Wazuh will not start after upgrade

[Николай Грудов]

Hi all,

I was using Wazuh 4.10.0 on Ubuntu 22.04.4.

After upgrading to 4.10.1 I get "Wazuh dashboard server is not ready yet" when I try to access Wazuh.

I tried a few commands:

~# systemctl status wazuh-manager.service

● wazuh-manager.service - Wazuh manager
     Loaded: loaded (/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: enabled)
     Active: active (running) since Wed 2025-01-22 12:24:48 EET; 1h 34min ago
      Tasks: 195 (limit: 9283)
     Memory: 2.1G
        CPU: 4min 7.628s
     CGroup: /system.slice/wazuh-manager.service
             ├─1875 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─1876 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─1879 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─1882 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
             ├─1927 /var/ossec/bin/wazuh-authd
             ├─2052 /var/ossec/bin/wazuh-db
             ├─2098 /var/ossec/bin/wazuh-execd
             ├─2116 /var/ossec/bin/wazuh-maild
             ├─2123 /var/ossec/bin/wazuh-analysisd
             ├─2132 /var/ossec/bin/wazuh-syscheckd
             ├─2146 /var/ossec/bin/wazuh-remoted
             ├─2224 /var/ossec/bin/wazuh-logcollector
             ├─2240 /var/ossec/bin/wazuh-monitord
             └─2275 /var/ossec/bin/wazuh-modulesd

Jan 22 12:24:43 wazuh env[911]: Started wazuh-analysisd...
Jan 22 12:24:43 wazuh env[911]: Started wazuh-syscheckd...
Jan 22 12:24:44 wazuh env[911]: Started wazuh-remoted...
Jan 22 12:24:44 wazuh env[911]: Started wazuh-logcollector...
Jan 22 12:24:45 wazuh env[911]: Started wazuh-monitord...
Jan 22 12:24:45 wazuh env[2273]: 2025/01/22 12:24:45 wazuh-modulesd:router: INFO: Loaded router module.
Jan 22 12:24:45 wazuh env[2273]: 2025/01/22 12:24:45 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
Jan 22 12:24:46 wazuh env[911]: Started wazuh-modulesd...
Jan 22 12:24:48 wazuh env[911]: Completed.
Jan 22 12:24:48 wazuh systemd[1]: Started Wazuh manager.

~# systemctl status wazuh-dashboard.service

● wazuh-dashboard.service - wazuh-dashboard
     Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)
     Active: active (running) since Wed 2025-01-22 12:27:18 EET; 1h 33min ago
   Main PID: 4648 (node)
      Tasks: 11 (limit: 9283)
     Memory: 178.7M
        CPU: 20.656s
     CGroup: /system.slice/wazuh-dashboard.service
             └─4648 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist

Jan 22 14:00:12 wazuh opensearch-dashboards[4648]: {"type":"log","@timestamp":"2025-01-22T12:00:12Z","tags":["error","opensearch","data"],"pid":4648,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}

Jan 22 14:00:15 wazuh opensearch-dashboards[4648]: {"type":"log","@timestamp":"2025-01-22T12:00:15Z","tags":["error","opensearch","data"],"pid":4648,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Jan 22 14:00:17 wazuh opensearch-dashboards[4648]: {"type":"log","@timestamp":"2025-01-22T12:00:17Z","tags":["error","opensearch","data"],"pid":4648,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Jan 22 14:00:20 wazuh opensearch-dashboards[4648]: {"type":"log","@timestamp":"2025-01-22T12:00:20Z","tags":["error","opensearch","data"],"pid":4648,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Jan 22 14:00:22 wazuh opensearch-dashboards[4648]: {"type":"log","@timestamp":"2025-01-22T12:00:22Z","tags":["error","opensearch","data"],"pid":4648,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Jan 22 14:00:25 wazuh opensearch-dashboards[4648]: {"type":"log","@timestamp":"2025-01-22T12:00:25Z","tags":["error","opensearch","data"],"pid":4648,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Jan 22 14:00:27 wazuh opensearch-dashboards[4648]: {"type":"log","@timestamp":"2025-01-22T12:00:27Z","tags":["error","opensearch","data"],"pid":4648,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Jan 22 14:00:30 wazuh opensearch-dashboards[4648]: {"type":"log","@timestamp":"2025-01-22T12:00:30Z","tags":["error","opensearch","data"],"pid":4648,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Jan 22 14:00:32 wazuh opensearch-dashboards[4648]: {"type":"log","@timestamp":"2025-01-22T12:00:32Z","tags":["error","opensearch","data"],"pid":4648,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Jan 22 14:00:35 wazuh opensearch-dashboards[4648]: {"type":"log","@timestamp":"2025-01-22T12:00:35Z","tags":["error","opensearch","data"],"pid":4648,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}

~#  systemctl status wazuh-indexer.service

× wazuh-indexer.service - wazuh-indexer
     Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Wed 2025-01-22 12:24:39 EET; 1h 38min ago
       Docs: https://documentation.wazuh.com
   Main PID: 910 (code=exited, status=1/FAILURE)
        CPU: 3.873s

Jan 22 12:24:39 wazuh systemd-entrypoint[910]:         at org.opensearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:104)
Jan 22 12:24:39 wazuh systemd-entrypoint[910]:         at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
Jan 22 12:24:39 wazuh systemd-entrypoint[910]:         at org.opensearch.cli.Command.main(Command.java:101)
Jan 22 12:24:39 wazuh systemd-entrypoint[910]:         at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:138)
Jan 22 12:24:39 wazuh systemd-entrypoint[910]:         at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:104)
Jan 22 12:24:39 wazuh systemd-entrypoint[910]: For complete error details, refer to the log at /var/log/wazuh-indexer/wazuh-cluster.log
Jan 22 12:24:39 wazuh systemd[1]: wazuh-indexer.service: Main process exited, code=exited, status=1/FAILURE
Jan 22 12:24:39 wazuh systemd[1]: wazuh-indexer.service: Failed with result 'exit-code'.
Jan 22 12:24:39 wazuh systemd[1]: Failed to start wazuh-indexer.
Jan 22 12:24:39 wazuh systemd[1]: wazuh-indexer.service: Consumed 3.873s CPU time.

~# /usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh -u kibanaserver -p ****** -v

22/01/2025 12:27:15 INFO: Updating the internal users.
Security Admin v7
Will connect to 127.0.0.1:9200

ERR: Seems there is no OpenSearch running on 127.0.0.1:9200 - Will exit

.....

Please help.

[Francis Timilehin Jeremiah]

Hello, you have that error because the Wazuh dashboard cannot connect to the Wazuh indexer. I do not see any major errors so far. Do systemctl start wazuh-indexer.service to start the Wazuh indexer and check the dashboard again.

[Николай Грудов]

Thank you for the fast response, all good now!