Hey,
every night on 00:00 when the logs are getting rotated I get the error:
"Aug 9 00:00:00 wazuh systemd-entrypoint[1271]: ERROR StatusConsoleListener Could not define attribute view on path "/var/log/wazuh-indexer/wazuh-cluster_server.json" got access denied ("java.lang.RuntimePermission" "accessUserInformation")
Aug 9 00:00:00 wazuh systemd-entrypoint[1271]: ERROR StatusConsoleListener Could not define attribute view on path "/var/log/wazuh-indexer/wazuh-cluster.log" got access denied ("java.lang.RuntimePermission" "accessUserInformation")"
This seems to be a known issue (seen here: https://github.com/wazuh/wazuh-indexer/issues/205, https://github.com/opensearch-project/OpenSearch/issues/9609 or https://github.com/wazuh/wazuh-packages/issues/2139#issuecomment-2049442145)
Although it's marked as closed in some cases I get this error. Also the workaround which tells me to add
grant
{
permission java.lang.RuntimePermission
"accessUserInformation";
};
to the end of
/etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy does not solve this problem.
I am using
Ubuntu 22.04.4 LTS
Has anyone else seen this?
Cheers chic
Hello,
Could you run and share the output of ls -lsah /var/log/wazuh-indexer to check the ownership and permissions of the directory?
Thank you.
Hello,
The permissions seems okay.
If you have correctly implemented the solution here you could try to restart the Wazuh components and check again the logs.
If that doesn't fix the issue you will have to wait to the release of 4.9.0 as this bug is fixed on that version. If the bug persists after upgrading to 4.9.0, please open us an issue here: https://github.com/wazuh/wazuh/issues/new?assignees=&labels=&projects=&template=default.md&title=
--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/24a50e03-9a5c-4ad0-8411-956708cf3cban%40googlegroups.com.
Hello,
The solution seems to be correct from your side except the owner and group should be both wazuh-indexer. And remember you have to restart the Wazuh Indexer, that's the component that is giving the error.
If doing that does not work, I would wait for the fix on 4.9.0 and if it
keeps giving error after upgrading, open us an issue please.
Thank you.