Bump Wazuh indexer to OpenSearch 2.10.0

[rauldpm]

Description

It is necessary to adapt the Wazuh indexer to version 2.10.0 of OpenSearch
Request: https://github.com/wazuh/internal-devel-requests/issues/301

Tasks

• Bump OpenSearch version https://github.com/wazuh/wazuh-packages/blob/master/stack/indexer/base/builder.sh#L19
• Build the package locally
  • Base
  • RPM
  • DEB
• Test the packages locally
  • RPM
  • DEB
• Modify https://github.com/wazuh/wazuh-packages/blob/master/README.md matrix with the new version
• Create ECS and ECR resources (base, rpm, deb)
• Test the package using the Test_stack pipeline https://ci.wazuh.info/job/Test_stack_tier/97/
• Test the package using the Wazuh installation assistant

Stages

• Build Base and RPM packages: Bump Wazuh indexer to OpenSearch 2.10.0 #2520 (comment)
• RPM analysis report: Bump Wazuh indexer to OpenSearch 2.10.0 #2520 (comment)
• Build DEB package: Bump Wazuh indexer to OpenSearch 2.10.0 #2520 (comment)
• DEB analysis report: Bump Wazuh indexer to OpenSearch 2.10.0 #2520 (comment)
• New Master key configuration analysis: Bump Wazuh indexer to OpenSearch 2.10.0 #2520 (comment)
• Upgrade from 4.5.3: Bump Wazuh indexer to OpenSearch 2.10.0 #2520 (comment)

Validation

• The package presents normal operation and without errors

---

Working branch

• enhancement/2520-bump-indexer

[rauldpm]

Update report - Bump and building packages - Base and RPM

Base

• Bumped readme
• Bumped base version
• The base file was built successfully
  • https://packages-dev.wazuh.com/warehouse/test/4.8/stack/wazuh-indexer-base-4.8.0-wp2520-linux-x64.tar.xz
  • base.log

---

RPM

• Package creation fails due to changes in dependency versions

Files not found

    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-job-scheduler/opensearch-job-scheduler-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-job-scheduler/opensearch-job-scheduler-spi-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-job-scheduler/guava-31.0.1-jre.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/tokenizers-0.19.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/opensearch-ml-algorithms-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/opensearch-ml-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/api-0.19.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/j2objc-annotations-1.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/gson-2.9.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/opensearch-rest-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/onnxruntime-engine-0.19.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/pytorch-model-zoo-0.19.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/error_prone_annotations-2.7.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/checker-qual-3.12.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/commons-compress-1.21.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/jackson-databind-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/jackson-annotations-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/httpcore-nio-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/pytorch-engine-0.19.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/onnxruntime_gpu-1.13.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/opensearch-ml-common-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/guava-31.0.1-jre.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/woodstox-core-6.4.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/jjwt-impl-0.10.8.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/parent-join-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/netty-transport-native-unix-common-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/mapper-extras-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/error_prone_annotations-2.3.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/commons-lang-2.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/json-smart-2.4.10.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/j2objc-annotations-1.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/netty-buffer-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/transport-netty4-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/zxcvbn-1.7.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/jakarta.xml.bind-api-2.3.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/netty-resolver-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/opensearch-rest-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/commons-codec-1.14.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/java-saml-core-2.5.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/lang-mustache-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/json-path-2.4.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/netty-common-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/bcpkix-jdk15on-1.70.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/commons-lang3-3.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/eventbus-3.2.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/guava-30.0-jre.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/netty-handler-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/jjwt-api-0.10.8.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/jackson-databind-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/aggs-matrix-stats-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/jackson-annotations-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/cxf-core-3.5.5.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/xmlsec-2.2.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/httpclient-cache-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/zstd-jni-1.5.2-1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/zjsonpatch-0.4.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/httpcore-nio-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/cxf-rt-rs-security-jose-3.5.5.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/java-saml-2.5.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/cryptacular-1.2.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/netty-transport-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/asm-9.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/opensearch-security-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/cxf-rt-security-3.5.5.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/netty-codec-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/rank-eval-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/slf4j-api-1.7.30.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/commons-cli-1.3.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/opensearch-rest-high-level-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/cxf-rt-rs-json-basic-3.5.5.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/netty-codec-http-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/jjwt-jackson-0.10.8.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/kafka-clients-3.4.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/json-flattener-0.5.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/checker-qual-3.5.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/commons-collections-3.2.2.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/log4j-slf4j-impl-2.17.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/metrics-core-3.1.2.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/httpcore-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/snappy-java-1.1.8.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/jaxb-runtime-2.3.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/txw2-2.3.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/jakarta.annotation-api-1.3.5.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/istack-commons-runtime-3.0.12.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/bcprov-jdk15on-1.67.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-index-management/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-index-management/opensearch-index-management-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-index-management/opensearch-index-management-spi-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-index-management/httpcore-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-index-management/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-neural-search/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-neural-search/opensearch-neural-search-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-neural-search/opensearch-ml-client-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications/opensearch-notifications-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications/kotlin-stdlib-common-1.6.10.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-asynchronous-search/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-asynchronous-search/opensearch-asynchronous-search-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/error_prone_annotations-2.3.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/j2objc-annotations-1.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/kotlin-stdlib-jdk8-1.6.10.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/opensearch-rest-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/kotlin-stdlib-jdk7-1.6.10.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/kotlin-stdlib-1.6.10.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/guava-30.0-jre.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/httpcore-nio-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/alerting-core-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/checker-qual-3.5.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/percolator-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/httpcore-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/opensearch-alerting-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/kotlin-stdlib-common-1.6.10.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/datasources-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/opensearch-sql-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/okhttp-4.9.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/parent-join-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/core-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/j2objc-annotations-1.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/opensearch-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/bcprov-ext-jdk15on-1.70.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/opensearch-rest-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/error_prone_annotations-2.7.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/checker-qual-3.12.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/sql-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/opensearch-ssl-config-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/kotlin-stdlib-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/jackson-databind-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/legacy-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/jackson-annotations-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/okio-jvm-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/aws-encryption-sdk-java-2.4.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/geo-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/httpcore-nio-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/opensearch-ml-client-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/reindex-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/protocol-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/prometheus-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/ppl-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/common-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/kotlin-stdlib-jdk7-1.4.30.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/guava-31.0.1-jre.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-geospatial/geo-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-geospatial/opensearch-geospatial-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-geospatial/commons-lang3-3.12.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-geospatial/h3-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-reports-scheduler/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-reports-scheduler/kotlin-stdlib-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-reports-scheduler/kotlin-stdlib-common-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-reports-scheduler/opensearch-reports-scheduler-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-reports-scheduler/kotlin-test-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-cross-cluster-replication/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-cross-cluster-replication/opensearch-cross-cluster-replication-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-cross-cluster-replication/kotlin-stdlib-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-cross-cluster-replication/kotlin-stdlib-common-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-cross-cluster-replication/kotlin-stdlib-jdk8-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-cross-cluster-replication/kotlin-stdlib-jdk7-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-knn/opensearch-knn-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-knn/guava-30.0-jre.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/opensearch-anomaly-detection-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/randomcutforest-parkservices-3.0-rc3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/opensearch-rest-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/randomcutforest-serialization-3.0-rc3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/httpcore-nio-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/commons-lang3-3.12.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/httpcore-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/randomcutforest-core-3.0-rc3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications-core/kotlin-stdlib-1.6.10.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications-core/jackson-databind-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications-core/jackson-annotations-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications-core/opensearch-notifications-core-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications-core/opensearch-notifications-core-spi-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications-core/httpcore-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications-core/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications-core/kotlin-stdlib-common-1.6.10.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security-analytics/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security-analytics/opensearch-rest-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security-analytics/opensearch-security-analytics-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security-analytics/httpcore-nio-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security-analytics/commons-lang3-3.12.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security-analytics/httpcore-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security-analytics/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-observability/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-observability/kotlin-stdlib-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-observability/kotlin-stdlib-common-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-observability/opensearch-observability-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/jackson-module-paranamer-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/opensearch-performance-analyzer-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-transport-native-unix-common-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/performance-analyzer-commons-1.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/j2objc-annotations-1.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-buffer-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-resolver-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-handler-proxy-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-common-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-handler-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-codec-socks-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/jackson-databind-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/jackson-annotations-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-codec-http2-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/bcprov-jdk15on-1.70.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-transport-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-codec-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/guava-31.1-jre.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-common/opensearch-grok-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-common/joni-2.1.44.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-common/opensearch-dissect-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-common/ingest-common-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/repository-url/repository-url-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/percolator/percolator-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/search-pipeline-common/search-pipeline-common-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/opensearch-dashboards/opensearch-rest-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/opensearch-dashboards/opensearch-ssl-config-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/opensearch-dashboards/opensearch-dashboards-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/opensearch-dashboards/httpcore-nio-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/opensearch-dashboards/reindex-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/opensearch-dashboards/httpcore-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/opensearch-dashboards/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/lang-painless/lang-painless-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/lang-painless/opensearch-scripting-painless-spi-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/analysis-common/analysis-common-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/rank-eval/rank-eval-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/aggs-matrix-stats/aggs-matrix-stats-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/geo/geo-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/mapper-extras/mapper-extras-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-user-agent/ingest-user-agent-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/systemd/systemd-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/netty-transport-native-unix-common-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/netty-buffer-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/transport-netty4-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/netty-resolver-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/netty-common-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/netty-handler-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/netty-transport-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/netty-codec-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/netty-codec-http-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/parent-join/parent-join-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/lang-mustache/lang-mustache-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-geoip/maxmind-db-2.1.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-geoip/jackson-databind-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-geoip/ingest-geoip-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-geoip/jackson-annotations-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-geoip/geoip2-3.0.2.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/reindex/opensearch-rest-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/reindex/opensearch-ssl-config-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/reindex/httpcore-nio-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/reindex/reindex-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/reindex/httpcore-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/reindex/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/lang-expression/lang-expression-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/lang-expression/lucene-expressions-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/tools/upgrade-cli/opensearch-upgrade-cli-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/tools/upgrade-cli/jackson-core-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/tools/upgrade-cli/jackson-databind-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/tools/upgrade-cli/jackson-annotations-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/tools/plugin-cli/opensearch-plugin-cli-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/tools/keystore-cli/keystore-cli-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/log4j-core-2.17.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-misc-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-launchers-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-cli-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-core-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/jackson-core-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-spatial-extras-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-memory-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/hppc-0.8.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/log4j-api-2.17.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-secure-sm-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-x-content-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-backward-codecs-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-core-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/java-version-checker-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/jackson-dataformat-yaml-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-plugin-classloader-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-spatial3d-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-common-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/jackson-dataformat-cbor-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-suggest-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-geo-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-grouping-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-sandbox-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-queryparser-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-highlighter-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-join-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/jackson-dataformat-smile-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/snakeyaml-2.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-analysis-common-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/log4j-jul-2.17.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-queries-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/log4j-core-2.17.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-transport-native-unix-common-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/commons-lang3-3.9.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/jackson-core-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/performance-analyzer-commons-1.0.0-SNAPSHOT.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/j2objc-annotations-1.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-buffer-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-resolver-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/log4j-api-2.17.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/perfmark-api-0.25.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-handler-proxy-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-common-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/performance-analyzer-rca-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/bcpkix-jdk15on-1.70.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-handler-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-codec-socks-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/jackson-databind-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/jackson-annotations-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/proto-google-common-protos-2.9.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-codec-http2-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/bcprov-jdk15on-1.70.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/grpc-context-1.52.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/error_prone_annotations-2.14.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/grpc-api-1.52.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/javax.annotation-api-1.3.2.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-transport-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-codec-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/bcutil-jdk15on-1.70.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/grpc-protobuf-1.52.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-codec-http-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/grpc-netty-1.52.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/grpc-protobuf-lite-1.52.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/gson-2.9.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/checker-qual-3.29.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/animal-sniffer-annotations-1.21.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/guava-31.1-jre.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/grpc-core-1.52.1.jar

• Modified the spec file in order to avoid listing each file and use *

%attr(640, %{USER}, %{GROUP}) %{INSTALL_DIR}/modules/reindex/*.jar

• The Wazuh indexer file was built successfully
  • https://packages-dev.wazuh.com/warehouse/test/4.8/rpm/var/wazuh-indexer-4.8.0-wp2520.x86_64.rpm
  • build.log
• Installed files
  • files.log

[rauldpm]

Analysis report - RPM

• Found a message error when creating the certificates, reported at Message error generating the Wazuh certificates #2524

mkdir: cannot create directory ‘>> /dev/null 2>&1’: No such file or directory

Install 🟢

[root@centos7 vagrant]# yum localinstall wazuh-indexer-4.8.0-wp2520.x86_64.rpm 
Loaded plugins: fastestmirror
Examining wazuh-indexer-4.8.0-wp2520.x86_64.rpm: wazuh-indexer-4.8.0-wp2520.x86_64
Marking wazuh-indexer-4.8.0-wp2520.x86_64.rpm to be installed
Resolving Dependencies
--> Running transaction check
---> Package wazuh-indexer.x86_64 0:4.8.0-wp2520 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

=============================================================================================================================================================================================================================================
 Package                                               Arch                                           Version                                               Repository                                                                  Size
=============================================================================================================================================================================================================================================
Installing:
 wazuh-indexer                                         x86_64                                         4.8.0-wp2520                                          /wazuh-indexer-4.8.0-wp2520.x86_64                                         1.0 G

Transaction Summary
=============================================================================================================================================================================================================================================
Install  1 Package

Total size: 1.0 G
Installed size: 1.0 G
Is this ok [y/d/N]: y
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : wazuh-indexer-4.8.0-wp2520.x86_64                                                                                                                                                                                         1/1 
Created opensearch keystore in /etc/wazuh-indexer/opensearch.keystore
  Verifying  : wazuh-indexer-4.8.0-wp2520.x86_64                                                                                                                                                                                         1/1 

Installed:
  wazuh-indexer.x86_64 0:4.8.0-wp2520                                                                                                                                                                                                        

Complete!

Certificate creation 🟡 and certificates copy 🟢

[root@centos7 vagrant]# nano config.yml 
[root@centos7 vagrant]# bash ./wazuh-certs-tool.sh -A
mkdir: cannot create directory ‘>> /dev/null 2>&1’: No such file or directory
11/10/2023 20:38:34 INFO: Admin certificates created.
11/10/2023 20:38:34 INFO: Wazuh indexer certificates created.
[root@centos7 vagrant]# cat config.yml 
nodes:
  # Wazuh indexer nodes
  indexer:
    - name: indexer-1
      ip: "192.168.56.4"
[root@centos7 vagrant]# ls
config.yml  wazuh-certificates  wazuh-certs-tool.sh  wazuh-indexer-4.8.0-wp2520.x86_64.rpm
[root@centos7 vagrant]# ls wazuh-certificates/
admin-key.pem  admin.pem  indexer-1-key.pem  indexer-1.pem  root-ca.key  root-ca.pem
[root@centos7 vagrant]# tar -cvf ./wazuh-certificates.tar -C ./wazuh-certificates/ .
./
./root-ca.key
./root-ca.pem
./admin-key.pem
./admin.pem
./indexer-1-key.pem
./indexer-1.pem

[root@centos7 vagrant]# NODE_NAME=node-1
[root@centos7 vagrant]# NODE_NAME=indexer-1
[root@centos7 vagrant]# mkdir /etc/wazuh-indexer/certs
[root@centos7 vagrant]# tar -xf ./wazuh-certificates.tar -C /etc/wazuh-indexer/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
[root@centos7 vagrant]# mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
[root@centos7 vagrant]# mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
[root@centos7 vagrant]# chmod 500 /etc/wazuh-indexer/certs
[root@centos7 vagrant]# chmod 400 /etc/wazuh-indexer/certs/*
[root@centos7 vagrant]# chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs
[root@centos7 vagrant]# NODE_NAME=indexer-1
[root@centos7 vagrant]# mkdir /etc/wazuh-indexer/certs
[root@centos7 vagrant]# tar -xf ./wazuh-certificates.tar -C /etc/wazuh-indexer/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
[root@centos7 vagrant]# mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
[root@centos7 vagrant]# mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
[root@centos7 vagrant]# chmod 500 /etc/wazuh-indexer/certs
[root@centos7 vagrant]# chmod 400 /etc/wazuh-indexer/certs/*
[root@centos7 vagrant]# chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs

Start service 🟢

[root@centos7 vagrant]# systemctl daemon-reload
[root@centos7 vagrant]# systemctl enable wazuh-indexer
Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-indexer.service to /usr/lib/systemd/system/wazuh-indexer.service.
[root@centos7 vagrant]# systemctl start wazuh-indexer
[root@centos7 vagrant]# systemctl status wazuh-indexer
● wazuh-indexer.service - Wazuh-indexer
   Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2023-10-11 20:50:31 UTC; 7s ago
     Docs: https://documentation.wazuh.com
 Main PID: 22409 (java)
   CGroup: /system.slice/wazuh-indexer.service
           └─22409 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8...

Oct 11 20:50:25 centos7 systemd[1]: Starting Wazuh-indexer...
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: System::setSecurityManager will be removed in a future release
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: System::setSecurityManager will be removed in a future release
Oct 11 20:50:31 centos7 systemd[1]: Started Wazuh-indexer.

Initialize cluster 🟢

[root@centos7 vagrant]# /usr/share/wazuh-indexer/bin/indexer-security-init.sh
**************************************************************************
** This tool will be deprecated in the next major release of OpenSearch **
** https://github.com/opensearch-project/security/issues/1755           **
**************************************************************************
Security Admin v7
Will connect to 127.0.0.1:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.10.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
Populate config from /etc/wazuh-indexer/opensearch-security/
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml 
   SUCC: Configuration for 'config' created or updated
Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml 
   SUCC: Configuration for 'roles' created or updated
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml 
   SUCC: Configuration for 'rolesmapping' created or updated
Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml 
   SUCC: Configuration for 'internalusers' created or updated
Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml 
   SUCC: Configuration for 'actiongroups' created or updated
Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml 
   SUCC: Configuration for 'tenants' created or updated
Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml 
   SUCC: Configuration for 'nodesdn' created or updated
Will update '/whitelist' with /etc/wazuh-indexer/opensearch-security/whitelist.yml 
   SUCC: Configuration for 'whitelist' created or updated
Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml 
   SUCC: Configuration for 'audit' created or updated
Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml 
   SUCC: Configuration for 'allowlist' created or updated
SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"]) due to: null
Done with success

Check cluster health 🟢

[root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200
{
  "name" : "node-1",
  "cluster_name" : "wazuh-cluster",
  "cluster_uuid" : "olvQC435S2aCcHYDPmbbbQ",
  "version" : {
    "number" : "7.10.2",
    "build_type" : "rpm",
    "build_hash" : "eee49cb340edc6c4d489bcd9324dda571fc8dc03",
    "build_date" : "2023-09-20T23:54:29.889267151Z",
    "build_snapshot" : false,
    "lucene_version" : "9.7.0",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}

[root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cat/nodes?v
ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
10.0.2.15           45          94   2    0.14    0.08     0.06 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1

[root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cat/shards
.opensearch-observability        0 p STARTED  0   208b 10.0.2.15 node-1
.plugins-ml-config               0 p STARTED  1  3.8kb 10.0.2.15 node-1
.opensearch-sap-log-types-config 0 p STARTED           10.0.2.15 node-1
.opendistro_security             0 p STARTED 10 64.3kb 10.0.2.15 node-1

[root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cluster/health?pretty
{
  "cluster_name" : "wazuh-cluster",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "discovered_master" : true,
  "discovered_cluster_manager" : true,
  "active_primary_shards" : 4,
  "active_shards" : 4,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}

---

Logs

journal 🟢

-- Logs begin at Wed 2023-10-11 17:25:02 UTC, end at Wed 2023-10-11 21:01:01 UTC. --
Oct 11 20:50:31 centos7 systemd[1]: Started Wazuh-indexer.
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: System::setSecurityManager will be removed in a future release
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: System::setSecurityManager will be removed in a future release
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 11 20:50:25 centos7 systemd[1]: Starting Wazuh-indexer...

/var/log/wazuh-indexer 🟡

• wazuh-cluster_deprecations.json

  • Reported at OpenSearch deprecation messages #2518 (comment)

  {"type": "deprecation", "timestamp": "2023-10-11T20:50:28,117Z", "level": "DEPRECATION", "component": "o.o.d.c.s.Settings", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "[node.max_local_storage_nodes] setting was deprecated in OpenSearch and will be removed in a future release! See the breaking changes documentation for the next major version." }
  

  {"type": "deprecation", "timestamp": "2023-10-11T20:50:29,030Z", "level": "DEPRECATION", "component": "o.o.d.c.s.Settings", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "[index.store.hybrid.mmap.extensions] setting was deprecated in OpenSearch and will be removed in a future release! See the breaking changes documentation for the next major version." }
  

  {"type": "deprecation", "timestamp": "2023-10-11T20:50:29,032Z", "level": "DEPRECATION", "component": "o.o.d.c.s.Settings", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "[cluster.initial_master_nodes] setting was deprecated in OpenSearch and will be removed in a future release! See the breaking changes documentation for the next major version." }
  

  {"type": "deprecation", "timestamp": "2023-10-11T20:50:30,685Z", "level": "DEPRECATION", "component": "o.o.d.a.m.TransportMainAction", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "overriding main response version number will be removed in a future version" }
  

  {"type": "deprecation", "timestamp": "2023-10-11T20:50:31,150Z", "level": "DEPRECATION", "component": "o.o.d.c.m.MetadataCreateIndexService", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "index name [.opensearch-observability] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices", "cluster.uuid": "olvQC435S2aCcHYDPmbbbQ", "node.id": "AP8Lch6dQLiTv-xA-wRP1Q"  }
  

  {"type": "deprecation", "timestamp": "2023-10-11T20:51:07,139Z", "level": "DEPRECATION", "component": "o.o.d.c.m.IndexNameExpressionResolver", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "this request accesses system indices: [.opendistro_security], but in a future major version, direct access to system indices will be prevented by default", "cluster.uuid": "olvQC435S2aCcHYDPmbbbQ", "node.id": "AP8Lch6dQLiTv-xA-wRP1Q"  }
  

• wazuh-cluster_server.json

  • Warning found at Indexer stops working after reboot #1962 and Multiple messages in Wazuh indexer wazuh-cluster.log file asking to run securityadmin after reboot #1582

  {"type": "server", "timestamp": "2023-10-11T20:50:29,517Z", "level": "WARN", "component": "o.o.s.c.Salt", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "If you plan to use field masking pls configure compliance salt e1ukloTsQlOgPquJ to be a random string of 16 chars length identical on all nodes" }
  

  ---

  • Related Warning and error logs found in wazuh-indexer in demo environment #1511

  {"type": "server", "timestamp": "2023-10-11T20:50:29,533Z", "level": "ERROR", "component": "o.o.s.a.s.SinkProvider", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Default endpoint could not be created, auditlog will not work properly." }
  {"type": "server", "timestamp": "2023-10-11T20:50:29,534Z", "level": "WARN", "component": "o.o.s.a.r.AuditMessageRouter", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "No default storage available, audit log may not work properly. Please check configuration." }
  

  ---

  • New warning, specific info at https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information

  {"type": "server", "timestamp": "2023-10-11T20:50:29,988Z", "level": "WARN", "component": "o.o.s.p.SQLPlugin", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information" }
  

  ---

  Reported at Wazuh indexer warning message about dangling indices #2519

  {"type": "server", "timestamp": "2023-10-11T20:50:30,573Z", "level": "WARN", "component": "o.o.g.DanglingIndicesState", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "gateway.auto_import_dangling_indices is disabled, dangling indices will not be automatically detected or imported and must be managed manually" }
  

  ---

  • Reported at Connection error in Wazuh indexer 2.10.0 #2514

  {"type": "server", "timestamp": "2023-10-11T20:50:31,093Z", "level": "ERROR", "component": "o.o.s.t.SecurityRequestHandler", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "OpenSearchException[Transport client authentication no longer supported.]" }
  

  {"type": "server", "timestamp": "2023-10-11T20:50:31,096Z", "level": "WARN", "component": "o.o.d.HandshakingTransportAddressConnector", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "handshake failed for [connectToRemoteMasterNode[[::1]:9300]]", 
  "stacktrace": ["org.opensearch.transport.RemoteTransportException: [node-1][[::1]:9300][internal:transport/handshake]",
  "Caused by: org.opensearch.OpenSearchException: Transport client authentication no longer supported.",
  "at org.opensearch.security.ssl.util.ExceptionUtils.createTransportClientNoLongerSupportedException(ExceptionUtils.java:68) ~[?:?]",
  "at org.opensearch.security.transport.SecurityRequestHandler.messageReceivedDecorate(SecurityRequestHandler.java:292) ~[?:?]",
  "at org.opensearch.security.ssl.transport.SecuritySSLRequestHandler.messageReceived(SecuritySSLRequestHandler.java:163) ~[?:?]",
  "at org.opensearch.security.OpenSearchSecurityPlugin$7$1.messageReceived(OpenSearchSecurityPlugin.java:763) ~[?:?]",
  "at org.opensearch.indexmanagement.rollup.interceptor.RollupInterceptor$interceptHandler$1.messageReceived(RollupInterceptor.kt:113) ~[?:?]",
  "at org.opensearch.performanceanalyzer.transport.PerformanceAnalyzerTransportRequestHandler.messageReceived(PerformanceAnalyzerTransportRequestHandler.java:43) ~[?:?]",
  "at org.opensearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:106) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundHandler.handleRequest(InboundHandler.java:250) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundHandler.messageReceived(InboundHandler.java:133) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundHandler.inboundMessage(InboundHandler.java:115) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.TcpTransport.inboundMessage(TcpTransport.java:767) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundPipeline.forwardFragments(InboundPipeline.java:175) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundPipeline.doHandleBytes(InboundPipeline.java:150) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundPipeline.handleBytes(InboundPipeline.java:115) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:95) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
  "at io.netty.handler.logging.LoggingHandler.channelRead(LoggingHandler.java:280) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
  "at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:103) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
  "at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1466) ~[?:?]",
  "at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1329) ~[?:?]",
  "at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1378) ~[?:?]",
  "at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:529) ~[?:?]",
  "at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:468) ~[?:?]",
  "at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
  "at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
  "at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) ~[?:?]",
  "at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) ~[?:?]",
  "at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788) ~[?:?]",
  "at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:689) ~[?:?]",
  "at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:652) ~[?:?]",
  "at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) ~[?:?]",
  "at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) ~[?:?]",
  "at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) ~[?:?]",
  "at java.lang.Thread.run(Thread.java:833) [?:?]"] }
  {"type": "server", "timestamp": "2023-10-11T20:50:31,104Z", "level": "WARN", "component": "o.o.d.HandshakingTransportAddressConnector", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "handshake failed for [connectToRemoteMasterNode[127.0.0.1:9300]]", 
  "stacktrace": ["org.opensearch.transport.RemoteTransportException: [node-1][127.0.0.1:9300][internal:transport/handshake]",
  "Caused by: org.opensearch.OpenSearchException: Transport client authentication no longer supported.",
  "at org.opensearch.security.ssl.util.ExceptionUtils.createTransportClientNoLongerSupportedException(ExceptionUtils.java:68) ~[?:?]",
  "at org.opensearch.security.transport.SecurityRequestHandler.messageReceivedDecorate(SecurityRequestHandler.java:292) ~[?:?]",
  "at org.opensearch.security.ssl.transport.SecuritySSLRequestHandler.messageReceived(SecuritySSLRequestHandler.java:163) ~[?:?]",
  "at org.opensearch.security.OpenSearchSecurityPlugin$7$1.messageReceived(OpenSearchSecurityPlugin.java:763) ~[?:?]",
  "at org.opensearch.indexmanagement.rollup.interceptor.RollupInterceptor$interceptHandler$1.messageReceived(RollupInterceptor.kt:113) ~[?:?]",
  "at org.opensearch.performanceanalyzer.transport.PerformanceAnalyzerTransportRequestHandler.messageReceived(PerformanceAnalyzerTransportRequestHandler.java:43) ~[?:?]",
  "at org.opensearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:106) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundHandler.handleRequest(InboundHandler.java:250) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundHandler.messageReceived(InboundHandler.java:133) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundHandler.inboundMessage(InboundHandler.java:115) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.TcpTransport.inboundMessage(TcpTransport.java:767) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundPipeline.forwardFragments(InboundPipeline.java:175) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundPipeline.doHandleBytes(InboundPipeline.java:150) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundPipeline.handleBytes(InboundPipeline.java:115) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:95) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
  "at io.netty.handler.logging.LoggingHandler.channelRead(LoggingHandler.java:280) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
  "at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:103) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
  "at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1466) ~[?:?]",
  "at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1329) ~[?:?]",
  "at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1378) ~[?:?]",
  "at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:529) ~[?:?]",
  "at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:468) ~[?:?]",
  "at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
  "at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
  "at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) ~[?:?]",
  "at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) ~[?:?]",
  "at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788) ~[?:?]",
  "at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:689) ~[?:?]",
  "at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:652) ~[?:?]",
  "at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) ~[?:?]",
  "at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) ~[?:?]",
  "at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) ~[?:?]",
  "at java.lang.Thread.run(Thread.java:833) [?:?]"] }
  

  ---

  • No reports have been found with this warning even in the OpenSearch repository, the message appears among other messages, but it is not the main reported problem. As the message said, it is being ignored.

  {"type": "server", "timestamp": "2023-10-11T20:50:31,120Z", "level": "WARN", "component": "o.o.p.c.s.h.ConfigOverridesClusterSettingHandler", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Config override setting update called with empty string. Ignoring." }
  

---

• New warning, specific info at https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information

{"type": "server", "timestamp": "2023-10-11T20:50:29,988Z", "level": "WARN", "component": "o.o.s.p.SQLPlugin", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information" }

[rauldpm]

Update report - Bump and building packages - DEB

• The RPM SPEC file has been improved with wildcards, no version references are needed now
• No changes have been necessary in the rule file
• The Wazuh indexer file was built successfully
  • https://packages-dev.wazuh.com/warehouse/test/4.8/deb/var/wazuh-indexer_4.8.0-wp2520_amd64.deb
  • build.log
• Installed files
  • files.log

[rauldpm]

Analysis report - DEB

Install 🟢

root@ubuntu20stack:/home/vagrant# apt install ./wazuh-indexer_4.8.0-wp2520_amd64.deb 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Note, selecting 'wazuh-indexer' instead of './wazuh-indexer_4.8.0-wp2520_amd64.deb'
The following NEW packages will be installed:
  wazuh-indexer
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/754 MB of archives.
After this operation, 1,050 MB of additional disk space will be used.
Get:1 /home/vagrant/wazuh-indexer_4.8.0-wp2520_amd64.deb wazuh-indexer amd64 4.8.0-wp2520 [754 MB]
Selecting previously unselected package wazuh-indexer.
(Reading database ... 111886 files and directories currently installed.)
Preparing to unpack .../wazuh-indexer_4.8.0-wp2520_amd64.deb ...
Creating wazuh-indexer group... OK
Creating wazuh-indexer user... OK
Unpacking wazuh-indexer (4.8.0-wp2520) ...
Setting up wazuh-indexer (4.8.0-wp2520) ......................................................................................] 
Created opensearch keystore in /etc/wazuh-indexer/opensearch.keystore
Processing triggers for systemd (245.4-4ubuntu3.20) ...
Processing triggers for libc-bin (2.31-0ubuntu9.9) ..

Certificate creation 🟢 and certificates copy 🟢

root@ubuntu20stack:/home/vagrant# bash ./wazuh-certs-tool.sh -A
16/10/2023 13:50:55 INFO: Admin certificates created.
16/10/2023 13:50:55 INFO: Wazuh indexer certificates created.
root@ubuntu20stack:/home/vagrant# tar -cvf ./wazuh-certificates.tar -C ./wazuh-certificates/ .
./
./admin.pem
./indexer-1.pem
./indexer-1-key.pem
./root-ca.pem
./admin-key.pem
./root-ca.key

root@ubuntu20stack:/home/vagrant# NODE_NAME=indexer-1
root@ubuntu20stack:/home/vagrant# mkdir /etc/wazuh-indexer/certs
root@ubuntu20stack:/home/vagrant# tar -xf ./wazuh-certificates.tar -C /etc/wazuh-indexer/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
root@ubuntu20stack:/home/vagrant# mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
root@ubuntu20stack:/home/vagrant# mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
root@ubuntu20stack:/home/vagrant# chmod 500 /etc/wazuh-indexer/certs
root@ubuntu20stack:/home/vagrant# chmod 400 /etc/wazuh-indexer/certs/*
root@ubuntu20stack:/home/vagrant# chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs

Start service 🟢

root@ubuntu20stack:/home/vagrant# systemctl daemon-reload
root@ubuntu20stack:/home/vagrant# systemctl enable wazuh-indexer
Created symlink /etc/systemd/system/multi-user.target.wants/wazuh-indexer.service → /lib/systemd/system/wazuh-indexer.service.
root@ubuntu20stack:/home/vagrant# systemctl start wazuh-indexer
root@ubuntu20stack:/home/vagrant# systemctl status wazuh-indexer
● wazuh-indexer.service - Wazuh-indexer
     Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2023-10-16 14:26:29 UTC; 6s ago
       Docs: https://documentation.wazuh.com
   Main PID: 3300 (java)
      Tasks: 73 (limit: 9325)
     Memory: 1.3G
     CGroup: /system.slice/wazuh-indexer.service
             └─3300 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=t>

Oct 16 14:26:23 ubuntu20stack systemd[1]: Starting Wazuh-indexer...
Oct 16 14:26:24 ubuntu20stack systemd-entrypoint[3300]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 16 14:26:24 ubuntu20stack systemd-entrypoint[3300]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Oct 16 14:26:24 ubuntu20stack systemd-entrypoint[3300]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Oct 16 14:26:24 ubuntu20stack systemd-entrypoint[3300]: WARNING: System::setSecurityManager will be removed in a future release
Oct 16 14:26:25 ubuntu20stack systemd-entrypoint[3300]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 16 14:26:25 ubuntu20stack systemd-entrypoint[3300]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Oct 16 14:26:25 ubuntu20stack systemd-entrypoint[3300]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Oct 16 14:26:25 ubuntu20stack systemd-entrypoint[3300]: WARNING: System::setSecurityManager will be removed in a future release
Oct 16 14:26:29 ubuntu20stack systemd[1]: Started Wazuh-indexer.

Initialize cluster 🟢

root@ubuntu20stack:/home/vagrant# /usr/share/wazuh-indexer/bin/indexer-security-init.sh
**************************************************************************
** This tool will be deprecated in the next major release of OpenSearch **
** https://github.com/opensearch-project/security/issues/1755           **
**************************************************************************
Security Admin v7
Will connect to 127.0.0.1:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.10.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
Populate config from /etc/wazuh-indexer/opensearch-security/
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml 
   SUCC: Configuration for 'config' created or updated
Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml 
   SUCC: Configuration for 'roles' created or updated
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml 
   SUCC: Configuration for 'rolesmapping' created or updated
Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml 
   SUCC: Configuration for 'internalusers' created or updated
Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml 
   SUCC: Configuration for 'actiongroups' created or updated
Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml 
   SUCC: Configuration for 'tenants' created or updated
Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml 
   SUCC: Configuration for 'nodesdn' created or updated
Will update '/whitelist' with /etc/wazuh-indexer/opensearch-security/whitelist.yml 
   SUCC: Configuration for 'whitelist' created or updated
Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml 
   SUCC: Configuration for 'audit' created or updated
Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml 
   SUCC: Configuration for 'allowlist' created or updated
SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"]) due to: null
Done with success

Check cluster health 🟢

root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200
{
  "name" : "node-1",
  "cluster_name" : "wazuh-cluster",
  "cluster_uuid" : "tWpt9CrlQCWXY8VxBeIHEw",
  "version" : {
    "number" : "7.10.2",
    "build_type" : "rpm",
    "build_hash" : "eee49cb340edc6c4d489bcd9324dda571fc8dc03",
    "build_date" : "2023-09-20T23:54:29.889267151Z",
    "build_snapshot" : false,
    "lucene_version" : "9.7.0",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}

root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cat/nodes?v
ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
10.0.2.15           39          48   3    0.07    0.04     0.01 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1

root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cat/shards
.opensearch-observability        0 p STARTED  0   208b 10.0.2.15 node-1
.plugins-ml-config               0 p STARTED  1  3.8kb 10.0.2.15 node-1
.opensearch-sap-log-types-config 0 p STARTED           10.0.2.15 node-1
.opendistro_security             0 p STARTED 10 64.3kb 10.0.2.15 node-1

root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cluster/health?pretty
{
  "cluster_name" : "wazuh-cluster",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "discovered_master" : true,
  "discovered_cluster_manager" : true,
  "active_primary_shards" : 4,
  "active_shards" : 4,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}

---

Logs

journal 🟢

root@ubuntu20stack:/home/vagrant# journalctl -u wazuh-indexer
-- Logs begin at Mon 2023-10-16 13:42:20 UTC, end at Mon 2023-10-16 14:27:06 UTC. --
Oct 16 14:26:23 ubuntu20stack systemd[1]: Starting Wazuh-indexer...
Oct 16 14:26:24 ubuntu20stack systemd-entrypoint[3300]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 16 14:26:24 ubuntu20stack systemd-entrypoint[3300]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Oct 16 14:26:24 ubuntu20stack systemd-entrypoint[3300]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Oct 16 14:26:24 ubuntu20stack systemd-entrypoint[3300]: WARNING: System::setSecurityManager will be removed in a future release
Oct 16 14:26:25 ubuntu20stack systemd-entrypoint[3300]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 16 14:26:25 ubuntu20stack systemd-entrypoint[3300]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Oct 16 14:26:25 ubuntu20stack systemd-entrypoint[3300]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Oct 16 14:26:25 ubuntu20stack systemd-entrypoint[3300]: WARNING: System::setSecurityManager will be removed in a future release
Oct 16 14:26:29 ubuntu20stack systemd[1]: Started Wazuh-indexer.

/var/log/wazuh-indexer 🟡

• wazuh-cluster_deprecations.json

  • Reported at OpenSearch deprecation messages #2518 (comment)

  {"type": "deprecation", "timestamp": "2023-10-16T14:26:26,749Z", "level": "DEPRECATION", "component": "o.o.d.c.s.Settings", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "[node.max_local_storage_nodes] setting was deprecated in OpenSearch and will be removed in a future release! See the breaking changes documentation for the next major version." }
  

  {"type": "deprecation", "timestamp": "2023-10-16T14:26:27,716Z", "level": "DEPRECATION", "component": "o.o.d.c.s.Settings", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "[index.store.hybrid.mmap.extensions] setting was deprecated in OpenSearch and will be removed in a future release! See the breaking changes documentation for the next major version." }
  

  {"type": "deprecation", "timestamp": "2023-10-16T14:26:27,717Z", "level": "DEPRECATION", "component": "o.o.d.c.s.Settings", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "[cluster.initial_master_nodes] setting was deprecated in OpenSearch and will be removed in a future release! See the breaking changes documentation for the next major version." }
  

  {"type": "deprecation", "timestamp": "2023-10-16T14:26:29,276Z", "level": "DEPRECATION", "component": "o.o.d.a.m.TransportMainAction", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "overriding main response version number will be removed in a future version" }
  

  {"type": "deprecation", "timestamp": "2023-10-16T14:26:29,767Z", "level": "DEPRECATION", "component": "o.o.d.c.m.MetadataCreateIndexService", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "index name [.opensearch-observability] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices", "cluster.uuid": "tWpt9CrlQCWXY8VxBeIHEw", "node.id": "uBxoNDM7RXaSPSH5SrzeHg"  }
  

  {"type": "deprecation", "timestamp": "2023-10-16T14:26:57,215Z", "level": "DEPRECATION", "component": "o.o.d.c.m.IndexNameExpressionResolver", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "this request accesses system indices: [.opendistro_security], but in a future major version, direct access to system indices will be prevented by default", "cluster.uuid": "tWpt9CrlQCWXY8VxBeIHEw", "node.id": "uBxoNDM7RXaSPSH5SrzeHg"  }
  

• wazuh-cluster_server.json

  • Warning found at Indexer stops working after reboot #1962 and Multiple messages in Wazuh indexer wazuh-cluster.log file asking to run securityadmin after reboot #1582

  {"type": "server", "timestamp": "2023-10-16T14:26:28,195Z", "level": "WARN", "component": "o.o.s.c.Salt", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "If you plan to use field masking pls configure compliance salt e1ukloTsQlOgPquJ to be a random string of 16 chars length identical on all nodes" }
  

  ---

  • Related Warning and error logs found in wazuh-indexer in demo environment #1511

  {"type": "server", "timestamp": "2023-10-16T14:26:28,212Z", "level": "ERROR", "component": "o.o.s.a.s.SinkProvider", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Default endpoint could not be created, auditlog will not work properly." }
  
  {"type": "server", "timestamp": "2023-10-16T14:26:28,213Z", "level": "WARN", "component": "o.o.s.a.r.AuditMessageRouter", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "No default storage available, audit log may not work properly. Please check configuration." }
  

  ---

  • New warning, specific info at https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information

  {"type": "server", "timestamp": "2023-10-16T14:26:28,641Z", "level": "WARN", "component": "o.o.s.p.SQLPlugin", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information" }
  

  ---

  • Reported at Wazuh indexer warning message about dangling indices #2519

  {"type": "server", "timestamp": "2023-10-16T14:26:29,175Z", "level": "WARN", "component": "o.o.g.DanglingIndicesState", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "gateway.auto_import_dangling_indices is disabled, dangling indices will not be automatically detected or imported and must be managed manually" }
  

  ---

  • Reported at Connection error in Wazuh indexer 2.10.0 #2514

  {"type": "server", "timestamp": "2023-10-16T14:26:29,701Z", "level": "ERROR", "component": "o.o.s.t.SecurityRequestHandler", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "OpenSearchException[Transport client authentication no longer supported.]" }
  

  {"type": "server", "timestamp": "2023-10-16T14:26:29,708Z", "level": "WARN", "component": "o.o.d.HandshakingTransportAddressConnector", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "handshake failed for [connectToRemoteMasterNode[127.0.0.1:9300]]", 
  "stacktrace": ["org.opensearch.transport.RemoteTransportException: [node-1][127.0.0.1:9300][internal:transport/handshake]",
  "Caused by: org.opensearch.OpenSearchException: Transport client authentication no longer supported.",
  "at org.opensearch.security.ssl.util.ExceptionUtils.createTransportClientNoLongerSupportedException(ExceptionUtils.java:68) ~[?:?]",
  "at org.opensearch.security.transport.SecurityRequestHandler.messageReceivedDecorate(SecurityRequestHandler.java:292) ~[?:?]",
  "at org.opensearch.security.ssl.transport.SecuritySSLRequestHandler.messageReceived(SecuritySSLRequestHandler.java:163) ~[?:?]",
  "at org.opensearch.security.OpenSearchSecurityPlugin$7$1.messageReceived(OpenSearchSecurityPlugin.java:763) ~[?:?]",
  "at org.opensearch.indexmanagement.rollup.interceptor.RollupInterceptor$interceptHandler$1.messageReceived(RollupInterceptor.kt:113) ~[?:?]",
  "at org.opensearch.performanceanalyzer.transport.PerformanceAnalyzerTransportRequestHandler.messageReceived(PerformanceAnalyzerTransportRequestHandler.java:43) ~[?:?]",
  "at org.opensearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:106) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundHandler.handleRequest(InboundHandler.java:250) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundHandler.messageReceived(InboundHandler.java:133) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundHandler.inboundMessage(InboundHandler.java:115) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.TcpTransport.inboundMessage(TcpTransport.java:767) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundPipeline.forwardFragments(InboundPipeline.java:175) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundPipeline.doHandleBytes(InboundPipeline.java:150) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.InboundPipeline.handleBytes(InboundPipeline.java:115) ~[opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:95) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
  "at io.netty.handler.logging.LoggingHandler.channelRead(LoggingHandler.java:280) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
  "at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:103) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
  "at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1466) ~[?:?]",
  "at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1329) ~[?:?]",
  "at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1378) ~[?:?]",
  "at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:529) ~[?:?]",
  "at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:468) ~[?:?]",
  "at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
  "at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440) ~[?:?]",
  "at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
  "at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) ~[?:?]",
  "at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) ~[?:?]",
  "at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788) ~[?:?]",
  "at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:689) ~[?:?]",
  "at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:652) ~[?:?]",
  "at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) ~[?:?]",
  "at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) ~[?:?]",
  "at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) ~[?:?]",
  "at java.lang.Thread.run(Thread.java:833) [?:?]"] }
  

  ---

  • No reports have been found with this warning even in the OpenSearch repository, the message appears among other messages, but it is not the main reported problem. As the message said, it is being ignored.

  {"type": "server", "timestamp": "2023-10-16T14:26:29,736Z", "level": "WARN", "component": "o.o.p.c.s.h.ConfigOverridesClusterSettingHandler", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Config override setting update called with empty string. Ignoring." }
  

  ---

  • Error appeared at Multiple messages in Wazuh indexer wazuh-cluster.log file asking to run securityadmin after reboot #1582
  • Reported at https://forum.opensearch.org/t/java-io-filepermission-proc-self-task-read-java-security-accesscontrolexception-access-denied-java-io-filepermission-proc-self-task-read/14186
  • Related to system file access by Wazuh indexer and performance analyzer, maybe related: Incorrect path to the Wazuh indexer binary performance-analyzer-agent-cli #2321
  • New issue: Wazuh indexer DEB package set HOME as nonexistent #2529

  {"type": "server", "timestamp": "2023-10-16T14:26:30,041Z", "level": "ERROR", "component": "o.o.p.c.o.OSGlobals", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Error in static initialization of OSGlobals with exception: java.security.AccessControlException: access denied (\"java.io.FilePermission\" \"/proc/self/task\" \"read\")", "cluster.uuid": "tWpt9CrlQCWXY8VxBeIHEw", "node.id": "uBxoNDM7RXaSPSH5SrzeHg" , 
  "stacktrace": ["java.security.AccessControlException: access denied (\"java.io.FilePermission\" \"/proc/self/task\" \"read\")",
  "at java.security.AccessControlContext.checkPermission(AccessControlContext.java:485) ~[?:?]",
  "at java.security.AccessController.checkPermission(AccessController.java:1068) ~[?:?]",
  "at java.lang.SecurityManager.checkPermission(SecurityManager.java:416) ~[?:?]",
  "at java.lang.SecurityManager.checkRead(SecurityManager.java:756) ~[?:?]",
  "at java.io.File.normalizedList(File.java:1171) ~[?:?]",
  "at java.io.File.listFiles(File.java:1269) ~[?:?]",
  "at org.opensearch.performanceanalyzer.commons.os.OSGlobals.enumTids(OSGlobals.java:75) ~[performance-analyzer-commons-1.1.0.jar:?]",
  "at org.opensearch.performanceanalyzer.commons.os.OSGlobals.<clinit>(OSGlobals.java:34) [performance-analyzer-commons-1.1.0.jar:?]",
  "at org.opensearch.performanceanalyzer.commons.metrics_generator.linux.LinuxOSMetricsGenerator.getPid(LinuxOSMetricsGenerator.java:36) [performance-analyzer-commons-1.1.0.jar:?]",
  "at org.opensearch.performanceanalyzer.commons.jvm.ThreadList.<clinit>(ThreadList.java:44) [performance-analyzer-commons-1.1.0.jar:?]",
  "at org.opensearch.performanceanalyzer.commons.util.ThreadIDUtil.getNativeThreadId(ThreadIDUtil.java:22) [performance-analyzer-commons-1.1.0.jar:?]",
  "at org.opensearch.performanceanalyzer.commons.util.ThreadIDUtil.getNativeCurrentThreadId(ThreadIDUtil.java:18) [performance-analyzer-commons-1.1.0.jar:?]",
  "at org.opensearch.performanceanalyzer.listener.PerformanceAnalyzerSearchListener.preQueryPhase(PerformanceAnalyzerSearchListener.java:112) [opensearch-performance-analyzer-2.10.0.0.jar:2.10.0.0]",
  "at org.opensearch.performanceanalyzer.listener.PerformanceAnalyzerSearchListener.onPreQueryPhase(PerformanceAnalyzerSearchListener.java:46) [opensearch-performance-analyzer-2.10.0.0.jar:2.10.0.0]",
  "at org.opensearch.index.shard.SearchOperationListener$CompositeListener.onPreQueryPhase(SearchOperationListener.java:162) [opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.search.SearchService$SearchOperationListenerExecutor.<init>(SearchService.java:1746) [opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.search.SearchService$SearchOperationListenerExecutor.<init>(SearchService.java:1735) [opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.search.SearchService.executeQueryPhase(SearchService.java:596) [opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.search.SearchService$2.lambda$onResponse$0(SearchService.java:566) [opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:74) [opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.action.ActionRunnable$2.doRun(ActionRunnable.java:89) [opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52) [opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.threadpool.TaskAwareRunnable.doRun(TaskAwareRunnable.java:78) [opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52) [opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:59) [opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:908) [opensearch-2.10.0.jar:2.10.0]",
  "at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52) [opensearch-2.10.0.jar:2.10.0]",
  "at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) [?:?]",
  "at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) [?:?]",
  "at java.lang.Thread.run(Thread.java:833) [?:?]"] }
  

  ---

  • Related Multiple messages in Wazuh indexer wazuh-cluster.log file asking to run securityadmin after reboot #1582

  {"type": "server", "timestamp": "2023-10-16T14:26:30,760Z", "level": "ERROR", "component": "o.o.s.c.ConfigurationLoaderSecurity7", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Failure no such index [.opendistro_security] retrieving configuration for [INTERNALUSERS, ACTIONGROUPS, CONFIG, ROLES, ROLESMAPPING, TENANTS, NODESDN, WHITELIST, ALLOWLIST, AUDIT] (index=.opendistro_security)", "cluster.uuid": "tWpt9CrlQCWXY8VxBeIHEw", "node.id": "uBxoNDM7RXaSPSH5SrzeHg"  }
  

  ---

  • Initially related to unassigned shards: [BUG] Opensearch 2.9.0 - Failed to initialize LogType config index and builtin log types opensearch-project/OpenSearch#9061
  • Index already exists but it is not duplicated

  {"type": "server", "timestamp": "2023-10-16T14:30:50,010Z", "level": "WARN", "component": "o.o.o.i.ObservabilityIndex", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "message: index [.opensearch-observability/fJoQwA-LR7WU2n7wOnKLVg] already exists", "cluster.uuid": "tWpt9CrlQCWXY8VxBeIHEw", "node.id": "uBxoNDM7RXaSPSH5SrzeHg"  }
  

  root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cat/shards
  .plugins-ml-config               0 p STARTED  1  3.9kb 10.0.2.15 node-1
  .opensearch-observability        0 p STARTED  0   208b 10.0.2.15 node-1
  .opensearch-sap-log-types-config 0 p STARTED           10.0.2.15 node-1
  .opendistro_security             0 p STARTED 10 65.1kb 10.0.2.15 node-1
  

---

• New warning, specific info at https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information

{"type": "server", "timestamp": "2023-10-16T14:26:28,641Z", "level": "WARN", "component": "o.o.s.p.SQLPlugin", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information" }

[rauldpm]

Analysis report about the new warning related to Master key configuration

{"type": "server", "timestamp": "2023-10-16T14:26:28,641Z", "level": "WARN", "component": "o.o.s.p.SQLPlugin", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information" }

• The warning appears each time the service is started or restarted
• Setting the following line in the opensearch.yml file stops generating the warning message

plugins.query.datasources.encryption.masterkey: "yVlJzM8ywQ29fcpZjnGIglQO"

• The value has been generated following the Python script provided as an example at https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information
• No warning or error was found after restarting the wazuh-indexer service
  • A complete test must be performed that includes a cluster mode configuration with several nodes connected if this configuration is included by default
• The OpenSearch 2.10.0 DEB package does not include this configuration by default

root@ubuntu20stack:/var/log# grep "plugins.query.datasources.encryption.masterkey" /etc/opensearch/opensearch.yml 
root@ubuntu20stack:/var/log# grep "query.datasources.encryption.masterkey" /etc/opensearch/opensearch.yml 
root@ubuntu20stack:/var/log# grep "masterkey" /etc/opensearch/opensearch.yml 
root@ubuntu20stack:/var/log# grep "masterkey" /etc/opensearch/opensearch.yml | wc -l
0

• The 2.10.0 OpenSearch installation shows the same warning when the service is started, as this configuration is not provided by default, we should contemplate not including it by default in our package
  • This procedure needs validation by, at least, @davidjiglesias

root@ubuntu20stack:/home/vagrant# grep "Master key" /var/log/opensearch/opensearch_server.json 
{"type": "server", "timestamp": "2023-10-16T17:11:43,617Z", "level": "WARN", "component": "o.o.s.p.SQLPlugin", "cluster.name": "opensearch", "node.name": "ubuntu20stack", "message": "Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information" }

[rauldpm]

Analysis report - Upgrade RPM and DEB from 4.5.3

RPM 🟢

• 4.5.3 - Install 4.5.3

  [root@centos7 vagrant]# yum -y install wazuh-indexer -y
  Loaded plugins: fastestmirror
  Loading mirror speeds from cached hostfile
  * base: centos.mirror.ptisp.pt
  * extras: centos.mirror.ptisp.pt
  * updates: mirror.librelabucm.org
  wazuh                                                                  | 3.4 kB  00:00:00     
  wazuh/primary_db                                                       | 380 kB  00:00:00     
  Resolving Dependencies
  --> Running transaction check
  ---> Package wazuh-indexer.x86_64 0:4.5.3-1 will be installed
  --> Finished Dependency Resolution
  
  Dependencies Resolved
  
  ==============================================================================================
  Package                    Arch                Version              Repository          Size
  ==============================================================================================
  Installing:
  wazuh-indexer              x86_64              4.5.3-1              wazuh              675 M
  
  Transaction Summary
  ==============================================================================================
  Install  1 Package
  
  Total download size: 675 M
  Installed size: 931 M
  Downloading packages:
  wazuh-indexer-4.5.3-1.x86_64.rpm                                       | 675 MB  00:00:08     
  Running transaction check
  Running transaction test
  Transaction test succeeded
  Running transaction
  Installing : wazuh-indexer-4.5.3-1.x86_64                                               1/1 
  Created opensearch keystore in /etc/wazuh-indexer/opensearch.keystore
  Verifying  : wazuh-indexer-4.5.3-1.x86_64                                               1/1 
  
  Installed:
  wazuh-indexer.x86_64 0:4.5.3-1                                                              
  
  Complete!
  

• 4.5.3 - Configure certificates

  [root@centos7 vagrant]# NODE_NAME=indexer-1
  [root@centos7 vagrant]# mkdir /etc/wazuh-indexer/certs
  [root@centos7 vagrant]# tar -xf ./wazuh-certificates.tar -C /etc/wazuh-indexer/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
  [root@centos7 vagrant]# mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
  [root@centos7 vagrant]# mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
  [root@centos7 vagrant]# chmod 500 /etc/wazuh-indexer/certs
  [root@centos7 vagrant]# chmod 400 /etc/wazuh-indexer/certs/*
  [root@centos7 vagrant]# chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs
  

• 4.5.3 - Start service

  [root@centos7 vagrant]# systemctl daemon-reload
  [root@centos7 vagrant]# systemctl enable wazuh-indexer
  Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-indexer.service to /usr/lib/systemd/system/wazuh-indexer.service.
  [root@centos7 vagrant]# systemctl start wazuh-indexer
  [root@centos7 vagrant]# systemctl status wazuh-indexer
  ● wazuh-indexer.service - Wazuh-indexer
  Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: disabled)
  Active: active (running) since Mon 2023-10-16 17:54:49 UTC; 4s ago
      Docs: https://documentation.wazuh.com
  Main PID: 3707 (java)
  CGroup: /system.slice/wazuh-indexer.service
          └─3707 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkad...
  
  Oct 16 17:54:42 centos7 systemd[1]: Starting Wazuh-indexer...
  Oct 16 17:54:43 centos7 systemd-entrypoint[3707]: WARNING: A terminally deprecated method...ed
  Oct 16 17:54:43 centos7 systemd-entrypoint[3707]: WARNING: System::setSecurityManager has...r)
  Oct 16 17:54:43 centos7 systemd-entrypoint[3707]: WARNING: Please consider reporting this...ch
  Oct 16 17:54:43 centos7 systemd-entrypoint[3707]: WARNING: System::setSecurityManager wil...se
  Oct 16 17:54:44 centos7 systemd-entrypoint[3707]: WARNING: A terminally deprecated method...ed
  Oct 16 17:54:44 centos7 systemd-entrypoint[3707]: WARNING: System::setSecurityManager has...r)
  Oct 16 17:54:44 centos7 systemd-entrypoint[3707]: WARNING: Please consider reporting this...ty
  Oct 16 17:54:44 centos7 systemd-entrypoint[3707]: WARNING: System::setSecurityManager wil...se
  Oct 16 17:54:49 centos7 systemd[1]: Started Wazuh-indexer.
  Hint: Some lines were ellipsized, use -l to show in full.
  

• 4.5.3 - Start cluster

  [root@centos7 vagrant]# /usr/share/wazuh-indexer/bin/indexer-security-init.sh
  **************************************************************************
  ** This tool will be deprecated in the next major release of OpenSearch **
  ** https://github.com/opensearch-project/security/issues/1755           **
  **************************************************************************
  Security Admin v7
  Will connect to 127.0.0.1:9200 ... done
  Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
  OpenSearch Version: 2.6.0
  Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
  Clustername: wazuh-cluster
  Clusterstate: GREEN
  Number of nodes: 1
  Number of data nodes: 1
  .opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
  Populate config from /etc/wazuh-indexer/opensearch-security/
  Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml 
  SUCC: Configuration for 'config' created or updated
  Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml 
  SUCC: Configuration for 'roles' created or updated
  Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml 
  SUCC: Configuration for 'rolesmapping' created or updated
  Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml 
  SUCC: Configuration for 'internalusers' created or updated
  Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml 
  SUCC: Configuration for 'actiongroups' created or updated
  Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml 
  SUCC: Configuration for 'tenants' created or updated
  Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml 
  SUCC: Configuration for 'nodesdn' created or updated
  Will update '/whitelist' with /etc/wazuh-indexer/opensearch-security/whitelist.yml 
  SUCC: Configuration for 'whitelist' created or updated
  Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml 
  SUCC: Configuration for 'audit' created or updated
  Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml 
  SUCC: Configuration for 'allowlist' created or updated
  SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"]) due to: null
  Done with success
  

• 4.5.3 - Check cluster status

  [root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200
  {
  "name" : "node-1",
  "cluster_name" : "wazuh-cluster",
  "cluster_uuid" : "6Z0SpBhdRpqkw8yIyFT30Q",
  "version" : {
      "number" : "7.10.2",
      "build_type" : "rpm",
      "build_hash" : "7203a5af21a8a009aece1474446b437a3c674db6",
      "build_date" : "2023-02-24T18:57:04.388618985Z",
      "build_snapshot" : false,
      "lucene_version" : "9.5.0",
      "minimum_wire_compatibility_version" : "7.10.0",
      "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
  }
  

  [root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cat/nodes?v
  ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
  10.0.2.15           33          94   3    0.06    0.12     0.07 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1
  

  [root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cat/shards
  .opendistro_security      0 p STARTED 10 64.2kb 10.0.2.15 node-1
  .opensearch-observability 0 p STARTED  0   208b 10.0.2.15 node-1
  

  [root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cluster/health?pretty
  {
  "cluster_name" : "wazuh-cluster",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "discovered_master" : true,
  "discovered_cluster_manager" : true,
  "active_primary_shards" : 2,
  "active_shards" : 2,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
  }
  

• 4.5.3 - Stop shard allocation and services

  [root@centos7 vagrant]# curl -X PUT "https://192.168.56.4:9200/_cluster/settings"  -u admin:admin -k -H 'Content-Type: application/json' -d'
  > {
  >   "persistent": {
  >     "cluster.routing.allocation.enable": "primaries"
  >   }
  > }
  > '
  {"acknowledged":true,"persistent":{"cluster":{"routing":{"allocation":{"enable":"primaries"}}}},"transient":{}}
  

  [root@centos7 vagrant]# curl -X POST "https://192.168.56.4:9200/_flush/synced" -u admin:admin -k
  {"_shards":{"total":2,"successful":2,"failed":0}}
  

  [root@centos7 vagrant]# systemctl stop wazuh-indexer
  [root@centos7 vagrant]# systemctl status wazuh-indexer
  ● wazuh-indexer.service - Wazuh-indexer
  Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: disabled)
  Active: inactive (dead) since Mon 2023-10-16 18:00:57 UTC; 1min 4s ago
      Docs: https://documentation.wazuh.com
  Process: 3707 ExecStart=/usr/share/wazuh-indexer/bin/systemd-entrypoint -p ${PID_DIR}/wazuh-indexer.pid --quiet (code=exited, status=143)
  Main PID: 3707 (code=exited, status=143)
  
  Oct 16 17:54:43 centos7 systemd-entrypoint[3707]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.6.0.jar)
  Oct 16 17:54:43 centos7 systemd-entrypoint[3707]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
  Oct 16 17:54:43 centos7 systemd-entrypoint[3707]: WARNING: System::setSecurityManager will be removed in a future release
  Oct 16 17:54:44 centos7 systemd-entrypoint[3707]: WARNING: A terminally deprecated method in java.lang.System has been called
  Oct 16 17:54:44 centos7 systemd-entrypoint[3707]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.6.0.jar)
  Oct 16 17:54:44 centos7 systemd-entrypoint[3707]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
  Oct 16 17:54:44 centos7 systemd-entrypoint[3707]: WARNING: System::setSecurityManager will be removed in a future release
  Oct 16 17:54:49 centos7 systemd[1]: Started Wazuh-indexer.
  Oct 16 18:00:56 centos7 systemd[1]: Stopping Wazuh-indexer...
  Oct 16 18:00:57 centos7 systemd[1]: Stopped Wazuh-indexer.
  

• 4.8.0 - Upgrade

  [root@centos7 vagrant]# yum upgrade wazuh-indexer-4.8.0-wp2520.x86_64.rpm 
  Loaded plugins: fastestmirror
  Examining wazuh-indexer-4.8.0-wp2520.x86_64.rpm: wazuh-indexer-4.8.0-wp2520.x86_64
  Marking wazuh-indexer-4.8.0-wp2520.x86_64.rpm as an update to wazuh-indexer-4.5.3-1.x86_64
  Resolving Dependencies
  --> Running transaction check
  ---> Package wazuh-indexer.x86_64 0:4.5.3-1 will be updated
  ---> Package wazuh-indexer.x86_64 0:4.8.0-wp2520 will be an update
  --> Finished Dependency Resolution
  
  Dependencies Resolved
  
  ==============================================================================================
  Package           Arch       Version            Repository                              Size
  ==============================================================================================
  Updating:
  wazuh-indexer     x86_64     4.8.0-wp2520       /wazuh-indexer-4.8.0-wp2520.x86_64     1.0 G
  
  Transaction Summary
  ==============================================================================================
  Upgrade  1 Package
  
  Total size: 1.0 G
  Is this ok [y/d/N]: y
  Downloading packages:
  Running transaction check
  Running transaction test
  Transaction test succeeded
  Running transaction
  Updating   : wazuh-indexer-4.8.0-wp2520.x86_64                                          1/2 
  Cleanup    : wazuh-indexer-4.5.3-1.x86_64                                               2/2 
  Verifying  : wazuh-indexer-4.8.0-wp2520.x86_64                                          1/2 
  Verifying  : wazuh-indexer-4.5.3-1.x86_64                                               2/2 
  
  Updated:
  wazuh-indexer.x86_64 0:4.8.0-wp2520                                                         
  
  Complete!
  

• 4.8.0 - Start service

  [root@centos7 vagrant]# systemctl daemon-reload
  [root@centos7 vagrant]# systemctl enable wazuh-indexer
  [root@centos7 vagrant]# systemctl start wazuh-indexer
  [root@centos7 vagrant]# systemctl status wazuh-indexer
  ● wazuh-indexer.service - Wazuh-indexer
  Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: disabled)
  Active: active (running) since Mon 2023-10-16 18:05:06 UTC; 38s ago
      Docs: https://documentation.wazuh.com
  Main PID: 4317 (java)
  CGroup: /system.slice/wazuh-indexer.service
          └─4317 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkad...
  
  Oct 16 18:04:59 centos7 systemd[1]: Starting Wazuh-indexer...
  Oct 16 18:05:00 centos7 systemd-entrypoint[4317]: WARNING: A terminally deprecated method...ed
  Oct 16 18:05:00 centos7 systemd-entrypoint[4317]: WARNING: System::setSecurityManager has...r)
  Oct 16 18:05:00 centos7 systemd-entrypoint[4317]: WARNING: Please consider reporting this...ch
  Oct 16 18:05:00 centos7 systemd-entrypoint[4317]: WARNING: System::setSecurityManager wil...se
  Oct 16 18:05:01 centos7 systemd-entrypoint[4317]: WARNING: A terminally deprecated method...ed
  Oct 16 18:05:01 centos7 systemd-entrypoint[4317]: WARNING: System::setSecurityManager has...r)
  Oct 16 18:05:01 centos7 systemd-entrypoint[4317]: WARNING: Please consider reporting this...ty
  Oct 16 18:05:01 centos7 systemd-entrypoint[4317]: WARNING: System::setSecurityManager wil...se
  Oct 16 18:05:06 centos7 systemd[1]: Started Wazuh-indexer.
  Hint: Some lines were ellipsized, use -l to show in full.
  

• 4.8.0 - Enable shard allocation

  [root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cat/nodes?v
  ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
  10.0.2.15           26          97   3    0.15    0.13     0.08 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1
  

  [root@centos7 vagrant]# curl -X PUT "https://192.168.56.4:9200/_cluster/settings" -u admin:admin -k -H 'Content-Type: application/json' -d'
  > {
  >   "persistent": {
  >     "cluster.routing.allocation.enable": "all"
  >   }
  > }
  > '
  {"acknowledged":true,"persistent":{"cluster":{"routing":{"allocation":{"enable":"all"}}}},"transient":{}}
  

• 4.8.0 - Check cluster status

  [root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200
  {
  "name" : "node-1",
  "cluster_name" : "wazuh-cluster",
  "cluster_uuid" : "6Z0SpBhdRpqkw8yIyFT30Q",
  "version" : {
      "number" : "7.10.2",
      "build_type" : "rpm",
      "build_hash" : "eee49cb340edc6c4d489bcd9324dda571fc8dc03",
      "build_date" : "2023-09-20T23:54:29.889267151Z",
      "build_snapshot" : false,
      "lucene_version" : "9.7.0",
      "minimum_wire_compatibility_version" : "7.10.0",
      "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
  }
  

  [root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cat/nodes?v
  ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
  10.0.2.15           29          97   0    0.02    0.09     0.07 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1
  

  [root@centos7 vagrant]#  curl -k -u admin:admin https://192.168.56.4:9200/_cat/shards
  .opensearch-observability        0 p STARTED  0   208b 10.0.2.15 node-1
  .plugins-ml-config               0 p STARTED  1  3.8kb 10.0.2.15 node-1
  .opensearch-sap-log-types-config 0 p STARTED           10.0.2.15 node-1
  .opendistro_security             0 p STARTED 10 65.1kb 10.0.2.15 node-1
  

  [root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cluster/health?pretty
  {
  "cluster_name" : "wazuh-cluster",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "discovered_master" : true,
  "discovered_cluster_manager" : true,
  "active_primary_shards" : 4,
  "active_shards" : 4,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
  }
  

DEB 🟢

• 4.5.3 - Install 4.5.3

  root@ubuntu20stack:/var/log# apt install wazuh-indexer
  Reading package lists... Done
  Building dependency tree       
  Reading state information... Done
  The following NEW packages will be installed:
    wazuh-indexer
  0 upgraded, 1 newly installed, 0 to remove and 121 not upgraded.
  Need to get 0 B/685 MB of archives.
  After this operation, 971 MB of additional disk space will be used.
  Selecting previously unselected package wazuh-indexer.
  (Reading database ... 111886 files and directories currently installed.)
  Preparing to unpack .../wazuh-indexer_4.5.3-1_amd64.deb ...
  Creating wazuh-indexer group... OK
  Creating wazuh-indexer user... OK
  Unpacking wazuh-indexer (4.5.3-1) ...
  Setting up wazuh-indexer (4.5.3-1) ...
  Created opensearch keystore in /etc/wazuh-indexer/opensearch.keystore
  Processing triggers for systemd (245.4-4ubuntu3.20) ...
  Processing triggers for libc-bin (2.31-0ubuntu9.9) ...
  

• 4.5.3 - Configure certificates

  root@ubuntu20stack:/home/vagrant# NODE_NAME=indexer-1
  root@ubuntu20stack:/home/vagrant# mkdir /etc/wazuh-indexer/certs
  root@ubuntu20stack:/home/vagrant# tar -xf ./wazuh-certificates.tar -C /etc/wazuh-indexer/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
  root@ubuntu20stack:/home/vagrant# mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
  root@ubuntu20stack:/home/vagrant# mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
  root@ubuntu20stack:/home/vagrant# chmod 500 /etc/wazuh-indexer/certs
  root@ubuntu20stack:/home/vagrant# chmod 400 /etc/wazuh-indexer/certs/*
  root@ubuntu20stack:/home/vagrant# chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs
  

• 4.5.3 - Start service

  root@ubuntu20stack:/home/vagrant# systemctl daemon-reload
  root@ubuntu20stack:/home/vagrant# systemctl enable wazuh-indexer
  Synchronizing state of wazuh-indexer.service with SysV service script with /lib/systemd/systemd-sysv-install.
  Executing: /lib/systemd/systemd-sysv-install enable wazuh-indexer
  Created symlink /etc/systemd/system/multi-user.target.wants/wazuh-indexer.service → /lib/systemd/system/wazuh-indexer.service.
  root@ubuntu20stack:/home/vagrant# systemctl start wazuh-indexer
  root@ubuntu20stack:/home/vagrant# systemctl status wazuh-indexer
  ● wazuh-indexer.service - Wazuh-indexer
      Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
      Active: active (running) since Mon 2023-10-16 17:54:50 UTC; 9s ago
      Docs: https://documentation.wazuh.com
  Main PID: 3705 (java)
      Tasks: 66 (limit: 9325)
      Memory: 1.2G
      CGroup: /system.slice/wazuh-indexer.service
              └─3705 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 ->
  
  Oct 16 17:54:44 ubuntu20stack systemd[1]: Starting Wazuh-indexer...
  Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: A terminally deprecated method in java.lang.Syst>
  Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: System::setSecurityManager has been called by or>
  Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: Please consider reporting this to the maintainer>
  Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: System::setSecurityManager will be removed in a >
  Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: A terminally deprecated method in java.lang.Syst>
  Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: System::setSecurityManager has been called by or>
  Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: Please consider reporting this to the maintainer>
  Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: System::setSecurityManager will be removed in a >
  Oct 16 17:54:50 ubuntu20stack systemd[1]: Started Wazuh-indexer.
  

• 4.5.3 - Start cluster

  root@ubuntu20stack:/home/vagrant# /usr/share/wazuh-indexer/bin/indexer-security-init.sh
  **************************************************************************
  ** This tool will be deprecated in the next major release of OpenSearch **
  ** https://github.com/opensearch-project/security/issues/1755           **
  **************************************************************************
  Security Admin v7
  Will connect to 127.0.0.1:9200 ... done
  Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
  OpenSearch Version: 2.6.0
  Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
  Clustername: wazuh-cluster
  Clusterstate: GREEN
  Number of nodes: 1
  Number of data nodes: 1
  .opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
  Populate config from /etc/wazuh-indexer/opensearch-security/
  Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml 
  SUCC: Configuration for 'config' created or updated
  Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml 
  SUCC: Configuration for 'roles' created or updated
  Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml 
  SUCC: Configuration for 'rolesmapping' created or updated
  Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml 
  SUCC: Configuration for 'internalusers' created or updated
  Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml 
  SUCC: Configuration for 'actiongroups' created or updated
  Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml 
  SUCC: Configuration for 'tenants' created or updated
  Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml 
  SUCC: Configuration for 'nodesdn' created or updated
  Will update '/whitelist' with /etc/wazuh-indexer/opensearch-security/whitelist.yml 
  SUCC: Configuration for 'whitelist' created or updated
  Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml 
  SUCC: Configuration for 'audit' created or updated
  Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml 
  SUCC: Configuration for 'allowlist' created or updated
  SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"]) due to: null
  Done with success
  

• 4.5.3 - Check cluster status

  root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200
  {
  "name" : "node-1",
  "cluster_name" : "wazuh-cluster",
  "cluster_uuid" : "cpjW8LaMRNiwhNiSGTbLkg",
  "version" : {
      "number" : "7.10.2",
      "build_type" : "rpm",
      "build_hash" : "7203a5af21a8a009aece1474446b437a3c674db6",
      "build_date" : "2023-02-24T18:57:04.388618985Z",
      "build_snapshot" : false,
      "lucene_version" : "9.5.0",
      "minimum_wire_compatibility_version" : "7.10.0",
      "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
  }
  

  root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cat/nodes?v
  ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
  10.0.2.15           34          67   2    0.37    0.39     0.22 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1
  

  root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cat/shards
  .opendistro_security      0 p STARTED 10 64.2kb 10.0.2.15 node-1
  .opensearch-observability 0 p STARTED  0   208b 10.0.2.15 node-1
  

  root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cluster/health?pretty
  {
  "cluster_name" : "wazuh-cluster",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "discovered_master" : true,
  "discovered_cluster_manager" : true,
  "active_primary_shards" : 2,
  "active_shards" : 2,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
  }
  

• 4.5.3 - Stop shard allocation and services

  root@ubuntu20stack:/home/vagrant# curl -X PUT "https://192.168.56.33:9200/_cluster/settings"  -u admin:admin -k -H 'Content-Type: application/json' -d'
  > {
  >   "persistent": {
  >     "cluster.routing.allocation.enable": "primaries"
  >   }
  > }
  > '
  {"acknowledged":true,"persistent":{"cluster":{"routing":{"allocation":{"enable":"primaries"}}}},"transient":{}}
  

  root@ubuntu20stack:/home/vagrant# curl -X POST "https://192.168.56.33:9200/_flush/synced" -u admin:admin -k
  {"_shards":{"total":2,"successful":2,"failed":0}}
  

  root@ubuntu20stack:/home/vagrant# systemctl stop wazuh-indexer
  root@ubuntu20stack:/home/vagrant# systemctl status wazuh-indexer
  ● wazuh-indexer.service - Wazuh-indexer
      Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
      Active: inactive (dead) since Mon 2023-10-16 18:00:57 UTC; 33s ago
      Docs: https://documentation.wazuh.com
      Process: 3705 ExecStart=/usr/share/wazuh-indexer/bin/systemd-entrypoint -p ${PID_DIR}/wazuh-indexer.pid --quiet (code=exited, status=143)
  Main PID: 3705 (code=exited, status=143)
  
  Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
  Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: System::setSecurityManager will be removed in a future release
  Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: A terminally deprecated method in java.lang.System has been called
  Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.6.0.jar)
  Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
  Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: System::setSecurityManager will be removed in a future release
  Oct 16 17:54:50 ubuntu20stack systemd[1]: Started Wazuh-indexer.
  Oct 16 18:00:57 ubuntu20stack systemd[1]: Stopping Wazuh-indexer...
  Oct 16 18:00:57 ubuntu20stack systemd[1]: wazuh-indexer.service: Succeeded.
  Oct 16 18:00:57 ubuntu20stack systemd[1]: Stopped Wazuh-indexer.
  

• 4.8.0 - Upgrade

  root@ubuntu20stack:/home/vagrant# apt-get install ./wazuh-indexer_4.8.0-wp2520_amd64.deb 
  Reading package lists... Done
  Building dependency tree       
  Reading state information... Done
  Note, selecting 'wazuh-indexer' instead of './wazuh-indexer_4.8.0-wp2520_amd64.deb'
  The following packages will be upgraded:
  wazuh-indexer
  1 upgraded, 0 newly installed, 0 to remove and 121 not upgraded.
  Need to get 0 B/754 MB of archives.
  After this operation, 78.8 MB of additional disk space will be used.
  Get:1 /home/vagrant/wazuh-indexer_4.8.0-wp2520_amd64.deb wazuh-indexer amd64 4.8.0-wp2520 [754 MB]
  (Reading database ... 113009 files and directories currently installed.)
  Preparing to unpack .../wazuh-indexer_4.8.0-wp2520_amd64.deb ...
  Unpacking wazuh-indexer (4.8.0-wp2520) over (4.5.3-1) ...
  Setting up wazuh-indexer (4.8.0-wp2520) ...
  Installing new version of config file /etc/wazuh-indexer/opensearch-notifications-core/notifications-core.yml ...
  Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/log4j2.xml ...
  Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy ...
  Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/rca.conf ...
  Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/rca_cluster_manager.conf ...
  Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/rca_idle_cluster_manager.conf ...
  Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/supervisord.conf ...
  Installing new version of config file /etc/wazuh-indexer/opensearch-security/config.yml ...
  Processing triggers for systemd (245.4-4ubuntu3.20) ...
  Processing triggers for libc-bin (2.31-0ubuntu9.9) ...
  

• 4.8.0 - Start service

  root@ubuntu20stack:/home/vagrant# systemctl daemon-reload
  root@ubuntu20stack:/home/vagrant# systemctl enable wazuh-indexer
  root@ubuntu20stack:/home/vagrant# systemctl start wazuh-indexer
  root@ubuntu20stack:/home/vagrant# systemctl status wazuh-indexer
  ● wazuh-indexer.service - Wazuh-indexer
      Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
      Active: active (running) since Mon 2023-10-16 18:05:08 UTC; 28s ago
      Docs: https://documentation.wazuh.com
  Main PID: 4594 (java)
      Tasks: 79 (limit: 9325)
      Memory: 1.3G
      CGroup: /system.slice/wazuh-indexer.service
              └─4594 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 ->
  
  Oct 16 18:05:02 ubuntu20stack systemd[1]: Starting Wazuh-indexer...
  Oct 16 18:05:03 ubuntu20stack systemd-entrypoint[4594]: WARNING: A terminally deprecated method in java.lang.Syst>
  Oct 16 18:05:03 ubuntu20stack systemd-entrypoint[4594]: WARNING: System::setSecurityManager has been called by or>
  Oct 16 18:05:03 ubuntu20stack systemd-entrypoint[4594]: WARNING: Please consider reporting this to the maintainer>
  Oct 16 18:05:03 ubuntu20stack systemd-entrypoint[4594]: WARNING: System::setSecurityManager will be removed in a >
  Oct 16 18:05:03 ubuntu20stack systemd-entrypoint[4594]: WARNING: A terminally deprecated method in java.lang.Syst>
  Oct 16 18:05:03 ubuntu20stack systemd-entrypoint[4594]: WARNING: System::setSecurityManager has been called by or>
  Oct 16 18:05:03 ubuntu20stack systemd-entrypoint[4594]: WARNING: Please consider reporting this to the maintainer>
  Oct 16 18:05:03 ubuntu20stack systemd-entrypoint[4594]: WARNING: System::setSecurityManager will be removed in a >
  Oct 16 18:05:08 ubuntu20stack systemd[1]: Started Wazuh-indexer.
  

• 4.8.0 - Enable shard allocation

  root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cat/nodes?v
  ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
  10.0.2.15           40          68   4    0.32    0.23     0.19 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1
  

  root@ubuntu20stack:/home/vagrant# curl -X PUT "https://192.168.56.33:9200/_cluster/settings" -u admin:admin -k -H 'Content-Type: application/json' -d'
  > {
  >   "persistent": {
  >     "cluster.routing.allocation.enable": "all"
  >   }
  > }
  > '
  {"acknowledged":true,"persistent":{"cluster":{"routing":{"allocation":{"enable":"all"}}}},"transient":{}}
  

• 4.8.0 - Check cluster status

  root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200
  {
  "name" : "node-1",
  "cluster_name" : "wazuh-cluster",
  "cluster_uuid" : "cpjW8LaMRNiwhNiSGTbLkg",
  "version" : {
      "number" : "7.10.2",
      "build_type" : "rpm",
      "build_hash" : "eee49cb340edc6c4d489bcd9324dda571fc8dc03",
      "build_date" : "2023-09-20T23:54:29.889267151Z",
      "build_snapshot" : false,
      "lucene_version" : "9.7.0",
      "minimum_wire_compatibility_version" : "7.10.0",
      "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
  }
  

  root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cat/nodes?v
  ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
  10.0.2.15           23          68   0    0.14    0.17     0.17 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1
  

  root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cat/shards
  .opensearch-observability        0 p STARTED  0  208b 10.0.2.15 node-1
  .plugins-ml-config               0 p STARTED  1 3.8kb 10.0.2.15 node-1
  .opensearch-sap-log-types-config 0 p STARTED          10.0.2.15 node-1
  .opendistro_security             0 p STARTED 10  65kb 10.0.2.15 node-1
  

  root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cluster/health?pretty
  {
  "cluster_name" : "wazuh-cluster",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "discovered_master" : true,
  "discovered_cluster_manager" : true,
  "active_primary_shards" : 4,
  "active_shards" : 4,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
  }
  

---

The DEB package shows the following message about file changes:

    Installing new version of config file /etc/wazuh-indexer/opensearch-notifications-core/notifications-core.yml ...
    Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/log4j2.xml ...
    Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy ...
    Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/rca.conf ...
    Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/rca_cluster_manager.conf ...
    Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/rca_idle_cluster_manager.conf ...
    Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/supervisord.conf ...
    Installing new version of config file /etc/wazuh-indexer/opensearch-security/config.yml ...

Changes

• opensearch-notifications-core/notifications-core.yml

  4.5.3: size_limit: 10000
  4.8.0: size_limit: 10000000
  

  4.5.3: minimum_header_length: 100
  4.8.0: minimum_header_length: 160
  

  4.5.3: allowed_config_types: ["slack","chime","webhook","email","sns","ses_account","smtp_account","email_group"]
  4.8.0: allowed_config_types: ["slack","chime","microsoft_teams","webhook","email","sns","ses_account","smtp_account","email_group"]
  

  • Conclusion
    • OpenSearch internal change, we do not control it
• opensearch-performance-analyzer/log4j2.xml

  4.5.3: <RollingFile name="PerformanceAnalyzerLog" fileName="/tmp/PerformanceAnalyzer.log" filePattern="/tmp/PerformanceAnalyzer.log.%d{yyyy-MM-dd}-%i.gz" immediateFlush="true" append="true">
  4.8.0: <RollingFile name="PerformanceAnalyzerLog" fileName="${sys:opensearch.path.home:-/tmp}/logs/PerformanceAnalyzer.log" filePattern="${sys:opensearch.path.home:-/tmp}/logs/PerformanceAnalyzer.log.%d{yyyy-MM-dd}-%i.gz" immediateFlush="true" append="true">
  

  4.5.3: <Delete basePath="/tmp">
  4.8.0: Delete basePath="${sys:opensearch.path.home:-/tmp}/logs">
  

  4.5.3: <RollingFile name="StatsLog" fileName="/tmp/performance_analyzer_agent_stats.log" filePattern="/tmp/performance_analyzer_agent_stats.log.%d{yyyy-MM-dd}-%i.gz" immediateFlush="true" append="true">
  4.8.0: <RollingFile name="StatsLog" fileName="${sys:opensearch.path.home:-/tmp}/logs/performance_analyzer_agent_stats.log" filePattern="${sys:opensearch.path.home:-/tmp}/logs/performance_analyzer_agent_stats.log.%d{yyyy-MM-dd}-%i.gz" immediateFlush="true" append="true">
  

  4.5.3: <Delete basePath="/tmp">
  4.8.0: <Delete basePath="${sys:opensearch.path.home:-/tmp}/logs/">
  

  • Conclusion
    • OpenSearch internal change, we do not control it
• opensearch-performance-analyzer/opensearch_security.policy

  4.5.3: Not present
  4.8.0: permission java.lang.RuntimePermission "getClassLoader";
  

  • Conclusion
    • New addition
    • OpenSearch internal change, we do not control it
• opensearch-performance-analyzer/rca.conf

  4.5.3: "hot-shard-rca": {
  4.5.3:   "cpu-utilization" : 0.01,
  4.5.3:   "io-total-throughput-in-bytes" : 250000.0,
  4.5.3:   "io-total-syscallrate-per-second" : 0.1
  4.5.3: },
  
  4.8.0: "hot-shard-rca": {
  4.8.0:   "cpu-utilization" : 0.015,
  4.8.0:   "top-k-consumers" : 50
  4.8.0: },
  

  4.5.3: "muted-rcas": [
  4.5.3:     "HotShardRca",
  4.5.3:     "HotShardClusterRca"
  4.5.3: ],
  
  4.8.0:  "muted-rcas": [
  4.8.0: ],
  

  • Conclusion
    • OpenSearch internal change, we do not control it
• opensearch-performance-analyzer/rca_cluster_manager.conf

  4.5.3: "hot-shard-rca": {
  4.5.3:   "cpu-utilization" : 0.01,
  4.5.3:   "io-total-throughput-in-bytes" : 250000.0,
  4.5.3:   "io-total-syscallrate-per-second" : 0.1
  4.5.3: },
  
  4.8.0: "hot-shard-rca": {
  4.8.0:   "cpu-utilization" : 0.015,
  4.8.0:   "top-k-consumers" : 50
  4.8.0: },
  

  4.5.3: "hot-shard-cluster-rca": {
  4.5.3:   "cpu-utilization-cluster-percentage" : 0.3,
  4.5.3:   "io-total-throughput-cluster-percentage" : 0.3,
  4.5.3:   "io-total-syscallrate-cluster-percentage" : 0.3
  4.5.3: },
  
  4.8.0: "hot-shard-cluster-rca": {
  4.8.0:   "cpu-utilization-cluster-percentage" : 0.3
  4.8.0: },
  

  4.5.3: "muted-rcas": [
  4.5.3:     "HotShardRca",
  4.5.3:     "HotShardClusterRca"
  4.5.3: ],
  
  4.8.0: "muted-rcas": [
  4.8.0: ],
  

  • Conclusion
    • OpenSearch internal change, we do not control it
• opensearch-performance-analyzer/rca_idle_cluster_manager.conf

  4.5.3: "hot-shard-rca": {
  4.5.3:   "cpu-utilization" : 0.01,
  4.5.3:   "io-total-throughput-in-bytes" : 250000.0,
  4.5.3:   "io-total-syscallrate-per-second" : 0.1
  4.5.3: },
  
  4.8.0: "hot-shard-rca": {
  4.8.0:   "cpu-utilization" : 0.015,
  4.8.0:   "top-k-consumers" : 50
  4.8.0: },
  

  4.5.3: "hot-shard-cluster-rca": {
  4.5.3:   "cpu-utilization-cluster-percentage" : 0.3,
  4.5.3:   "io-total-throughput-cluster-percentage" : 0.3,
  4.5.3:   "io-total-syscallrate-cluster-percentage" : 0.3
  4.5.3: },
  
  4.8.0: "hot-shard-cluster-rca": {
  4.8.0:   "cpu-utilization-cluster-percentage" : 0.3
  4.8.0: },
  

  4.5.3: "muted-rcas": [
  4.5.3:     "HotShardRca",
  4.5.3:     "HotShardClusterRca"
  4.5.3: ],
  
  4.8.0: "muted-rcas": [
  4.8.0: ],
  

  • Conclusion
    • OpenSearch internal change, we do not control it
• opensearch-performance-analyzer/supervisord.conf

  4.5.3: childlogdir=/usr/share/supervisor/performance_analyzer            ; ('AUTO' child log dir, default $TEMP)
  
  4.8.0: childlogdir=/usr/share/supervisor/performance_analyzer             ; ('AUTO' child log dir, default $TEMP)
  

  4.5.3: ; include files themselves.
  4.5.3: 
  4.5.3: [include]
  
  4.8.0: ; include files themselves.
  4.8.0: [include]
  

  4.5.3: Not present 
  
  4.8.0: autostart=true                                                      ; start at supervisord start (default: true)
  4.8.0: autorestart=unexpected                                              ; autorestart if exited after running (def: unexpected)
  4.8.0: exitcodes=1                                                         ; 'expected' exit codes used with autorestart, System.exit(1) called from PerformanceAnalyzerApp.cleanupAndExit() - if Reader Thread crashes.
  4.8.0:  
  4.8.0: [eventlistener:stop_supervisord]
  4.8.0: command=bash -c "printf 'READY\n' && while read line; do kill -SIGQUIT $PPID; done < /dev/stdin"
  4.8.0: events=PROCESS_STATE_FATAL
  4.8.0: buffer_size=100
  

  • Conclusion
    • OpenSearch internal change, we do not control it
• opensearch-security/config.yml

  4.5.3: ; supervisor config file
  4.5.3: 
  4.5.3: [unix_http_server]
  4.5.3: file=/usr/share/supervisor/performance_analyzer/supervisord.sock
  4.5.3: chmod=0770
  4.5.3: 
  4.5.3: [supervisord]
  4.5.3: logfile=/usr/share/supervisor/performance_analyzer/supervisord.log ; (main log file;default $CWD/supervisord.log)
  4.5.3: pidfile=/usr/share/supervisor/performance_analyzer/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
  4.5.3: childlogdir=/usr/share/supervisor/performance_analyzer            ; ('AUTO' child log dir, default $TEMP)
  4.5.3: 
  4.5.3: ; the below section must remain in the config file for RPC
  4.5.3: ; (supervisorctl/web interface) to work, additional interfaces may be
  4.5.3: ; added by defining them in separate rpcinterface: sections
  4.5.3: [rpcinterface:supervisor]
  4.5.3: supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
  4.5.3: 
  4.5.3: [supervisorctl]
  4.5.3: serverurl=/usr/share/supervisord.sock
  4.5.3: 
  4.5.3: ; The [include] section can just contain the "files" setting.  This
  4.5.3: ; setting can list multiple files (separated by whitespace or
  4.5.3: ; newlines).  It can also contain wildcards.  The filenames are
  4.5.3: ; interpreted as relative to this file.  Included files *cannot*a---
  
  4.8.0: ---
  

  4.5.3: Not present
  
  4.8.0: #private_tenant_enabled: true
  4.8.0: #default_tenant: ""
  

  4.5.3: Not present
  
  4.8.0: jwt_clock_skew_tolerance_seconds: 30
  

  4.5.3: ; include files themselves.
  4.5.3: 
  4.5.3: [include]
  4.5.3: files = /etc/supervisor/conf.d/*.conf
  4.5.3: 
  4.5.3: [program:performance_analyzer]
  4.5.3: command=/usr/share/opensearch/performance-analyzer-rca/bin/performance-analyzer-agent /usr/share/opensearch
  4.5.3: user=1000
  
  4.8.0: Not present
  

  • Conclusion
    • OpenSearch internal change, we do not control it

---

Conclusion

• OpenSearch internal changes, we do not control it

[rauldpm]

It is necessary to finish the Wazuh dashboard bump to continue with the remaining tasks

[rauldpm]

Update report

• Stable Wazuh dashboard packages have been created and Test_stack testing can be started, the remaining tests will be tracked at Bump Wazuh dashboard to OpenSearch Dashboards 2.10.0 #2521 (comment)
• Created ECR resources
  • base_indexer_builder_x86_64_4-8-0
  • base_indexer_builder_amd64_4-8-0
  • rpm_indexer_builder_x86_64_4-8-0
  • deb_indexer_builder_amd64_4-8-0
• Created ECS resources
  • Packages_deb_indexer_amd64_4-8-0
  • Packages_rpm_indexer_x86_64_4-8-0
• Packages built successfully
  • https://ci.wazuh.info/job/Packages_builder/171786/
    • https://ci.wazuh.info/job/Packages_builder/171792/
  • Note: Failed build is related to a race condition with the shared base directory

[davidjiglesias]

LGTM!