Wazuh dashboard fails to start after update to 4.8.0 from 4.7.5

[Charles Rawls]

Greeting Gentle Beings:

I face a dilemma, and pray someone can buy me a clue. 

I am running ubuntu 22-04, and have been running various version of wazuh since 4.4.

I recently updated to 4.8.0 via apt-get update; apt-get upgrade -y

Wazuh manager is running as per:

root-wazuh:/etc/wazuh-dashboard# systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
     Loaded: loaded (/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: enabled)
     Active: active (running) since Wed 2024-06-12 14:21:15 UTC; 18min ago
    Process: 405 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=0/SUCCESS)
      Tasks: 163 (limit: 18992)
     Memory: 571.8M
        CPU: 6min 34.170s
     CGroup: /system.slice/wazuh-manager.service
             ├─1747 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
             ├─1748 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
             ├─1751 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
             ├─1754 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
             ├─1779 /var/ossec/bin/wazuh-integratord
             ├─1801 /var/ossec/bin/wazuh-authd
             ├─1817 /var/ossec/bin/wazuh-db
             ├─1843 /var/ossec/bin/wazuh-execd
             ├─1858 /var/ossec/bin/wazuh-maild
             ├─1864 /var/ossec/bin/wazuh-analysisd
             ├─1875 /var/ossec/bin/wazuh-syscheckd
             ├─1893 /var/ossec/bin/wazuh-remoted
             ├─1977 /var/ossec/bin/wazuh-logcollector
             ├─1997 /var/ossec/bin/wazuh-monitord
             └─2019 /var/ossec/bin/wazuh-modulesd

Jun 12 14:21:12 wazuh env[2016]: 2024/06/12 14:21:12 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
Jun 12 14:21:12 wazuh env[2016]: 2024/06/12 14:21:12 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
Jun 12 14:21:12 wazuh env[2016]: 2024/06/12 14:21:12 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
Jun 12 14:21:12 wazuh env[2016]: 2024/06/12 14:21:12 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
Jun 12 14:21:12 wazuh env[2016]: 2024/06/12 14:21:12 wazuh-modulesd: WARNING: (1230): Invalid element in the configuration: 'provider'.
Jun 12 14:21:12 wazuh env[2016]: 2024/06/12 14:21:12 wazuh-modulesd:router: INFO: Loaded router module.
Jun 12 14:21:12 wazuh env[2016]: 2024/06/12 14:21:12 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
Jun 12 14:21:13 wazuh env[405]: Started wazuh-modulesd...
Jun 12 14:21:15 wazuh env[405]: Completed.
Jun 12 14:21:15 wazuh systemd[1]: Started Wazuh manager.

But the wazuh dashboard files as per:

root-wazuh:/etc/wazuh-dashboard# systemctl status wazuh-dashboard
× wazuh-dashboard.service - wazuh-dashboard
     Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Wed 2024-06-12 14:36:47 UTC; 3min 44s ago
    Process: 4626 ExecStart=/usr/share/wazuh-dashboard/bin/opensearch-dashboards (code=exited, status=1/FAILURE)
   Main PID: 4626 (code=exited, status=1/FAILURE)
        CPU: 9.737s

Jun 12 14:36:47 wazuh opensearch-dashboards[4626]:     at InnerSubscriber._next (/usr/share/wazuh-dashboard/node_modules/rxjs/internal/InnerSubscriber.js:28:21)
Jun 12 14:36:47 wazuh opensearch-dashboards[4626]:     at InnerSubscriber.Subscriber.next (/usr/share/wazuh-dashboard/node_modules/rxjs/internal/Subscriber.js:66:18)
Jun 12 14:36:47 wazuh opensearch-dashboards[4626]:     at MapSubscriber._next (/usr/share/wazuh-dashboard/node_modules/rxjs/internal/operators/map.js:55:26)
Jun 12 14:36:47 wazuh opensearch-dashboards[4626]:     at MapSubscriber.Subscriber.next (/usr/share/wazuh-dashboard/node_modules/rxjs/internal/Subscriber.js:66:18)
Jun 12 14:36:47 wazuh opensearch-dashboards[4626]:     at DistinctUntilChangedSubscriber._next (/usr/share/wazuh-dashboard/node_modules/rxjs/internal/operators/distinctUntilChanged.js:69:30)
Jun 12 14:36:47 wazuh opensearch-dashboards[4626]:     at DistinctUntilChangedSubscriber.Subscriber.next (/usr/share/wazuh-dashboard/node_modules/rxjs/internal/Subscriber.js:66:18)
Jun 12 14:36:47 wazuh opensearch-dashboards[4626]:     at MapSubscriber._next (/usr/share/wazuh-dashboard/node_modules/rxjs/internal/operators/map.js:55:26)
Jun 12 14:36:47 wazuh systemd[1]: wazuh-dashboard.service: Main process exited, code=exited, status=1/FAILURE
Jun 12 14:36:47 wazuh systemd[1]: wazuh-dashboard.service: Failed with result 'exit-code'.
Jun 12 14:36:47 wazuh systemd[1]: wazuh-dashboard.service: Consumed 9.737s CPU time.
root-wazuh:/etc/wazuh-dashboard#

[Juan Nicolás Asselle (Nico Asselle)]

Hi Charles,

Unfortunately upgrading just like you did is not the suggested way. Here is the procedure https://documentation.wazuh.com/current/upgrade-guide/upgrading-central-components.html.

Anyway, to fix this I'm going to need the specific steps followed, your current environment layout (manager and indexer count, if they are clusters), wazuh-indexer and wazuh-dashboard error/warn logs.

Looking forward to your response.

Nico

[cra...@kinetik.care]

Of course I should have RTFM.   My only excuse is I’ve never had issues before.   (A WEAK EXCUSE)

 

This is an all-in-one setup, I’ll dig for the logs, right now I am revering to an earlier backup, once I have that running I’ll return to the 4.8 version and extract the logs

--
You received this message because you are subscribed to a topic in the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/wazuh/qr970nNG6-U/unsubscribe.
To unsubscribe from this group and all its topics, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/9d8ada65-f9ca-49bd-bc51-c24ddf794522n%40googlegroups.com.

CONFIDENTIALITY NOTICE: This Email is covered by the Electronic Communications Privacy Act, 18 U.S.C. 510 - 2521 and is legally privileged. The information contained in this e-mail message is intended only for the personal and confidential use of the recipient(s) named above. If the reader of this message is not the intended recipient or an agent responsible for delivering it to the intended recipient, you are hereby notified that you have received this document in error and that any review, use, dissemination, forwarding, printing, copying, disclosure or distribution by persons other than the intended recipient(s) is prohibited and may be unlawful. You must delete this message and any copy of it (in any form) without disclosing it.
If you believe this message has been sent to you in error, please notify the sender by replying to this transmission.

[Colin Edwards]

I'm actually running into the same problem with the Dashboard, and I did follow the upgrade procedure.  This is a 3 server deployment (Indexer, Server, and Dashboard).  No clustered index.

What logs should I be looking at related to the dashboard service failure?

× wazuh-dashboard.service - wazuh-dashboard
     Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)

     Active: failed (Result: exit-code) since Thu 2024-06-13 13:47:50 UTC; 18min ago
    Process: 1385 ExecStart=/usr/share/wazuh-dashboard/bin/opensearch-dashboards (code=exited, status=1/FAILURE)
   Main PID: 1385 (code=exited, status=1/FAILURE)
        CPU: 4.351s

Jun 13 13:47:50 w-dashboard opensearch-dashboards[1385]:     at InnerSubscriber._next (/usr/share/wazuh-dashboard/node_modules/rxjs/internal/InnerSubscriber.js:28:21)
Jun 13 13:47:50 w-dashboard opensearch-dashboards[1385]:     at InnerSubscriber.Subscriber.next (/usr/share/wazuh-dashboard/node_modules/rxjs/internal/Subscriber.js:66:18)
Jun 13 13:47:50 w-dashboard opensearch-dashboards[1385]:     at MapSubscriber._next (/usr/share/wazuh-dashboard/node_modules/rxjs/internal/operators/map.js:55:26)
Jun 13 13:47:50 w-dashboard opensearch-dashboards[1385]:     at MapSubscriber.Subscriber.next (/usr/share/wazuh-dashboard/node_modules/rxjs/internal/Subscriber.js:66:18)
Jun 13 13:47:50 w-dashboard opensearch-dashboards[1385]:     at DistinctUntilChangedSubscriber._next (/usr/share/wazuh-dashboard/node_modules/rxjs/internal/operators/distinctUntilChanged.js:69:30)
Jun 13 13:47:50 w-dashboard opensearch-dashboards[1385]:     at DistinctUntilChangedSubscriber.Subscriber.next (/usr/share/wazuh-dashboard/node_modules/rxjs/internal/Subscriber.js:66:18)
Jun 13 13:47:50 w-dashboard opensearch-dashboards[1385]:     at MapSubscriber._next (/usr/share/wazuh-dashboard/node_modules/rxjs/internal/operators/map.js:55:26)
Jun 13 13:47:50 w-dashboard systemd[1]: wazuh-dashboard.service: Main process exited, code=exited, status=1/FAILURE
Jun 13 13:47:50 w-dashboard systemd[1]: wazuh-dashboard.service: Failed with result 'exit-code'.
Jun 13 13:47:50 w-dashboard systemd[1]: wazuh-dashboard.service: Consumed 4.351s CPU time.

Thanks,

Colin

[White Daka]

Hi,

Despite following the documentation from this link (https://documentation.wazuh.com/current/upgrade-guide/upgrading-central-components.html) I still got the same error wazuh-dashboard.service: Failed with result 'exit-code'. How can this issue be resolved if anyone has encountered it. Your positive response will be highly appreciated.

Thank you.

[Colin Edwards]

Resolved for me.  I was overlooking two of my customized lines in opensearch_dashboards.yml.

Check to make sure your server.ssl.key and server.ssl.certificate are pointing to the actual .pem files that exist in /etc/wazuh-dashboard/certs/.

Mine were only a 1 character different in my file names, and the defaults with the new yml that was installed during upgrade, and I hadn't noticed it at first..

Colin

On Thursday, June 13, 2024 at 4:26:11 AM UTC-4 cra...@kinetik.care wrote:

[Alx Ch]

Colin Edwards, thanks a lot!

I can confirm, that your way fixed my issues.

пятница, 14 июня 2024 г. в 12:30:16 UTC+3, Colin Edwards:

[Max შემიწყალე]

Thank you Colin Edwards! This is what happened to me as well.

After the upgrade it had this:

/etc/wazuh-dashboard/opensearch_dashboards.yml

server.ssl.certificate: "/etc/wazuh-dashboard/certs/dashboard.pem"

and the actual file it needed to point at was dashboard-cert.pem

Changed the entry, and restarted the service successfully.