Release 4.8.0 - RC 1 - Footprint Metrics - ROOTCHECK (2.5d)

[wazuhci]

Footprint metrics information

Main release stage issue #	#23246
Main footprint metrics issue #	#23254
Version	4.8.0
Release stage #	RC 1
Tag	https://github.com/wazuh/wazuh/tree/v4.8.0-rc1

Stress test documentation

Packages used

• Repository: packages-dev.wazuh.com

• Package path: pre-release

• Package revision: 1

• Jenkins build: https://ci.wazuh.info/job/Test_stress/5104/

---

Manager

• Plots

  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  

• Logs and configuration

  ossec_Test_stress_B5104_manager_2024-05-06.zip

• CSV

  monitor-manager-Test_stress_B5104_manager-pre-release.csv
  Test_stress_B5104_manager_analysisd_events.csv
  Test_stress_B5104_manager_analysisd_state.csv
  Test_stress_B5104_manager_remoted_state.csv

Centos agent

• Plots

  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  

• Logs and configuration

  ossec_Test_stress_B5104_centos_2024-05-06.zip

• CSV

  monitor-agent-Test_stress_B5104_centos-pre-release.csv
  Test_stress_B5104_centos_agentd_state.csv

Ubuntu agent

• Plots

  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  

• Logs and configuration

  ossec_Test_stress_B5104_ubuntu_2024-05-06.zip

• CSV

  monitor-agent-Test_stress_B5104_ubuntu-pre-release.csv
  Test_stress_B5104_ubuntu_agentd_state.csv

Windows agent

• Plots

  
  
  
  
  
  
  
  
  
  
  
  
  
  
  

• Logs and configuration

  ossec_Test_stress_B5104_windows_2024-05-06.zip

• CSV

  monitor-winagent-Test_stress_B5104_windows-pre-release.csv
  Test_stress_B5104_windows_agentd_state.csv

macOS agent

• Plots
• Logs and configuration
• CSV

Solaris agent

• Plots
• Logs and configuration
• CSV

---

Conclusions 🔴

Plots compared to #23175

New Issues

• Increase of memory usage by wazuh-modulesd #23304
• Increase in Disk_Read Values for Manager #23315

Known Issues

• https://github.com/wazuh/wazuh-jenkins/issues/4867
• Vulnerability Detector module is enabled at the start of the stress test #22565
• Increase in differents metrics by Wazuh-modulesd #22841

[rafabailon]

Analysis Report

Graph Report 🔴

Manager

• Disk: Decrease in wazuh-db and increase in wazuh-syscheckd
• Disk_Read: Increase in wazuh-syscheckd
  • Reported in Increase in Disk_Read Values for Manager #23315
• FD: Increase in wazuh-analysisd, wazuh-db, wazuh-modulesd and wazuh-remoted
• PSS, RSS_MAXMIN, RSS, USS: Increase in wazuh-modulesd
• VMS: Increase in wazuh-db and wazuh-remoted

Reported in #22841 and #23304

CentOS

• Disk: Decrease in wazuh-syscheckd and wazuh-agentd
• PSS: Increase in wazuh-agentd and wazuh-modulesd
• RSS_MAXMIN, RSS: Increase in wazuh-syscheckd, wazuh-modulesd and wazuh-agentd
• USS: Increase in wazuh-modulesd and wazuh-agentd
• VMS: Decrease in wazuh-modulesd

Reported in #22841 and #23304

Ubuntu

• Disk: Different Pattern with Similar Values
• PSS, RSS_MAXMIN, RSS: Increase in wazuh-syscheckd, wazuh-modulesd and wazuh-agentd
• USS: Increase in wazuh-modulesd and wazuh-agentd
• VMS: Increase in wazuh-modulesd

Reported in #22841 and #23304

Windows

• Disk: Different Pattern with Similar Values

Log Report 🟡

Ubuntu

• Reported in https://github.com/wazuh/wazuh-jenkins/issues/4867

2024/05/03 15:19:38 wazuh-agentd ERROR: (1216): Unable to connect to '[172.31.11.161]:1514/tcp': 'Connection refused'.

Centos

• Expected in Stress Test

2024/05/03 15:19:44 wazuh-syscheckd WARNING: Process locked due to agent is offline. Waiting for connection...

• Reported in https://github.com/wazuh/wazuh-jenkins/issues/4867

2024/05/03 15:19:30 wazuh-agentd ERROR: (1137): Lost connection with manager. Setting lock.
2024/05/03 15:19:30 wazuh-agentd ERROR: (1216): Unable to connect to '[172.31.11.161]:1514/tcp': 'Connection refused'.

Manager

• Expected in Stress Test

2024/05/03 15:18:55 wazuh-logcollector WARNING: Target 'agent' message queue is full (1024). Log lines may be lost.

• Reported in Vulnerability Detector module is enabled at the start of the stress test #22565

2024/05/03 15:16:48 indexer-connector WARNING: No username and password found in the keystore, using default values.
2024/05/03 15:16:48 indexer-connector WARNING: IndexerConnector initialization failed for index 'wazuh-states-vulnerabilities', retrying until the connection is successful.
2024/05/03 15:18:00 indexer-connector WARNING: Failed to sync agent '000' with the indexer.

Windows

• Reported in https://github.com/wazuh/wazuh-jenkins/issues/4867

2024/05/03 15:19:37 wazuh-agent ERROR: (1216): Unable to connect to '[172.31.11.161]:1514/tcp': 'No connection could be made because the target machine actively refused it.'.

[Rebits]

Graphs

• Increase of Disk read from 0 to 5e8. This was reported in Disk read increased for syscollector test in 4.8.0-beta4 #22600, although in this case, EDPS are similar. Further research is required. I suggest reopening the issue and comparing used configurations.
• Increase the memory used by modules. Please include Increase of memory usage by wazuh-modulesd #23304

[rafabailon]

Update

I have added the wazuh-modulesd issue and have reopened the Disk_Read issue, providing all the information.

Update 2

The issue has been closed again because it affects a different module. I have created a new issue with all the information regarding the changes in Disk_Read #23315

[Rebits]

LGTM

[juliamagan]

LGTM