Wazuh 3.1 - stale agent in web interface?

[Neal Rauhauser]

I have a brand new install of Wazuh 3.1 and have created a total of five agents.

The first agent 001 has never been configured.

Agents 002, 003, 004 were configured in the command line of both the server and each respective agent.

I goofed on agent 003, used the incorrect IP for it. I deleted it via the command line interface.

I created agent 005, which has the same symbolic name as agent 003, but the correct IP.

This is what I see via the command line on the server:

Available agents: 

   ID: 001, Name: light, IP: 192.168.1.83

   ID: 002, Name: test002, IP: 192.168.0.11

   ID: 004, Name: test004, IP: 192.168.0.43

   ID: 005, Name: test005, IP: 192.168.1.246

But via the Kibana interface the system still shows test003 with the incorrect IP. This is true even after a restart of the system.

So to reproduce - on the server using manage_agents, create an agent with an incorrect IP address, delete it, then create a second with the same name and corrected IP. The Kibana interface should show the original erroneous entry even after a restart.

[Neal Rauhauser]

And here's a graphical view of the failure - click on the stale agent 003 and this is what the system reports.

https://imgur.com/a/sItFD

[Javier Castro]

Hi Neal,

by command line on the server, what do you exactly mean?

The Wazuh app gets data from calls to Wazuh API, there may be some incoherence between the binaries and the API call (because the API reads from a database).

Regards

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.
To post to this group, send email to wa...@googlegroups.com.
Visit this group at https://groups.google.com/group/wazuh.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/a60c117d-0fb8-4817-ab9f-eced2a7fcb16%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.