Wazuh 4.3 - Dashboard Reporting Error

[swapnils]

Greetings!

I am completely new to Wazuh and this community. Currently I am facing issues while generating reports from Opensearch Visualization & Dashboard.Reports work well when fetched from Wazuh module itself but using opensearch visualize/dashboard, it fails. When I click 'pdf' icon, logs I get under wazuh-dashboard:/var/log/wazuh-dashboard/opensearch.log are -

---

{"type":"log","@timestamp":"2022-09-22T12:46:00Z","tags":["error","plugins","reportsDashboards"],"pid":101223,"message":"Failed to generate report by id: Error: Protocol error (Target.setDiscoverTargets): Target closed."}

{"type":"log","@timestamp":"2022-09-22T12:46:00Z","tags":["error","plugins","reportsDashboards"],"pid":101223,"message":"{ Error: Protocol error (Target.setDiscoverTargets): Target closed.\n    at Promise (/usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/puppeteer-core/lib/Connection.js:74:56)\n    at new Promise (<anonymous>)\n    at Connection.send (/usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/puppeteer-core/lib/Connection.js:73:12)\n    at Function.create (/usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/puppeteer-core/lib/Browser.js:34:22)\n    at Launcher.launch (/usr/share/wazuh-dashboard/plugins/reportsDashboards/node_modules/puppeteer-core/lib/Launcher.js:183:37)\n    at process._tickCallback (internal/process/next_tick.js:68:7)\n  message: 'Protocol error (Target.setDiscoverTargets): Target closed.' }"}

{"type":"error","@timestamp":"2022-09-22T12:46:00Z","tags":[],"pid":101223,"level":"error","error":{"message":"Internal Server Error","name":"Error","stack":"Error: Internal Server Error\n    at HapiResponseAdapter.toError (/usr/share/wazuh-dashboard/src/core/server/http/router/response_adapter.js:145:19)\n    at HapiResponseAdapter.toHapiResponse (/usr/share/wazuh-dashboard/src/core/server/http/router/response_adapter.js:99:19)\n    at HapiResponseAdapter.handle (/usr/share/wazuh-dashboard/src/core/server/http/router/response_adapter.js:94:17)\n    at Router.handle (/usr/share/wazuh-dashboard/src/core/server/http/router/router.js:164:34)"},"url":{"protocol":null,"slashes":null,"auth":null,"host":null,"port":null,"hostname":null,"hash":null,"search":"?timezone=Asia%2FKolkata&dateFormat=MMM%20D%2C%20YYYY%20%40%20HH%3Amm%3Ass.SSS&csvSeparator=%2C","query":{"timezone":"Asia/Kolkata","dateFormat":"MMM D, YYYY @ HH:mm:ss.SSS","csvSeparator":","},"pathname":"/api/reporting/generateReport/8Cl9ZIMBiyEdh9iqzhJT","path":"/api/reporting/generateReport/8Cl9ZIMBiyEdh9iqzhJT?timezone=Asia%2FKolkata&dateFormat=MMM%20D%2C%20YYYY%20%40%20HH%3Amm%3Ass.SSS&csvSeparator=%2C","href":"/api/reporting/generateReport/8Cl9ZIMBiyEdh9iqzhJT?timezone=Asia%2FKolkata&dateFormat=MMM%20D%2C%20YYYY%20%40%20HH%3Amm%3Ass.SSS&csvSeparator=%2C"},"message":"Internal Server Error"}

{"type":"response","@timestamp":"2022-09-22T12:46:00Z","tags":[],"pid":101223,"method":"get","statusCode":500,"req":{"url":"/api/reporting/generateReport/8Cl9ZIMBiyEdh9iqzhJT?timezone=Asia%2FKolkata&dateFormat=MMM%20D%2C%20YYYY%20%40%20HH%3Amm%3Ass.SSS&csvSeparator=%2C","method":"get","headers":{"host":"172.30.58.37","user-agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0","accept":"*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate, br","referer":"https://172.30.58.37/app/reports-dashboards","content-type":"application/json","osd-version":"1.2.0","connection":"keep-alive","sec-fetch-dest":"empty","sec-fetch-mode":"cors","sec-fetch-site":"same-origin"},"remoteAddress":"172.27.12.13","userAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0","referer":"https://172.30.58.37/app/reports-dashboards"},"res":{"statusCode":500,"responseTime":118,"contentLength":9},"message":"GET /api/reporting/generateReport/8Cl9ZIMBiyEdh9iqzhJT?timezone=Asia%2FKolkata&dateFormat=MMM%20D%2C%20YYYY%20%40%20HH%3Amm%3Ass.SSS&csvSeparator=%2C 500 118ms - 9.0B"}

---

Appreciate your help on this. Also I have noticed that above "@timestamp" is different than what I have on by dashboard box. My current setup is distributed where there are 2 wazuh-server, 2 wazuh-indexer & 1 wazuh-dashboard.

Reports generated with Wazuh module are residing under /usr/share/wazuh-dashboard/data/wazuh/downloads/reports/admin but visualization reports are nowhere seen.

Note: I have tried chrome related thread but that didn't solve the issue.

Thanks!

[Daniel Folch]

Hello,

The reportsDashboards module used by wazuh-dashboard to generate reports from the Visualize and Dashboards tabs uses a Chromium Headless instance to generate the reports, so it is necessary to have chromium or chrome installed in the wazuh-dashboard node to use it.

Here you have some documentation about how to troubleshoot problems with the reporting module and the necessary dependencies used by it

https://opensearch.org/docs/latest/dashboards/reporting/#troubleshooting
https://github.com/opensearch-project/dashboards-reports/blob/main/dashboards-reports/rendering-engine/headless-chrome/README.md#additional-libaries

Regards
Daniel F

​

[swapnils]

Thanks a ton Daniel! You are a savior!

I was so dumb that I tried updating Chrome on my local system through which I was accessing the dashboard URL..! :(

Just a suggestion : Will it be possible to incorporate these two links in Wazuh official documentation? It will help all.

Aside, one small query -

I have created visualization which will give details on failed SCA rules in tabular form. Result appears with around 10k rows. But for visualization/Dashboard purpose, I have set max rows to 50. While I download the report from this visualization, it only generates for 50 lines which are visible. Is there any way to handle this?

Thanks again!

- swapnils