DASHBOARD FAILING IMMEDIATELY

[AmmisettyBhuvanesh]

Wazuh	Rev	Browser
X.Y.Z	xyzw	Chrome, Firefox, Safari, etc

Description× wazuh-dashboard.service - wazuh-dashboard Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; preset: enabled) Active: failed (Result: exit-code) since Fri 2024-10-25 11:09:39 UTC; 10min ago Duration: 35.543s Process: 17897 ExecStart=/usr/share/wazuh-dashboard/bin/opensearch-dashboards (code=exited, status=1/FAILURE) Main PID: 17897 (code=exited, status=1/FAILURE) CPU: 7.725s

{"type":"log","@timestamp":"2024-10-25T11:09:08Z","tags":["info","savedobjects-service"],"pid":17897,"message":"Wai> {"type":"log","@timestamp":"2024-10-25T11:09:08Z","tags":["info","savedobjects-service"],"pid":17897,"message":"Sta> {"type":"log","@timestamp":"2024-10-25T11:09:08Z","tags":["warning","cross-compatibility-service"],"pid":17897,"mes> {"type":"log","@timestamp":"2024-10-25T11:09:08Z","tags":["info","plugins-system"],"pid":17897,"message":"Starting > {"type":"log","@timestamp":"2024-10-25T11:09:38Z","tags":["fatal","root"],"pid":17897,"message":"Error: Start lifec> {"type":"log","@timestamp":"2024-10-25T11:09:38Z","tags":["info","plugins-system"],"pid":17897,"message":"Stopping > FATAL Error: Start lifecycle of "wazuhCore" plugin wasn't completed in 30sec. Consider disabling the plugin and r> : wazuh-dashboard.service: Main process exited, code=exited, status=1/FAILURE

I am using latest version wazuh components and my wazuh dashboard is failing immediately after the installtion

how to resolve the issue

[Desvelao]

Hi @AmmisettyBhuvanesh , the provided (and truncated) logs it seems to indicate that wazuhCore plugin gets a timeout in the start plugin lifecycle. Unfortunately, the logs do not display the cause of the timeout or what the wazuhCore plugin was doing before the timeout.

Could you share the following information?

0. Context: 0.1 Wazuh dashboard version 0.2 Did the error happen in a new installation or this was working before? Did you upgrade the wazuh-dashboard package? If this happened in a non-new installation, did you do something in some application of the Wazuh stack previously to the error happened?

1. Review the logs of the wazuh-dashboard service for more information before the service failed:

   journalctl -u wazuh-dashboard

You could use some utility such as grep to filter the logs that contain some string If you go to share the logs, ensure they are not truncated to see all the log message and you provide logs before the Wazuh dashboard failed.

If reviewing the logs you can not find any relevant information, you could consider to enable the verbosity of Wazuh dashboard adding to the configuration file (/etc/wazuh-dashboard/opensearch_dashboards.yml ):

logging.verbose: true

and restart the wazuh-service:

systemcl restart wazuh-dashboard

After debugging, consider to disable it

Then, replicate the problem and review the logs again seraching any releavat information about the error or what the wazuhCore plugin was doing before the wazuh-dashboard failed.