wazuh / wazuh-agent

Wazuh agent, the Wazuh agent for endpoints.
GNU Affero General Public License v3.0
22 stars 12 forks source link

Wazuh agent failed to start after upgrade (4.8 to 4.9) #197

Open VenkataPatrana opened 1 week ago

VenkataPatrana commented 1 week ago
Wazuh version Component Install type Install method Platform
4.9 Agent Upgrade Packages (All in one Deployment) Amazon Linux

After upgrading the Agent from 4.7 to 4.9, wazuh agent failed to start with reading XML error but started successfully after enabling the debug configuration on /var/ossec/etc/internal_options.conf agent.debug=1

Logs before enabling agent debug option

2024/10/03 20:31:25 wazuh-syscheckd: INFO: (1756): Shutdown received. Releasing resources.
2024/10/03 20:31:25 wazuh-syscheckd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2024/10/03 20:31:25 wazuh-agentd[701738] sig_op.c:49 at HandleSIG(): INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2024/10/03 20:31:25 wazuh-execd: INFO: (1314): Shutdown received. Deleting responses.
2024/10/03 20:31:25 wazuh-execd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2024/10/03 20:31:25 wazuh-logcollector: ERROR: Remote commands are not accepted from the manager. Ignoring it on the agent.conf
2024/10/03 20:31:26 wazuh-execd: INFO: Started (pid: 709183).
2024/10/03 20:31:26 wazuh-agentd: ERROR: (1226): Error reading XML file 'etc/ossec.conf':  (line 0).
2024/10/04 03:41:37 wazuh-logcollector: ERROR: Remote commands are not accepted from the manager. Ignoring it on the agent.conf
2024/10/04 03:41:37 wazuh-agentd: ERROR: (1226): Error reading XML file 'etc/ossec.conf':  (line 0).
VenkataPatrana commented 4 days ago

@francobep can you please help me with this agent upgrade issue?

gdiazlo commented 30 minutes ago

Can you share with us the XML file? The error you're seeing means the file does not follow the XML format of the config file.