Manually test 4.5.1 OVA and AMI after retagging

[davidjiglesias]

After retagging v4.5.1-rc2, we need to add some minor manual testing to ensure the newly generated OVA and AMI are correct.

Tasks:

• Test OVA installation
• Test AMI installation

Test packages

System	Build	Install	Deployment install	Upgrade	Remove	TCP	UDP	Errors found	Warnings found	Alerts found	Check users
OVA	🟢	🟢	---	---	---	🟢	🟢	🟢	🟢	🟡	🟢

---

OVA-specific tests

System	Filebeat test	Cluster green/yellow	Production repositories	UI Access	No SSH root access	SSH user access	Wazuh dashboard/APP version	Dashboard/Indexer VERSION file
OVA	🟢	🟢	🟢	🟢	🟢	🟢	🟢	🟢

AMI-specific tests

System	Services	Errors and warnings	Agent connection	Alerts seen in manager
AMI	🟢	🟢	🟢	🟢

Summary

OVA

Just some warnings and alerts were detected. All those were reported and treated previously, but it seems that still, some persist from 4.4.5.

• Systemd-entrypoint warnings in wazuh indexer in 4.4.5 wazuh-packages#2325
• Wazuh dashboard show errors related to SSL in 4.4.5 wazuh-packages#2326

AMI

No abnormalities were detected

[verdx]

AMI test 🟢

The AMI has been tested and is installed correctly on a c5a.large instance, as recommended in the documentation

🟢 Testing after the installation

Services:

$ sudo systemctl status wazuh-manager.service wazuh-indexer.service wazuh-dashboard.service 
● wazuh-manager.service - Wazuh manager
   Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2023-08-24 08:45:44 UTC; 3min 0s ago
   CGroup: /system.slice/wazuh-manager.service
           ├─2680 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
           ├─2720 /var/ossec/bin/wazuh-authd
           ├─2730 /var/ossec/bin/wazuh-db
           ├─2761 /var/ossec/bin/wazuh-execd
           ├─2763 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
           ├─2766 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
           ├─2785 /var/ossec/bin/wazuh-analysisd
           ├─2799 /var/ossec/bin/wazuh-syscheckd
           ├─2816 /var/ossec/bin/wazuh-remoted
           ├─2878 /var/ossec/bin/wazuh-logcollector
           ├─2898 /var/ossec/bin/wazuh-monitord
           └─2919 /var/ossec/bin/wazuh-modulesd

Aug 24 08:45:35 wazuh-server env[2247]: Started wazuh-db...
Aug 24 08:45:36 wazuh-server env[2247]: Started wazuh-execd...
Aug 24 08:45:37 wazuh-server env[2247]: Started wazuh-analysisd...
Aug 24 08:45:38 wazuh-server env[2247]: Started wazuh-syscheckd...
Aug 24 08:45:39 wazuh-server env[2247]: Started wazuh-remoted...
Aug 24 08:45:40 wazuh-server env[2247]: Started wazuh-logcollector...
Aug 24 08:45:41 wazuh-server env[2247]: Started wazuh-monitord...
Aug 24 08:45:42 wazuh-server env[2247]: Started wazuh-modulesd...
Aug 24 08:45:44 wazuh-server env[2247]: Completed.
Aug 24 08:45:44 wazuh-server systemd[1]: Started Wazuh manager.

● wazuh-indexer.service - Wazuh-indexer
   Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2023-08-24 08:46:12 UTC; 2min 33s ago
     Docs: https://documentation.wazuh.com
 Main PID: 2257 (java)
   CGroup: /system.slice/wazuh-indexer.service
           └─2257 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+Alway...

Aug 24 08:45:15 wazuh-server systemd-entrypoint[2257]: at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:242)
Aug 24 08:45:15 wazuh-server systemd-entrypoint[2257]: at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:404)
Aug 24 08:45:15 wazuh-server systemd-entrypoint[2257]: at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:180)
Aug 24 08:45:15 wazuh-server systemd-entrypoint[2257]: at org.opensearch.bootstrap.OpenSearch.execute(OpenSearch.java:171)
Aug 24 08:45:15 wazuh-server systemd-entrypoint[2257]: at org.opensearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:104)
Aug 24 08:45:15 wazuh-server systemd-entrypoint[2257]: at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
Aug 24 08:45:15 wazuh-server systemd-entrypoint[2257]: at org.opensearch.cli.Command.main(Command.java:101)
Aug 24 08:45:15 wazuh-server systemd-entrypoint[2257]: at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:137)
Aug 24 08:45:15 wazuh-server systemd-entrypoint[2257]: at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:103)
Aug 24 08:46:12 wazuh-server systemd[1]: Started Wazuh-indexer.

● wazuh-dashboard.service - wazuh-dashboard
   Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2023-08-24 08:46:27 UTC; 2min 18s ago
 Main PID: 4176 (node)
   CGroup: /system.slice/wazuh-dashboard.service
           └─4176 /usr/share/wazuh-dashboard/bin/../node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/bin/.....

Aug 24 08:46:35 wazuh-server opensearch-dashboards[4176]: {"type":"log","@timestamp":"2023-08-24T08:46:35Z","tags":["info","plugins-service"],"pid":4176,"message...Source]"}
Aug 24 08:46:35 wazuh-server opensearch-dashboards[4176]: {"type":"log","@timestamp":"2023-08-24T08:46:35Z","tags":["info","plugins-service"],"pid":4176,"message...sabled."}
Aug 24 08:46:35 wazuh-server opensearch-dashboards[4176]: {"type":"log","@timestamp":"2023-08-24T08:46:35Z","tags":["info","plugins-service"],"pid":4176,"message...sabled."}
Aug 24 08:46:35 wazuh-server opensearch-dashboards[4176]: {"type":"log","@timestamp":"2023-08-24T08:46:35Z","tags":["info","plugins-service"],"pid":4176,"message...sabled."}
Aug 24 08:46:35 wazuh-server opensearch-dashboards[4176]: {"type":"log","@timestamp":"2023-08-24T08:46:35Z","tags":["info","plugins-system"],"pid":4176,"message"...port,expr
Aug 24 08:46:35 wazuh-server opensearch-dashboards[4176]: {"type":"log","@timestamp":"2023-08-24T08:46:35Z","tags":["info","savedobjects-service"],"pid":4176,"me...ions..."}
Aug 24 08:46:36 wazuh-server opensearch-dashboards[4176]: {"type":"log","@timestamp":"2023-08-24T08:46:36Z","tags":["info","savedobjects-service"],"pid":4176,"me...rations"}
Aug 24 08:46:36 wazuh-server opensearch-dashboards[4176]: {"type":"log","@timestamp":"2023-08-24T08:46:36Z","tags":["info","plugins-system"],"pid":4176,"message"...rt,expres
Aug 24 08:46:37 wazuh-server opensearch-dashboards[4176]: {"type":"log","@timestamp":"2023-08-24T08:46:37Z","tags":["listening","info"],"pid":4176,"message":"Ser...0.0:443"}
Aug 24 08:46:37 wazuh-server opensearch-dashboards[4176]: {"type":"log","@timestamp":"2023-08-24T08:46:37Z","tags":["info","http","server","OpenSearchDashboards"...0.0:443"}
Hint: Some lines were ellipsized, use -l to show in full.

$ sudo filebeat test output
elasticsearch: https://127.0.0.1:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 127.0.0.1
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.2
    dial up... OK
  talk to server... OK
  version: 7.10.2


$ curl -k -u admin:i-06e95f222f08a4999 https://localhost:9200/_cat/nodes?v
ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
127.0.0.1            7          95   9    0.06    0.72     0.47 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1

Errors and warnings:

# grep -E 'error|ERROR|warning|WARNING' /var/ossec/logs/ossec.log 
#

Agent connection:

# /var/ossec/bin/agent_control -l

Wazuh agent_control. List of available agents:
   ID: 000, Name: wazuh-server (server), IP: 127.0.0.1, Active/Local
   ID: 001, Name: ubuntu22, IP: any, Active

List of agentless devices:

[root@wazuh-server wazuh-user]# /var/ossec/bin/agent_control -i 001

Wazuh agent_control. Agent information:
   Agent ID:   001
   Agent Name: ubuntu22
   IP address: any
   Status:     Active

   Operating system:    Linux |ubuntu22 |5.15.0-69-generic |#76-Ubuntu SMP Fri Mar 17 17:19:29 UTC 2023 |x86_64
   Client version:      Wazuh v4.5.1
   Configuration hash:  ab73af41699f13fdd81903b5f23d8d00
   Shared file hash:    4a8724b20dee0124ff9656783c490c4e
   Last keep alive:     1692867948

   Syscheck last started at:  Thu Aug 24 09:04:15 2023
   Syscheck last ended at:    Thu Aug 24 09:05:25 2023

Alerts seen in manager:

{"timestamp":"2023-08-24T09:05:42.833+0000","rule":{"level":7,"description":"SCA summary: CIS Ubuntu Linux 22.04 LTS Benchmark v1.0.0: Score less than 50% (42)","id":"19004","firedtimes":2,"mail":false,"groups":["sca"],"gdpr":["IV_35.7.d"],"pci_dss":["2.2"],"nist_800_53":["CM.1"],"tsc":["CC7.1","CC7.2"]},"agent":{"id":"001","name":"ubuntu22","ip":"10.0.2.15"},"manager":{"name":"wazuh-server"},"id":"1692867942.672139","decoder":{"name":"sca"},"data":{"sca":{"type":"summary","scan_id":"1441873773","policy":"CIS Ubuntu Linux 22.04 LTS Benchmark v1.0.0","description":"This document provides prescriptive guidance for establishing a secure configuration posture for Ubuntu Linux 22.04 LTS based on CIS benchmark for Ubuntu Linux 22.04 LTS.","policy_id":"cis_ubuntu22-04","passed":"76","failed":"104","invalid":"2","total_checks":"182","score":"42","file":"cis_ubuntu22-04.yml"}},"location":"sca"}

[pro-akim]

Analysis report - OVA 🟢

Agent info

[root@wazuh-centos vagrant]# curl -O https://packages-dev.wazuh.com/pre-release/yum/wazuh-agent-4.5.1-1.x86_64.rpm
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 8915k  100 8915k    0     0  2854k      0  0:00:03  0:00:03 --:--:-- 2855k
[root@wazuh-centos vagrant]# ls
wazuh-agent-4.5.1-1.x86_64.rpm
[root@wazuh-centos vagrant]# yum localinstall -y wazuh-agent-4.5.1-1.x86_64.rpm
Failed to set locale, defaulting to C.UTF-8
CentOS Linux 8 - AppStream                             6.0 MB/s | 8.4 MB     00:01    
CentOS Linux 8 - BaseOS                                6.5 MB/s | 4.6 MB     00:00    
CentOS Linux 8 - Extras                                 70 kB/s |  10 kB     00:00    
Extra Packages for Enterprise Linux 8 - x86_64         2.1 MB/s |  16 MB     00:07    
Last metadata expiration check: 0:00:01 ago on Thu Aug 24 08:57:45 2023.
Dependencies resolved.
=======================================================================================
 Package               Architecture     Version           Repository              Size
=======================================================================================
Installing:
 wazuh-agent           x86_64           4.5.1-1           @commandline           8.7 M

Transaction Summary
=======================================================================================
Install  1 Package

Total size: 8.7 M
Installed size: 25 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                               1/1 
  Running scriptlet: wazuh-agent-4.5.1-1.x86_64                                    1/1 
  Installing       : wazuh-agent-4.5.1-1.x86_64                                    1/1 
  Running scriptlet: wazuh-agent-4.5.1-1.x86_64                                    1/1 
  Verifying        : wazuh-agent-4.5.1-1.x86_64                                    1/1 

Installed:
  wazuh-agent-4.5.1-1.x86_64                                                           

Complete!
[root@wazuh-centos vagrant]# vi /var/ossec/etc/ossec.conf
[root@wazuh-centos vagrant]# cat /var/ossec/etc/ossec.conf | grep address
      <address>192.168.1.47</address>
[root@wazuh-centos vagrant]# /var/ossec/bin/wazuh-control start
Starting Wazuh v4.5.1...
Started wazuh-execd...
Started wazuh-agentd...
Started wazuh-syscheckd...
Started wazuh-logcollector...
Started wazuh-modulesd...
Completed.
[root@wazuh-centos vagrant]# /var/ossec/bin/wazuh-control info
WAZUH_VERSION="v4.5.1"
WAZUH_REVISION="40503"
WAZUH_TYPE="agent"

``

```console
[root@wazuh-server wazuh-user]# /var/ossec/bin/agent_control -l

Wazuh agent_control. List of available agents:
   ID: 000, Name: wazuh-server (server), IP: 127.0.0.1, Active/Local
   ID: 001, Name: wazuh-centos, IP: any, Active

List of agentless devices:



[root@wazuh-server wazuh-user]# /var/ossec/bin/agent_control -i 001

Wazuh agent_control. Agent information:
   Agent ID:   001
   Agent Name: wazuh-centos
   IP address: any
   Status:     Active

   Operating system:    Linux |wazuh-centos |4.18.0-348.7.1.el8_5.x86_64 |#1 SMP Wed Dec 22 13:25:12 UTC 2021 |x86_64
   Client version:      Wazuh v4.5.1
   Configuration hash:  ab73af41699f13fdd81903b5f23d8d00
   Shared file hash:    4a8724b20dee0124ff9656783c490c4e
   Last keep alive:     1692867836

   Syscheck last started at:  Thu Aug 24 09:01:58 2023
   Syscheck last ended at:    Thu Aug 24 09:02:00 2023

OVA - Check Wazuh agent connection

[root@wazuh-server wazuh-user]# cat /etc/os-release
NAME="Amazon Linux"
VERSION="2"
ID="amzn"
ID_LIKE="centos rhel fedora"
VERSION_ID="2"
PRETTY_NAME="Amazon Linux 2"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"
HOME_URL="https://amazonlinux.com/"

[root@wazuh-server wazuh-user]# grep "tcp" /var/ossec/etc/ossec.conf
    <protocol>tcp</protocol>
[root@wazuh-server wazuh-user]# /var/ossec/bin/agent_control -i 001

Wazuh agent_control. Agent information:
   Agent ID:   001
   Agent Name: wazuh-centos
   IP address: any
   Status:     Active

   Operating system:    Linux |wazuh-centos |4.18.0-348.7.1.el8_5.x86_64 |#1 SMP Wed Dec 22 13:25:12 UTC 2021 |x86_64
   Client version:      Wazuh v4.5.1
   Configuration hash:  ab73af41699f13fdd81903b5f23d8d00
   Shared file hash:    4a8724b20dee0124ff9656783c490c4e
   Last keep alive:     1692867896

   Syscheck last started at:  Thu Aug 24 09:01:58 2023
   Syscheck last ended at:    Thu Aug 24 09:02:00 2023


[root@wazuh-server wazuh-user]#  grep -i -E "tcp" /var/ossec/logs/ossec.log
2023/08/18 13:39:32 wazuh-remoted: INFO: Started (pid: 9960). Listening on port 1514/TCP (secure).
2023/08/24 08:41:42 wazuh-remoted: INFO: Started (pid: 11224). Listening on port 1514/TCP (secure).

[root@wazuh-server wazuh-user]# sed -i "s/tcp/udp/" /var/ossec/etc/ossec.conf
[root@wazuh-server wazuh-user]# grep "udp" /var/ossec/etc/ossec.conf
    <protocol>udp</protocol>


[root@wazuh-server wazuh-user]# /var/ossec/bin/wazuh-control restart
wazuh-clusterd not running...
Killing wazuh-modulesd...
Killing wazuh-monitord...
Killing wazuh-logcollector...
Killing wazuh-remoted...
Killing wazuh-syscheckd...
Killing wazuh-analysisd...
wazuh-maild not running...
Killing wazuh-execd...
Killing wazuh-db...
Killing wazuh-authd...
wazuh-agentlessd not running...
wazuh-integratord not running...
wazuh-dbd not running...
wazuh-csyslogd not running...
Killing wazuh-apid...
Wazuh v4.5.1 Stopped
Starting Wazuh v4.5.1...
Started wazuh-apid...
Started wazuh-csyslogd...
Started wazuh-dbd...
2023/08/24 09:06:22 wazuh-integratord: INFO: Remote integrations not configured. Clean exit.
Started wazuh-integratord...
Started wazuh-agentlessd...
Started wazuh-authd...
Started wazuh-db...
Started wazuh-execd...
Started wazuh-analysisd...
Started wazuh-syscheckd...
Started wazuh-remoted...
Started wazuh-logcollector...
Started wazuh-monitord...
Started wazuh-modulesd...
Completed.

[root@wazuh-server wazuh-user]# grep -i -E "udp" /var/ossec/logs/ossec.log
2023/07/31 18:02:36 wazuh-remoted: INFO: Started (pid: 19391). Listening on port 1514/UDP (secure).

[root@wazuh-server wazuh-user]# /var/ossec/bin/agent_control -i 001

Wazuh agent_control. Agent information:
   Agent ID:   001
   Agent Name: wazuh-centos
   IP address: any
   Status:     Disconnected

   Operating system:    Linux |wazuh-centos |4.18.0-348.7.1.el8_5.x86_64 |#1 SMP Wed Dec 22 13:25:12 UTC 2021 |x86_64
   Client version:      Wazuh v4.5.1
   Configuration hash:  ab73af41699f13fdd81903b5f23d8d00
   Shared file hash:    4a8724b20dee0124ff9656783c490c4e
   Last keep alive:     1692867976

   Syscheck last started at:  Thu Aug 24 09:01:58 2023
   Syscheck last ended at:    Thu Aug 24 09:02:00 2023



[root@wazuh-server wazuh-user]# grep -i -E "error|critical|fatal|warning" /var/ossec/logs/ossec.log
2023/08/18 11:44:45 manage_agents: CRITICAL: Key import only available on an agent.
2023/08/24 09:06:57 wazuh-authd: WARNING: Duplicate name 'wazuh-centos', rejecting enrollment. Agent '001' has not been disconnected long enough to be replaced.

• Agent

[root@wazuh-centos vagrant]# grep -i -E "tcp" /var/ossec/logs/ossec.log
2023/08/24 09:01:51 wazuh-agentd: INFO: Trying to connect to server ([192.168.1.47]:1514/tcp).
2023/08/24 09:01:51 wazuh-agentd: INFO: (4102): Connected to the server ([192.168.1.47]:1514/tcp).
2023/08/24 09:01:56 wazuh-agentd: INFO: Trying to connect to server ([192.168.1.47]:1514/tcp).
2023/08/24 09:01:56 wazuh-agentd: INFO: (4102): Connected to the server ([192.168.1.47]:1514/tcp).
2023/08/24 09:06:17 wazuh-agentd: INFO: Closing connection to server ([192.168.1.47]:1514/tcp).
2023/08/24 09:06:17 wazuh-agentd: INFO: Trying to connect to server ([192.168.1.47]:1514/tcp).
2023/08/24 09:06:17 wazuh-agentd: ERROR: (1216): Unable to connect to '[192.168.1.47]:1514/tcp': 'Connection refused'.
2023/08/24 09:06:27 wazuh-agentd: INFO: Trying to connect to server ([192.168.1.47]:1514/tcp).
2023/08/24 09:06:27 wazuh-agentd: ERROR: (1216): Unable to connect to '[192.168.1.47]:1514/tcp': 'Connection refused'.
2023/08/24 09:06:37 wazuh-agentd: INFO: Trying to connect to server ([192.168.1.47]:1514/tcp).
2023/08/24 09:06:37 wazuh-agentd: ERROR: (1216): Unable to connect to '[192.168.1.47]:1514/tcp': 'Connection refused'.
2023/08/24 09:06:47 wazuh-agentd: INFO: Trying to connect to server ([192.168.1.47]:1514/tcp).
2023/08/24 09:06:47 wazuh-agentd: ERROR: (1216): Unable to connect to '[192.168.1.47]:1514/tcp': 'Connection refused'.
2023/08/24 09:06:57 wazuh-agentd: INFO: Trying to connect to server ([192.168.1.47]:1514/tcp).
2023/08/24 09:06:57 wazuh-agentd: ERROR: (1216): Unable to connect to '[192.168.1.47]:1514/tcp': 'Connection refused'.
2023/08/24 09:07:07 wazuh-agentd: INFO: Trying to connect to server ([192.168.1.47]:1514/tcp).
2023/08/24 09:07:07 wazuh-agentd: ERROR: (1216): Unable to connect to '[192.168.1.47]:1514/tcp': 'Connection refused'.
2023/08/24 09:07:17 wazuh-agentd: INFO: Trying to connect to server ([192.168.1.47]:1514/tcp).
2023/08/24 09:07:17 wazuh-agentd: ERROR: (1216): Unable to connect to '[192.168.1.47]:1514/tcp': 'Connection refused'.
2023/08/24 09:07:27 wazuh-agentd: INFO: Trying to connect to server ([192.168.1.47]:1514/tcp).
2023/08/24 09:07:27 wazuh-agentd: ERROR: (1216): Unable to connect to '[192.168.1.47]:1514/tcp': 'Connection refused'.
2023/08/24 09:07:37 wazuh-agentd: INFO: Trying to connect to server ([192.168.1.47]:1514/tcp).
2023/08/24 09:07:37 wazuh-agentd: ERROR: (1216): Unable to connect to '[192.168.1.47]:1514/tcp': 'Connection refused'.
2023/08/24 09:07:47 wazuh-agentd: INFO: Trying to connect to server ([192.168.1.47]:1514/tcp).
2023/08/24 09:07:47 wazuh-agentd: ERROR: (1216): Unable to connect to '[192.168.1.47]:1514/tcp': 'Connection refused'.



[root@wazuh-centos vagrant]# sed -i "s/tcp/udp/" /var/ossec/etc/ossec.conf
[root@wazuh-centos vagrant]# grep "udp" /var/ossec/etc/ossec.conf
      <protocol>udp</protocol>



[root@wazuh-centos vagrant]# /var/ossec/bin/wazuh-control restart
Killing wazuh-modulesd... 
Killing wazuh-logcollector... 
Killing wazuh-syscheckd... 
Killing wazuh-agentd... 
Killing wazuh-execd... 
Wazuh v4.5.1 Stopped
Starting Wazuh v4.5.1...
Started wazuh-execd...
Started wazuh-agentd...
Started wazuh-syscheckd...
Started wazuh-logcollector...
Started wazuh-modulesd...
Completed.


[root@wazuh-centos vagrant]# grep -i -E "udp" /var/ossec/logs/ossec.log
2023/08/24 09:08:45 wazuh-agentd: INFO: Trying to connect to server ([192.168.1.47]:1514/udp).
2023/08/24 09:08:45 wazuh-agentd: INFO: (4102): Connected to the server ([192.168.1.47]:1514/udp).

Wazuh processes

[root@wazuh-server wazuh-user]# ps -ef | grep wazuh
wazuh-d+  2443     1  1 08:40 ?        00:00:17 /usr/share/wazuh-dashboard/bin/../node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/bin/../src/cli/dist -c /etc/wazuh-dashboard/opensearch_dashboards.yml
root      6989     1  0 08:41 ?        00:00:00 /sbin/dhclient -1 -q -lf /var/lib/dhclient/dhclient--eth0.lease -pf /var/run/dhclient-eth0.pid -H wazuh-server eth0
wazuh-i+  7351     1  7 08:41 ?        00:01:59 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -XX:+ShowCodeDetailsInExceptionMessages -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dio.netty.allocator.numDirectArenas=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.locale.providers=SPI,COMPAT -Xms3981m -Xmx3981m -XX:+UseG1GC -XX:G1ReservePercent=25 -XX:InitiatingHeapOccupancyPercent=30 -Djava.io.tmpdir=/tmp/opensearch-8176521988288616105 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/lib/wazuh-indexer -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m -Dclk.tck=100 -Djdk.attach.allowAttachSelf=true -Djava.security.policy=file:///etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy --add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED -XX:MaxDirectMemorySize=2087714816 -Dopensearch.path.home=/usr/share/wazuh-indexer -Dopensearch.path.conf=/etc/wazuh-indexer -Dopensearch.distribution.type=rpm -Dopensearch.bundled_jdk=true -cp /usr/share/wazuh-indexer/lib/* org.opensearch.bootstrap.OpenSearch -p /run/wazuh-indexer/wazuh-indexer.pid --quiet
root     19003     1  0 08:42 ?        00:00:00 login -- wazuh-user
wazuh-u+ 19006 19003  0 08:43 tty1     00:00:00 -bash
root     19051  7357  0 08:49 ?        00:00:00 sshd: wazuh-user [priv]
wazuh-u+ 19054 19051  0 08:49 ?        00:00:00 sshd: wazuh-user@pts/0
wazuh-u+ 19055 19054  0 08:49 pts/0    00:00:00 -bash
wazuh    19350     1  3 09:06 ?        00:00:06 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
root     19390     1  0 09:06 ?        00:00:00 /var/ossec/bin/wazuh-authd
wazuh    19404     1  0 09:06 ?        00:00:00 /var/ossec/bin/wazuh-db
root     19429     1  0 09:06 ?        00:00:00 /var/ossec/bin/wazuh-execd
wazuh    19433 19350  0 09:06 ?        00:00:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
wazuh    19436 19350  0 09:06 ?        00:00:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
wazuh    19450     1  0 09:06 ?        00:00:00 /var/ossec/bin/wazuh-analysisd
root     19460     1  4 09:06 ?        00:00:08 /var/ossec/bin/wazuh-syscheckd
wazuh    19526     1  0 09:06 ?        00:00:00 /var/ossec/bin/wazuh-remoted
root     19562     1  0 09:06 ?        00:00:00 /var/ossec/bin/wazuh-logcollector
wazuh    19581     1  0 09:06 ?        00:00:00 /var/ossec/bin/wazuh-monitord
root     19623     1  0 09:06 ?        00:00:00 /var/ossec/bin/wazuh-modulesd
root     20472 19087  0 09:09 pts/0    00:00:00 grep --color=auto wazuh


[root@wazuh-server wazuh-user]# /var/ossec/bin/wazuh-control restart
wazuh-clusterd not running...
Killing wazuh-modulesd...
Killing wazuh-monitord...
Killing wazuh-logcollector...
Killing wazuh-remoted...
Killing wazuh-syscheckd...
Killing wazuh-analysisd...
wazuh-maild not running...
Killing wazuh-execd...
Killing wazuh-db...
Killing wazuh-authd...
wazuh-agentlessd not running...
wazuh-integratord not running...
wazuh-dbd not running...
wazuh-csyslogd not running...
Killing wazuh-apid...
Wazuh v4.5.1 Stopped
Starting Wazuh v4.5.1...
Started wazuh-apid...
Started wazuh-csyslogd...
Started wazuh-dbd...
2023/08/24 09:09:47 wazuh-integratord: INFO: Remote integrations not configured. Clean exit.
Started wazuh-integratord...
Started wazuh-agentlessd...
Started wazuh-authd...
Started wazuh-db...
Started wazuh-execd...
Started wazuh-analysisd...
Started wazuh-syscheckd...
Started wazuh-remoted...
Started wazuh-logcollector...
Started wazuh-monitord...
Started wazuh-modulesd...
Completed.




[root@wazuh-server wazuh-user]# ps -ef | grep wazuh
wazuh-d+  2443     1  1 08:40 ?        00:00:18 /usr/share/wazuh-dashboard/bin/../node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/bin/../src/cli/dist -c /etc/wazuh-dashboard/opensearch_dashboards.yml
root      6989     1  0 08:41 ?        00:00:00 /sbin/dhclient -1 -q -lf /var/lib/dhclient/dhclient--eth0.lease -pf /var/run/dhclient-eth0.pid -H wazuh-server eth0
wazuh-i+  7351     1  6 08:41 ?        00:02:01 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -XX:+ShowCodeDetailsInExceptionMessages -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dio.netty.allocator.numDirectArenas=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.locale.providers=SPI,COMPAT -Xms3981m -Xmx3981m -XX:+UseG1GC -XX:G1ReservePercent=25 -XX:InitiatingHeapOccupancyPercent=30 -Djava.io.tmpdir=/tmp/opensearch-8176521988288616105 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/lib/wazuh-indexer -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m -Dclk.tck=100 -Djdk.attach.allowAttachSelf=true -Djava.security.policy=file:///etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy --add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED -XX:MaxDirectMemorySize=2087714816 -Dopensearch.path.home=/usr/share/wazuh-indexer -Dopensearch.path.conf=/etc/wazuh-indexer -Dopensearch.distribution.type=rpm -Dopensearch.bundled_jdk=true -cp /usr/share/wazuh-indexer/lib/* org.opensearch.bootstrap.OpenSearch -p /run/wazuh-indexer/wazuh-indexer.pid --quiet
root     19003     1  0 08:42 ?        00:00:00 login -- wazuh-user
wazuh-u+ 19006 19003  0 08:43 tty1     00:00:00 -bash
root     19051  7357  0 08:49 ?        00:00:00 sshd: wazuh-user [priv]
wazuh-u+ 19054 19051  0 08:49 ?        00:00:00 sshd: wazuh-user@pts/0
wazuh-u+ 19055 19054  0 08:49 pts/0    00:00:00 -bash
wazuh    20651     1  8 09:09 ?        00:00:06 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
root     20692     1  0 09:09 ?        00:00:00 /var/ossec/bin/wazuh-authd
wazuh    20708     1  0 09:09 ?        00:00:00 /var/ossec/bin/wazuh-db
wazuh    20723 20651  0 09:09 ?        00:00:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
wazuh    20726 20651  0 09:09 ?        00:00:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
root     20739     1  0 09:09 ?        00:00:00 /var/ossec/bin/wazuh-execd
wazuh    20754     1  0 09:09 ?        00:00:00 /var/ossec/bin/wazuh-analysisd
root     20816     1 12 09:09 ?        00:00:09 /var/ossec/bin/wazuh-syscheckd
wazuh    20831     1  0 09:09 ?        00:00:00 /var/ossec/bin/wazuh-remoted
root     20863     1  0 09:09 ?        00:00:00 /var/ossec/bin/wazuh-logcollector
wazuh    20889     1  0 09:09 ?        00:00:00 /var/ossec/bin/wazuh-monitord
root     20938     1  0 09:09 ?        00:00:00 /var/ossec/bin/wazuh-modulesd
root     21777 19087  0 09:11 pts/0    00:00:00 grep --color=auto wazuh



[root@wazuh-server wazuh-user]# service wazuh-manager restart
Restarting wazuh-manager (via systemctl):                  [  OK  ]



[root@wazuh-server wazuh-user]# ps -ef | grep wazuh
wazuh-d+  2443     1  0 08:40 ?        00:00:18 /usr/share/wazuh-dashboard/bin/../node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/bin/../src/cli/dist -c /etc/wazuh-dashboard/opensearch_dashboards.yml
root      6989     1  0 08:41 ?        00:00:00 /sbin/dhclient -1 -q -lf /var/lib/dhclient/dhclient--eth0.lease -pf /var/run/dhclient-eth0.pid -H wazuh-server eth0
wazuh-i+  7351     1  6 08:41 ?        00:02:02 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -XX:+ShowCodeDetailsInExceptionMessages -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dio.netty.allocator.numDirectArenas=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.locale.providers=SPI,COMPAT -Xms3981m -Xmx3981m -XX:+UseG1GC -XX:G1ReservePercent=25 -XX:InitiatingHeapOccupancyPercent=30 -Djava.io.tmpdir=/tmp/opensearch-8176521988288616105 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/lib/wazuh-indexer -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m -Dclk.tck=100 -Djdk.attach.allowAttachSelf=true -Djava.security.policy=file:///etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy --add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED -XX:MaxDirectMemorySize=2087714816 -Dopensearch.path.home=/usr/share/wazuh-indexer -Dopensearch.path.conf=/etc/wazuh-indexer -Dopensearch.distribution.type=rpm -Dopensearch.bundled_jdk=true -cp /usr/share/wazuh-indexer/lib/* org.opensearch.bootstrap.OpenSearch -p /run/wazuh-indexer/wazuh-indexer.pid --quiet
root     19003     1  0 08:42 ?        00:00:00 login -- wazuh-user
wazuh-u+ 19006 19003  0 08:43 tty1     00:00:00 -bash
root     19051  7357  0 08:49 ?        00:00:00 sshd: wazuh-user [priv]
wazuh-u+ 19054 19051  0 08:49 ?        00:00:00 sshd: wazuh-user@pts/0
wazuh-u+ 19055 19054  0 08:49 pts/0    00:00:00 -bash
wazuh    21992     1 31 09:11 ?        00:00:06 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
root     22032     1  0 09:11 ?        00:00:00 /var/ossec/bin/wazuh-authd
wazuh    22049     1  0 09:11 ?        00:00:00 /var/ossec/bin/wazuh-db
wazuh    22064 21992  0 09:11 ?        00:00:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
wazuh    22067 21992  0 09:11 ?        00:00:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
root     22080     1  0 09:11 ?        00:00:00 /var/ossec/bin/wazuh-execd
wazuh    22095     1  3 09:11 ?        00:00:00 /var/ossec/bin/wazuh-analysisd
root     22157     1 30 09:11 ?        00:00:05 /var/ossec/bin/wazuh-syscheckd
wazuh    22174     1  0 09:11 ?        00:00:00 /var/ossec/bin/wazuh-remoted
root     22212     1  0 09:11 ?        00:00:00 /var/ossec/bin/wazuh-logcollector
wazuh    22231     1  0 09:11 ?        00:00:00 /var/ossec/bin/wazuh-monitord
root     22267     1  1 09:11 ?        00:00:00 /var/ossec/bin/wazuh-modulesd
root     22573 19087  0 09:11 pts/0    00:00:00 grep --color=auto wazuh

Versions

[root@wazuh-server wazuh-user]# /var/ossec/bin/wazuh-control info
WAZUH_VERSION="v4.5.1"
WAZUH_REVISION="40503"
WAZUH_TYPE="server"
[root@wazuh-server wazuh-user]# cat /usr/share/wazuh-indexer/VERSION
4.5.1
[root@wazuh-server wazuh-user]# cat /usr/share/wazuh-dashboard/VERSION
4.5.1
[root@wazuh-server wazuh-user]# cat /usr/share/wazuh-dashboard/package.json
{
  "name": "opensearch-dashboards",
  "description": "OpenSearch Dashboards is a browser based analytics and search dashboard for OpenSearch. OpenSearch Dashboards is a snap to setup and start using. OpenSearch Dashboards strives to be easy to get started with, while also being flexible and powerful, just like OpenSearch.",
  "keywords": [
    "opensearch-dashboards",
    "opensearch",
    "logstash",
    "analytics",
    "visualizations",
    "dashboards",
    "dashboarding"
  ],
  "version": "2.6.0",
  "branch": "2.6",
  "build": {
    "number": 45103,
    "sha": "b15a28f9d6d6ec40d695a2eb01442d2a7d6d72d9",
    "distributable": true,
    "release": true
  },
  "repository": {
    "type": "git",
    "url": "https://github.com/opensearch-project/opensearch-dashboards.git"
  },
  "engines": {
    "node": "14.20.1"
  }
}

OVA - Users

[root@wazuh-server wazuh-user]# grep -R "wazuh" /etc/group
wheel:x:10:wazuh-user
wazuh-user:x:1000:
wazuh-indexer:x:993:
wazuh:x:992:wazuh
wazuh-dashboard:x:991:wazuh-dashboard
[root@wazuh-server wazuh-user]# grep -R "wazuh" /etc/passwd
wazuh-user:x:1000:1000::/home/wazuh-user:/bin/bash
wazuh-indexer:x:995:993:wazuh-indexer user:/usr/share/wazuh-indexer:/sbin/nologin
wazuh:x:994:992::/var/ossec:/sbin/nologin
wazuh-dashboard:x:993:991::/usr/share/wazuh-dashboard/:/sbin/nologin
[root@wazuh-server wazuh-user]# 

OVA - WUI

• Loading screen OK
• Login screen OK
• Light/dark mode OK
• Credentials admin:admin OK

OVA - Logs

• Wazuh dashboard - journalctl

  Re opened issue - Wazuh dashboard show errors related to SSL in 4.4.5 wazuh-packages#2326

     [root@wazuh-server wazuh-user]# journalctl -r -u wazuh-dashboard | grep -i -E "error|critical|fatal|warning"
    ago 24 09:00:50 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T09:00:50Z","tags":["error","plugins","securityDashboards"],"pid":2443,"message":"Failed authentication: Error: Authentication Exception"}
    ago 24 08:42:15 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:42:15Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ResponseError]: Response Error"}
    ago 24 08:42:12 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:42:12Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ResponseError]: Response Error"}
    ago 24 08:42:10 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:42:10Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ResponseError]: Response Error"}
    ago 24 08:42:07 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:42:07Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ResponseError]: Response Error"}
    ago 24 08:42:05 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:42:05Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ResponseError]: Response Error"}
    ago 24 08:42:02 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:42:02Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 08:42:00 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:42:00Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 08:41:57 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:41:57Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 08:41:55 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:41:55Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 08:41:52 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:41:52Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 08:41:50 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:41:50Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 08:41:47 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:41:47Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 08:41:45 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:41:45Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 08:41:42 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:41:42Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 08:41:40 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:41:40Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 08:41:37 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:41:37Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 08:41:35 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T08:41:35Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 10:41:30 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T10:41:30Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 10:41:28 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T10:41:28Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 10:41:25 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T10:41:25Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 10:41:23 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T10:41:23Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 10:41:20 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T10:41:20Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 10:41:17 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T10:41:17Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 10:41:15 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T10:41:15Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 10:41:12 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T10:41:12Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
    ago 24 10:41:10 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T10:41:10Z","tags":["error","savedobjects-service"],"pid":2443,"message":"Unable to retrieve version information from OpenSearch nodes."}
    ago 24 10:41:10 wazuh-server opensearch-dashboards[2443]: {"type":"log","@timestamp":"2023-08-24T10:41:10Z","tags":["error","opensearch","data"],"pid":2443,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
  

• Wazuh indexer - journalctl

  Warnings reported at - Systemd-entrypoint warnings in wazuh indexer in 4.4.5 wazuh-packages#2325

    [root@wazuh-server wazuh-user]# journalctl -r -u wazuh-indexer | grep -i -E "error|critical|fatal|warning"
    ago 24 08:41:35 wazuh-server systemd-entrypoint[7351]: at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
    ago 24 08:41:35 wazuh-server systemd-entrypoint[7351]: 2023-08-24 08:41:35,115 main ERROR Could not define attribute view on path "/var/log/wazuh-indexer/wazuh-cluster.log" got access denied ("java.lang.RuntimePermission" "accessUserInformation") java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "accessUserInformation")
    ago 24 08:41:35 wazuh-server systemd-entrypoint[7351]: at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
    ago 24 08:41:35 wazuh-server systemd-entrypoint[7351]: 2023-08-24 08:41:35,097 main ERROR Could not define attribute view on path "/var/log/wazuh-indexer/wazuh-cluster_server.json" got access denied ("java.lang.RuntimePermission" "accessUserInformation") java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "accessUserInformation")
    ago 24 08:41:35 wazuh-server systemd-entrypoint[7351]: WARNING: System::setSecurityManager will be removed in a future release
    ago 24 08:41:35 wazuh-server systemd-entrypoint[7351]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
    ago 24 08:41:35 wazuh-server systemd-entrypoint[7351]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.6.0.jar)
    ago 24 08:41:35 wazuh-server systemd-entrypoint[7351]: WARNING: A terminally deprecated method in java.lang.System has been called
    ago 24 10:41:29 wazuh-server systemd-entrypoint[7351]: WARNING: System::setSecurityManager will be removed in a future release
    ago 24 10:41:29 wazuh-server systemd-entrypoint[7351]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
    ago 24 10:41:29 wazuh-server systemd-entrypoint[7351]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.6.0.jar)
    ago 24 10:41:29 wazuh-server systemd-entrypoint[7351]: WARNING: A terminally deprecated method in java.lang.System has been called
  

• Wazuh indexer - /var/logs/wazuh-indexer

      [root@wazuh-server wazuh-user]# grep -R -i -E "error|critical|fatal|warning" /var/log/wazuh-indexer/
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:41:35,118Z", "level": "INFO", "component": "o.o.n.Node", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "JVM arguments [-Xshare:auto, -Dopensearch.networkaddress.cache.ttl=60, -Dopensearch.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -XX:+ShowCodeDetailsInExceptionMessages, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.locale.providers=SPI,COMPAT, -Xms3981m, -Xmx3981m, -XX:+UseG1GC, -XX:G1ReservePercent=25, -XX:InitiatingHeapOccupancyPercent=30, -Djava.io.tmpdir=/tmp/opensearch-8176521988288616105, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=/var/lib/wazuh-indexer, -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Dclk.tck=100, -Djdk.attach.allowAttachSelf=true, -Djava.security.policy=file:///etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy, --add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED, -XX:MaxDirectMemorySize=2087714816, -Dopensearch.path.home=/usr/share/wazuh-indexer, -Dopensearch.path.conf=/etc/wazuh-indexer, -Dopensearch.distribution.type=rpm, -Dopensearch.bundled_jdk=true]" }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:41:57,141Z", "level": "ERROR", "component": "o.o.s.a.s.SinkProvider", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Default endpoint could not be created, auditlog will not work properly." }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:03,777Z", "level": "ERROR", "component": "o.o.s.c.ConfigurationLoaderSecurity7", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Exception while retrieving configuration for [INTERNALUSERS, ACTIONGROUPS, CONFIG, ROLES, ROLESMAPPING, TENANTS, NODESDN, WHITELIST, ALLOWLIST, AUDIT] (index=.opendistro_security)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ" , 
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:04,275Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:05,458Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:05,481Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:05,496Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:05,500Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:07,891Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:07,895Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:07,897Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:07,900Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:10,394Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:10,397Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:10,400Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:10,403Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:12,606Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:12,895Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:12,898Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:12,900Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:12,902Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:15,398Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:15,400Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:15,402Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster_server.json:{"type": "server", "timestamp": "2023-08-24T08:42:15,405Z", "level": "ERROR", "component": "o.o.s.a.BackendRegistry", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Not yet initialized (you may need to run securityadmin)", "cluster.uuid": "cCIn8kn-TRSPuVJZVmgKww", "node.id": "NplGQd6tTqug1EXcAFxRgQ"  }
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:41:35,118][INFO ][o.o.n.Node               ] [node-1] JVM arguments [-Xshare:auto, -Dopensearch.networkaddress.cache.ttl=60, -Dopensearch.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -XX:+ShowCodeDetailsInExceptionMessages, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.locale.providers=SPI,COMPAT, -Xms3981m, -Xmx3981m, -XX:+UseG1GC, -XX:G1ReservePercent=25, -XX:InitiatingHeapOccupancyPercent=30, -Djava.io.tmpdir=/tmp/opensearch-8176521988288616105, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=/var/lib/wazuh-indexer, -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Dclk.tck=100, -Djdk.attach.allowAttachSelf=true, -Djava.security.policy=file:///etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy, --add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED, -XX:MaxDirectMemorySize=2087714816, -Dopensearch.path.home=/usr/share/wazuh-indexer, -Dopensearch.path.conf=/etc/wazuh-indexer, -Dopensearch.distribution.type=rpm, -Dopensearch.bundled_jdk=true]
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:41:57,141][ERROR][o.o.s.a.s.SinkProvider   ] [node-1] Default endpoint could not be created, auditlog will not work properly.
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:03,777][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [node-1] Exception while retrieving configuration for [INTERNALUSERS, ACTIONGROUPS, CONFIG, ROLES, ROLESMAPPING, TENANTS, NODESDN, WHITELIST, ALLOWLIST, AUDIT] (index=.opendistro_security)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:04,275][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:05,458][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:05,481][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:05,496][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:05,500][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:07,891][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:07,895][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:07,897][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:07,900][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:10,394][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:10,397][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:10,400][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:10,403][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:12,606][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:12,895][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:12,898][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:12,900][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:12,902][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:15,398][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:15,400][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:15,402][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
    /var/log/wazuh-indexer/wazuh-cluster.log:[2023-08-24T08:42:15,405][ERROR][o.o.s.a.BackendRegistry  ] [node-1] Not yet initialized (you may need to run securityadmin)
  

• Wazuh server - /var/ossec/logs

    [root@wazuh-server wazuh-user]# grep -i -E "error|critical|fatal|warning" /var/ossec/logs/ossec.log
    2023/08/18 11:44:45 manage_agents: CRITICAL: Key import only available on an agent.
    2023/08/24 09:06:57 wazuh-authd: WARNING: Duplicate name 'wazuh-centos', rejecting enrollment. Agent '001' has not been disconnected long enough to be replaced.
    2023/08/24 09:07:47 wazuh-authd: WARNING: Duplicate name 'wazuh-centos', rejecting enrollment. Agent '001' has not been disconnected long enough to be replaced.
    2023/08/24 09:08:37 wazuh-authd: WARNING: Duplicate name 'wazuh-centos', rejecting enrollment. Agent '001' has not been disconnected long enough to be replaced.
  

• OVA - Filebeat test

    [root@wazuh-server wazuh-user]# filebeat test output
    elasticsearch: https://127.0.0.1:9200...
      parse url... OK
      connection...
        parse host... OK
        dns lookup... OK
        addresses: 127.0.0.1
        dial up... OK
      TLS...
        security: server's certificate chain verification is enabled
        handshake... OK
        TLS version: TLSv1.2
        dial up... OK
      talk to server... OK
      version: 7.10.2
  

• OVA - Wazuh indexer cluster

    [root@wazuh-server wazuh-user]# filebeat test output
    elasticsearch: https://127.0.0.1:9200...
      parse url... OK
      connection...
        parse host... OK
        dns lookup... OK
        addresses: 127.0.0.1
        dial up... OK
      TLS...
        security: server's certificate chain verification is enabled
        handshake... OK
        TLS version: TLSv1.2
        dial up... OK
      talk to server... OK
      version: 7.10.2
  
        
      [root@wazuh-server wazuh-user]# curl -k -u admin:admin https://127.0.0.1:9200
  
    {
      "name" : "node-1",
      "cluster_name" : "wazuh-cluster",
      "cluster_uuid" : "cCIn8kn-TRSPuVJZVmgKww",
      "version" : {
        "number" : "7.10.2",
        "build_type" : "rpm",
        "build_hash" : "7203a5af21a8a009aece1474446b437a3c674db6",
        "build_date" : "2023-02-24T18:57:04.388618985Z",
        "build_snapshot" : false,
        "lucene_version" : "9.5.0",
        "minimum_wire_compatibility_version" : "7.10.0",
        "minimum_index_compatibility_version" : "7.0.0"
      },
      "tagline" : "The OpenSearch Project: https://opensearch.org/"
    }
    [root@wazuh-server wazuh-user]# 
    [root@wazuh-server wazuh-user]# curl -k -u admin:admin https://127.0.0.1:9200/_cat/nodes?v
    ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
    127.0.0.1           12          80   2    0.25    0.24     0.20 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1
    [root@wazuh-server wazuh-user]# 
  
      
    [root@wazuh-server wazuh-user]# curl -k -u admin:admin https://127.0.0.1:9200/_cluster/health?pretty
    {
      "cluster_name" : "wazuh-cluster",
      "status" : "green",
      "timed_out" : false,
      "number_of_nodes" : 1,
      "number_of_data_nodes" : 1,
      "discovered_master" : true,
      "discovered_cluster_manager" : true,
      "active_primary_shards" : 14,
      "active_shards" : 14,
      "relocating_shards" : 0,
      "initializing_shards" : 0,
      "unassigned_shards" : 0,
      "delayed_unassigned_shards" : 0,
      "number_of_pending_tasks" : 0,
      "number_of_in_flight_fetch" : 0,
      "task_max_waiting_in_queue_millis" : 0,
      "active_shards_percent_as_number" : 100.0
  

[davidjiglesias]

LGTM!