Wazuh API not showing/working

[Djordje Dosic]

Hello

I am currently testing Wazuh version 4.3.10. My choice of installation is from the source, and I installed Wazuh manager per your official docs instructions. Wazuh manager is generally working fine, and there are no major problems regarding core Wazuh functions. 

But for some reason, API doesn't work well. There is no port 55000 among listening ports and I've noticed that when I check status of Wazuh manager, it doesn't show API processes (see attached screenshot).

I didn't changed anything out of the ordinary in the api.yaml (second screenshot).

Can you please advise, am I missing something? I installed manager as root and when I do ps aux | grep wazuh-api, it shows some process.

Thanks in advance!

Djordje

[Facundo Dalmau]

Hi Djordje! Thanks for using Wazuh!

Please, could you share the contents of {WAZUH_PATH}/logs/ossec.log (especially those sections with WARNING or ERROR messages) and the output of the following command: {WAZUH_PATH}/bin/wazuh-control status ?

Best regards,

Facundo

[Djordje Dosic]

Hi Facundo, thanks for the fast response! Here is the output of requested commands:

xxxxxxxx:~# /data/ossec/bin/wazuh-control status
wazuh-clusterd not running...
wazuh-modulesd is running...
wazuh-monitord is running...
wazuh-logcollector is running...
wazuh-remoted is running...
wazuh-syscheckd is running...
wazuh-analysisd is running...
wazuh-maild not running...
wazuh-execd is running...
wazuh-db is running...
wazuh-authd is running...
wazuh-agentlessd not running...
wazuh-integratord not running...
wazuh-dbd not running...
wazuh-csyslogd not running...
wazuh-apid not running...
xxxxxxxxxx:~# grep 'ERROR\|WARNING' /data/ossec/logs/ossec.log
xxxxxxxxxx:~# 

Also I want to point out that it is single instance manager, no cluster, with default configuration.

Best regards

Djordje



Reply

Forward

F

[Facundo Dalmau]

Hi Djordje,

Could you execute data/ossec/bin/wazuh-control restart and share the logs inside data/ossec/logs/api.log to check what may have failed? Please don't forget to sanitize these logs by removing any sensitive data.

Regards

[Djordje Dosic]

Hi Facundo

After instructed restart, API started and it works!? Here is output:

xxxxxxxxxxxx:~# cat /data/ossec/logs/api.log
2023/02/06 12:59:13 INFO: Listening on 0.0.0.0:55000..

I've also checked Wazuh App in Kibana, everything seems fine. I don't know what happened. Anyway thanks for your help and sorry for bothering!!

Best regards

Djordje

[Facundo Dalmau]

No problem Djordje! Glad to read it works now, we are here to help!

Regards