Wazuh dashboard server is not ready yet

[rached cherif]

Hi all , 

I use Wazuh 4.3.10. I have tried everything I could find, but it hasn't worked 

cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn"

[Federico Rodriguez]

Hi!

Can you please provide the output of this command:

journalctl -xeu wazuh-indexer

cat /etc/wazuh-indexer/jvm.options

Thanks!

[rached cherif]

journalctl -xeu wazuh-indexer

cat /etc/wazuh-indexer/jvm.options

[Federico Rodriguez]

In the /etc/wazuh-indexer/jvm.options file add the configuration to set the memory availability. Set it to no more than 50% of you total RAM and no more than 32GB.

In this example is being set to 4GB:

# Xms represents the initial size of total heap space
# Xmx represents the maximum size of total heap space

-Xms4g
-Xmx4g

Once the file is modified restart wazuh-indexer.

More info:
https://documentation.wazuh.com/current/user-manual/elasticsearch/elastic-tuning.html#memory-locking
Item 3°

[rached cherif]

when I try to restart wazuh index i recieve this message  "  job for wazuh-indexer.service failed because the control process exited with error code .see "systemctl status wazuh-indexer.service" and "journalctl -xe for details "

[Federico Rodriguez]

So far the  issue seems to be related to memory issues. I suggest doing as the error mentions and run the command journalctl -xe and systemctl status wazuh-indexer.service to see if we can get more details on the indexer start issue. All the details you can provide on the environment the app is running are helpful.

Also to have a bit more context on the machine resources please run free -h to get the memory availability.

[rached cherif]

 journalctl -xe

systemctl status wazuh-indexer.service

free -h

  I have tried updating the memory as recommended (8ram and 4cpu) but still have the same problems 

[Federico Rodriguez]

The free-h screenshot indicates a problem related to RAM memory. It show 1GB as the machine total memory and 414MB available, but the java virtual machine is trying to allocate the 4GB specified in the /etc/wazuh-indexer/jvm.options file. In case you upgraded the machine resources please share again:
systemctl status wazuh-indexer.service  <--- to see why it failed
free -h <--- to verify the available resources

Keep in mind the memory specified in /etc/wazuh-indexer/jvm.options file should not exceed 50% of the machine total RAM memory.
In this case:
-Xms4g
-Xmx4g

means you should have at least 8GB of RAM.

I suggest you check on Wazuh Indexer requirements: 
https://documentation.wazuh.com/current/installation-guide/wazuh-indexer/index.html#hardware-recommendations

[rached cherif]

systemctl status wazuh-indexer.service  
free -h 

/etc/wazuh-indexer/jvm.options 

[Federico Rodriguez]

The indexer
In the screenshots, I see you have a total of 4GB of RAM memory and in the /etc/wazuh-indexer/jvm.options file you configured:
-Xms4g
-Xmx4g

This means you are trying to assign all the machine memory to the Java Virtual Machine (jvm.options) and it is not possible.

Option 1:
If you have a total of 4GB of RAM memory, you can set the configuration of the jvm.options to 2GB like this:
-Xms2g
-Xmx2g

Or Option 2:
If you can extend the machine RAM memory to a total of 8GB you should be able to use the /etc/wazuh-indexer/jvm.options like:
-Xms4g
-Xmx4g

Keep in mind the memory specified in /etc/wazuh-indexer/jvm.options file should not exceed 50% of the machine total RAM memory.

Another thing you could try is to increase the service timeout time to avoid timeout errors when it is initializing. You can follow these commands to do so:

# sudo mkdir /etc/systemd/system/wazuh-indexer.service.d
# echo -e "[Service]\nTimeoutStartSec=180" | sudo tee /etc/systemd/system/wazuh-indexer.service.d/startup-timeout.conf 

Then, reload the daemon:
$ sudo systemctl daemon-reload

And finally restart the services:
# sudo systemctl restart wazuh-indexer

[rached cherif]

I'm back again, 

When I switched from VMware to VirtualBox I just set the total RAM for the machine to 4 and the CPU to 3 but it didn't work for a while but when I set sudo systemctl restart wazuh-indexer I was able to get it to work again. I don't know why it didn't work in VMware. 

However, thank you very much for your time   

[Federico Rodriguez]

I'm glad it's working now. Thanks a lot for sharing how you solved the issue, hope it's of use to others.