Wazuh manager fails in case some directories do not exist or are not accessible

[zbalkan]

Wazuh version	Component	Install type	Install method	Platform
4.3.10	Wazuh manager	Manager	N/A	Linux / RHEL8

Summary

When default log directories (/var/ossec/logs/alerts or /var/ossec/logs/archives, and subdirectories) are removed or directory permissions are changed, Wazuh manager fails.

Expected behavior

• When those directories are removed, instead of creating a CRITICAL severity logs, the wazuh-manager can create the folders if they do not exist, then create a log with ERROR severity, so that it can continue running reliably.
• If the permissions are incorrect, wazuh-manager can fix the ownership and file permissions, then create a log with ERROR severity, so that it can continue running reliably.

Note

Wazuh components can run preflight checks for integrity on start such as:

• Existence of important directories and files
• Permissions of important directories and files

This was discussed in #15741 before.

[zbalkan]

As a side note, locking the directories would highly improve the integrity:

# for /var/ossec/logs/archives
touch /var/ossec/logs/archives/.lock
chattr +i /var/ossec/logs/archives/.lock

# for /var/ossec/logs/alerts
touch /var/ossec/logs/alerts/.lock
chattr +i /var/ossec/logs/alerts/.lock

[zbalkan]

In case of CRITICAL errors, it is probably better to crash instead of running in an unreliable state. This is an issue with other problems such as running under a system with no free space (#15493).