Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix agent auto-restart when shared configuration changes #13606

Merged
merged 1 commit into from
Jun 22, 2022

Conversation

vikman90
Copy link
Member

@vikman90 vikman90 commented May 27, 2022

On RHEL 9 on containers, service links to systemctl but that's unavailable.

Related issue
Closes #13602

This PR aims to let the Active Response script restart.sh behave just like restart-wazuh: simply call wazuh-control restart, no matter the underlying service manager.

Tests

  • The agent is able to restart on an RHEL 9-based container after a shared configuration change.

Systemd service behavior

  • Starting the agent through systemctl:
● wazuh-agent.service - Wazuh agent
   Loaded: loaded (/etc/systemd/system/wazuh-agent.service; enabled; vendor preset: disabl>
   Active: active (running) since Wed 2022-06-15 12:11:18 CEST; 1s ago
  Process: 12262 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, s>
    Tasks: 34 (limit: 11405)
   Memory: 132.5M
   CGroup: /system.slice/wazuh-agent.service
           ├─12289 /var/ossec/bin/wazuh-execd
           ├─12298 /var/ossec/bin/wazuh-agentd
           ├─12312 /var/ossec/bin/wazuh-syscheckd
           ├─12322 /var/ossec/bin/wazuh-logcollector
           └─12337 /var/ossec/bin/wazuh-modulesd
  • Agent auto-restart due to configuration change:
● wazuh-agent.service - Wazuh agent
   Loaded: loaded (/etc/systemd/system/wazuh-agent.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2022-06-15 12:11:18 CEST; 16min ago
  Process: 12262 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=0/SUCCESS)
    Tasks: 37 (limit: 11405)
   Memory: 538.2M
   CGroup: /system.slice/wazuh-agent.service
           ├─12471 /var/ossec/bin/wazuh-execd
           ├─12480 /var/ossec/bin/wazuh-agentd
           ├─12495 /var/ossec/bin/wazuh-syscheckd
           ├─12508 /var/ossec/bin/wazuh-logcollector
           └─12523 /var/ossec/bin/wazuh-modulesd
  • Stopping the agent via systemctl:
● wazuh-agent.service - Wazuh agent
   Loaded: loaded (/etc/systemd/system/wazuh-agent.service; enabled; vendor preset: disabled)
   Active: inactive (dead) since Wed 2022-06-15 13:16:54 CEST; 4s ago
  Process: 9436 ExecStop=/usr/bin/env /var/ossec/bin/wazuh-control stop (code=exited, status=0/SUCCESS)
  Process: 8312 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=0/SUCCESS)
  • Starting the agent again:
● wazuh-agent.service - Wazuh agent
   Loaded: loaded (/etc/systemd/system/wazuh-agent.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2022-06-15 13:17:26 CEST; 6s ago
  Process: 9436 ExecStop=/usr/bin/env /var/ossec/bin/wazuh-control stop (code=exited, status=0/SUCCESS)
  Process: 9507 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=0/SUCCESS)
    Tasks: 38 (limit: 11405)
   Memory: 20.8M
   CGroup: /system.slice/wazuh-agent.service
           ├─9534 /var/ossec/bin/wazuh-execd
           ├─9543 /var/ossec/bin/wazuh-agentd
           ├─9558 /var/ossec/bin/wazuh-syscheckd
           ├─9571 /var/ossec/bin/wazuh-logcollector
           └─9619 /var/ossec/bin/wazuh-modulesd

On RHEL 9 on containers, service links to systemctl but that's unavailable.
@vikman90 vikman90 linked an issue May 27, 2022 that may be closed by this pull request
@vikman90 vikman90 self-assigned this May 27, 2022
@vikman90 vikman90 added the type/bug Something isn't working label May 27, 2022
Copy link
Contributor

@chemamartinez chemamartinez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jmv74211
Copy link
Contributor

QA review

@vikman90 vikman90 merged commit c50d97f into 4.3 Jun 22, 2022
@vikman90 vikman90 deleted the 13602-fix-ar-restart branch June 22, 2022 17:09
@vikman90 vikman90 added this to the Release 4.4.0 milestone Aug 31, 2022
@rauldpm rauldpm restored the 13602-fix-ar-restart branch November 16, 2022 20:16
@rauldpm rauldpm deleted the 13602-fix-ar-restart branch November 16, 2022 20:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type/bug Something isn't working
Projects
No open projects
Status: Done
Development

Successfully merging this pull request may close these issues.

Agent stop on restart, RHEL 9
4 participants