Error: Check Wazuh API Connection

[Brandon Payne]

This morning I'm getting this error when click on the Wazuh tab in the left Navigation menu

Check Wazuh API connection	Error
Check for Wazuh API version	Error
Check Elasticsearch index pattern	Ready
Check Elasticsearch template	Ready
Check index pattern known fields	Ready

I went back and looked at documentation (https://documentation.wazuh.com/3.11/installation-guide/securing_api.html) and restarted services and didn't make any difference. I also rebooted my virtual machine and getting the same results.

I tried this curl command and can't make much sense of the output. I did try running this without the --insecure option and I get a message about not trusting the certificate. If I use "http" (not s) in my curl command I get output  "(52) Empty reply from server"

[root@manager auth]# curl -u <user>:<pass> https://localhost:55000 --insecure

{"error":0,"data":{"msg":"Welcome to Wazuh HIDS API","api_version":"v3.11.3","hostname":"manager","timestamp":"Thu Mar 05 2020 17:09:35 GMT+0000 (UTC)"}}

I am using the default config.port 55000 (I double checked in the file /var/ossec/api/configuration/config.js). 

I did previously change the foo bar user/pass to something different. I double checked my wazuh.yml file and it correctly states my user/pass and port.

Running the single VM option, version 3.11. 

No updates have been performed that I'm aware of and its been working for a while previously. 

[Alberto Andujar]

Hello Brandon,

Could you check if you see any errors in this area, as you can see in the picture? Could you share it? 

Let's check some logs and see if we have any more information.

Can you attach the output of the following commands to me? To see if there are something erratic.

1. The Wazuh API log
   

cat /var/ossec/logs/api.log

       2. The Wazuh UI log 

cat /usr/share/kibana/optimize/wazuh-logs/wazuhapp.log

Best regards,

Alberto

[Brandon Payne]

I get the message "Wazuh not ready yet." in the area you pointed out in your screenshot. 

Attached the two log files

[Brandon Payne]

Just a quick update from my last post. While waiting, I went ahead and went through this again (https://documentation.wazuh.com/3.11/installation-guide/securing_api.html), rebooted and now everything is back to normal and connected. I didn't change ports or user/pass - kept all that the same.  

Thanks

-Brandon

[Alberto Andujar]

Hi Brandon,

I'm glad it's working out for you. Maybe the reboot of Wazuh api was not done properly.

Any questions please do not hesitate to open a new ticket

Regards,

Alberto

[Mona Singh]

hi,

i am facing the same issue , this command giving me the output I attached, can anyone help?

1. The Wazuh API log
   
   cat /var/ossec/logs/api.log

1/08/18 13:42:54 INFO: unknown_user 127.0.0.1 "GET /security/user/authenticate" with parameters {} and body {} done in 0.002s: 429
2021/08/18 13:42:54 INFO: unknown_user 127.0.0.1 "GET /manager/info" with parameters {} and body {} done in 0.002s: 429

[Mona Singh]

hi all,
can anyone help me with this

whenever I try to open wazuh manager getting this error

Wazuh App: Please set up Wazuh API credentials
Settings. Error getting API entries
Cannot initialize Setting