ERROR DASHBOARD

[Faber Andres Cubides]

Hello everyone,

We are experiencing a persistent circuit_breaking_exception error in our Wazuh Dashboard (OpenSearch Dashboards) and need help identifying the root cause, as we believe the memory assigned to the Indexer should be sufficient.

The wazuh-dashboard service repeatedly fails with the following error, indicating that the data request is too large for the allocated Dashboard memory (7.5 GB limit):

circuit_breaking_exception: [parent] Data too large, data for [<http_request>] would be [8392922020/7.8gb], which is larger than the limit of [8160437862/7.5gb]


(Both -Xms and -Xmx values are the same in their respective /etc/wazuh-indexer/jvm.options files.)

We have tried increasing Indexer capacity by adding a 16 GB node, but the Dashboard error persists. This suggests the issue may not be related to Indexer capacity, but rather to Dashboard configuration.

We would like to confirm:

Is it correct that the 7.5 GB limit comes from the Dashboard memory and not from the Indexer?

What max-old-space-size (Dashboard heap) is recommended for an Indexer setup of 64 GB + 16 GB?

Is there any additional configuration on the Indexer side that could be forcing such large responses to the Dashboard?

Any guidance or shared experience to resolve this memory exception would be greatly appreciated.

Thank you in advance!

[Bony V John]

Hi,

Apologies for the late response. It seems we somehow missed your thread.

From your screenshots, it looks like your Wazuh manager and indexer server are using a high amount of memory. The 7.5GB limit is coming from the Wazuh Indexer, not the Wazuh Dashboard. This error occurs because the dashboard is sending a large query to the indexer, and the indexer cannot process it due to insufficient JVM heap memory.

To fix this, we need to make sure the JVM heap size is large enough to handle the data load.

A few important recommendations for JVM memory:

• Do not use more than 50% of your total RAM

• Do not exceed 32GB of heap memory

First, check the memory available on your indexer node:

free -h

Next, edit the file:

/etc/wazuh-indexer/jvm.options

Update the JVM settings based on your system memory.
For example, if your server has 32GB RAM, set JVM heap to 16GB:

-Xms16g
-Xmx16g

After updating the file, restart the services:  

systemctl daemon-reload
systemctl restart wazuh-indexer
systemctl restart wazuh-dashboard

You can refer Wazuh indexer memory locking documentation for further details.

If the issue still persists, please provide the following:

1. Are you using an all-in-one deployment or a distributed deployment?

2. How many agents and devices are connected to your Wazuh server?

3. Do you have any custom dashboards running heavy or long-running queries?

4. Resource usage of your indexer and dashboard server:

   • Memory: free -h

   • Disk: df -h

   • CPU: top

I also recommend adding additional Wazuh indexer nodes if possible.
This will distribute the load, improve performance, and prevent memory-related issues in the future.
You can refer to the Wazuh documentation for adding more indexer nodes.