Wazuh API health check

[barcle]

Hello,

I'm having an issue with the Wazuh Manager API. When I log into Wazuh and navigate to the /app/wz-home page, a health check is performed. The problem is that this health check times out every time. I have to refresh the page and go back to /app/wz-home, and after a few seconds, the page finally loads.

However, after this initial issue, everything works fine—meaning that once (I assume) the Wazuh Dashboard successfully connects to the Wazuh Manager, I no longer experience any problems. But when I log out of Wazuh and log back in, the issue occurs again.

Essentially, the problem only happens on the first connection to the Wazuh Manager API via the Wazuh Dashboard. (For reference, the default timeout on the Wazuh Dashboard is set to 20,000 ms.)

Do you have any idea what might be causing this issue?

Thanks in advance,
Clement

[Stuti3097]

Hi @barcle

This usually occurs when you have high CPU usage on the Wazuh manager nodes.
It is also possible that you are running out of disk space.
Check CPU usage: top -bn1 | grep "Cpu(s)" | sed "s/., ([0-9.])% id.*/\1/" | awk '{print 100 - $1}'
Check disk usage: df -h
Check memory usage: free -m

Please share the following log files from the Wazuh manager node(s):
/var/ossec/logs/api.log,
/var/ossec/logs/ossec.log.

Also, consider increasing the CPU resources of the node or adding more worker nodes to your cluster.

Adding Wazuh server node: https://documentation.wazuh.com/current/user-manual/wazuh-server-cluster/adding-new-server-nodes/index.html

Can you please share the following details and information to know the cause of the issue:
Could you let us know when you encountered this error? Did you follow any specific steps or documentation before this issue occurred?
Please check the cluster health by running the following command: curl -XGET -k -u user:pass "https://localhost:9200/_cluster/health"

It would also be helpful to know which version of Wazuh you are using and whether your setup is an all-in-one deployment (Wazuh manager, indexer, and dashboard on the same server) or a distributed deployment.

Please let me know the update on this to assist further.