Wazuh-Agent unable to create PID

[Dhiraj Ambigapathi]

Ran onto this error today, after running wazuh agents for moths without issue

2023/07/14 10:26:59 wazuh-agentd: INFO: Version detected -> Linux |domain |hostname |#1 SMP PREEMPT_DYNAMIC Debian 6.1.20-2kali1 (2023-04-18) |x86_64 [Kali GNU/Linux|kali: 2023.1] - Wazuh v4.3.10
2023/07/14 10:26:59 wazuh-agentd: ERROR: Could not write PID file 'var/run/wazuh-agentd-8278.pid': No space left on device (28)
2023/07/14 10:26:59 wazuh-agentd: CRITICAL: (1212): Unable to create PID file.

The storage and RAM
               total        used        free      shared  buff/cache   available
Mem:           11937         458       10721           5         757       11202
Swap:           2108           0        2108

Filesystem      Size  Used Avail Use% Mounted on
udev            6.3G     0  6.3G   0% /dev
tmpfs           1.3G  1.7M  1.3G   1% /run
/dev/sdb1        62G   58G     0 100% /
tmpfs           6.3G     0  6.3G   0% /dev/shm
tmpfs           5.3M     0  5.3M   0% /run/lock
/dev/sda1       106G   28G   73G  28% /home
tmpfs           1.3G   58k  1.3G   1% /run/user/1xx
tmpfs           1.3G   54k  1.3G   1% /run/user/10xx
tmpfs           1.3G   54k  1.3G   1% /run/user/10xx

Tried to uninstall agent, restart system, but problem persists

[Jeremiah Kolawole]

Hello Dhiraj,

Based on the error message, it seems that the Wazuh agent is unable to create a PID file due to insufficient disk space. 

The 'No space left on device' error indicates that the filesystem where the agent is installed is full. From the df -h command output you shared, the disk usage is at 100% for the filesystem where Wazuh is installed (/dev/sdb1 in this case). So, you will need to free up some space by deleting unnecessary files or expanding the disk capacity. 

Once you have freed up enough space, try restarting the Wazuh agent and check if the issue persists. 

If the problem continues, please provide more information about your system configuration and any relevant logs for further troubleshooting.

I hope this helps

[Dhiraj Ambigapathi]

I will try this