is referred to as "DISK USAGE EXCEEDED." When disk space runs out, the indexer may reach the flood-stage disk consumption watermark.

To solve this issue, there are the following solutions: https://www.elastic.co/guide/en/elasticsearch/reference/6.2/disk-allocator.html.

Solution 1: free up disk space
Freeing up enough disk space so that more than 5% of the disk is free will solve this problem.
curl -XPUT -H "Content-Type: application/json" https://<Wazuh-Indexer-address>:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'

Solution 2: Delete the indexes
you can delete the the indexes if it is not in use, using the fowling command:
curl -k -u <username>:<passward> -XDELETE 'http://localhost:9200/<index name>'

For more information, you can refer tothe following links:
https://www.elastic.co/guide/en/elasticsearch/reference/7.4/disk-allocator.html
https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-delete-index.html
https://www.elastic.co/guide/en/elasticsearch/reference/7.17/fix-common-cluster-issues.html#_error_disk_usage_exceeded[…]ead_only_allow_delete_block

Let me know if this resolves your issue.