search

wazuh / wazuh-docker

Wazuh - Docker containers
https://wazuh.com
Other
613 stars 339 forks source link

Error after upgrading #1393

Open alec-jensen opened 3 weeks ago

alec-jensen commented 3 weeks ago

I upgraded to 4.8.0 and I now get this error from the indexer, causing Wazuh to be unusable.

[2024-06-14T16:34:18,942][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [wazuh.indexer] uncaught exception in thread [main]
org.opensearch.bootstrap.StartupException: java.lang.IllegalStateException: failed to load plugin class [org.opensearch.security.OpenSearchSecurityPlugin]
        at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:184) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.OpenSearch.execute(OpenSearch.java:171) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:104) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138) ~[opensearch-cli-2.10.0.jar:2.10.0]
        at org.opensearch.cli.Command.main(Command.java:101) ~[opensearch-cli-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:137) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:103) ~[opensearch-2.10.0.jar:2.10.0]
Caused by: java.lang.IllegalStateException: failed to load plugin class [org.opensearch.security.OpenSearchSecurityPlugin]
        at org.opensearch.plugins.PluginsService.loadPlugin(PluginsService.java:791) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.plugins.PluginsService.loadBundle(PluginsService.java:731) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.plugins.PluginsService.loadBundles(PluginsService.java:533) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.plugins.PluginsService.<init>(PluginsService.java:195) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.node.Node.<init>(Node.java:474) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.node.Node.<init>(Node.java:401) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:242) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:242) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:404) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:180) ~[opensearch-2.10.0.jar:2.10.0]
        ... 6 more
Caused by: java.lang.reflect.InvocationTargetException
        at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]
        at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:77) ~[?:?]
        at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?]
        at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:499) ~[?:?]
        at java.lang.reflect.Constructor.newInstance(Constructor.java:480) ~[?:?]
        at org.opensearch.plugins.PluginsService.loadPlugin(PluginsService.java:782) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.plugins.PluginsService.loadBundle(PluginsService.java:731) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.plugins.PluginsService.loadBundles(PluginsService.java:533) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.plugins.PluginsService.<init>(PluginsService.java:195) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.node.Node.<init>(Node.java:474) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.node.Node.<init>(Node.java:401) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:242) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:242) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:404) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:180) ~[opensearch-2.10.0.jar:2.10.0]
        ... 6 more
Caused by: java.lang.OutOfMemoryError: Cannot reserve 291650519 bytes of direct buffer memory (allocated: 1, limit: 268435456)
        at java.nio.Bits.reserveMemory(Bits.java:178) ~[?:?]
        at java.nio.DirectByteBuffer.<init>(DirectByteBuffer.java:121) ~[?:?]
        at java.nio.ByteBuffer.allocateDirect(ByteBuffer.java:332) ~[?:?]
        at sun.nio.ch.Util.getTemporaryDirectBuffer(Util.java:243) ~[?:?]
        at sun.nio.ch.IOUtil.read(IOUtil.java:293) ~[?:?]
        at sun.nio.ch.IOUtil.read(IOUtil.java:273) ~[?:?]
        at sun.nio.ch.FileChannelImpl.read(FileChannelImpl.java:232) ~[?:?]
        at sun.nio.ch.ChannelInputStream.read(ChannelInputStream.java:65) ~[?:?]
        at sun.nio.ch.ChannelInputStream.read(ChannelInputStream.java:107) ~[?:?]
        at sun.nio.ch.ChannelInputStream.read(ChannelInputStream.java:101) ~[?:?]
        at java.nio.file.Files.read(Files.java:3244) ~[?:?]
        at java.nio.file.Files.readAllBytes(Files.java:3295) ~[?:?]
        at org.opensearch.security.OpenSearchSecurityPlugin.sha256(OpenSearchSecurityPlugin.java:416) ~[?:?]
        at org.opensearch.security.OpenSearchSecurityPlugin$4.lambda$run$0(OpenSearchSecurityPlugin.java:377) ~[?:?]
        at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197) ~[?:?]
        at java.util.stream.DistinctOps$1$2.accept(DistinctOps.java:174) ~[?:?]
        at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197) ~[?:?]
        at java.util.Iterator.forEachRemaining(Iterator.java:133) ~[?:?]
        at java.util.Spliterators$IteratorSpliterator.forEachRemaining(Spliterators.java:1845) ~[?:?]
        at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509) ~[?:?]
        at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499) ~[?:?]
        at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921) ~[?:?]
        at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:?]
        at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682) ~[?:?]
        at org.opensearch.security.OpenSearchSecurityPlugin$4.run(OpenSearchSecurityPlugin.java:377) ~[?:?]
        at org.opensearch.security.OpenSearchSecurityPlugin$4.run(OpenSearchSecurityPlugin.java:371) ~[?:?]
        at java.security.AccessController.doPrivileged(AccessController.java:318) ~[?:?]
        at org.opensearch.security.OpenSearchSecurityPlugin.<init>(OpenSearchSecurityPlugin.java:371) ~[?:?]
        at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]
        at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:77) ~[?:?]
        at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?]
        at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:499) ~[?:?]
        at java.lang.reflect.Constructor.newInstance(Constructor.java:480) ~[?:?]
        at org.opensearch.plugins.PluginsService.loadPlugin(PluginsService.java:782) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.plugins.PluginsService.loadBundle(PluginsService.java:731) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.plugins.PluginsService.loadBundles(PluginsService.java:533) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.plugins.PluginsService.<init>(PluginsService.java:195) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.node.Node.<init>(Node.java:474) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.node.Node.<init>(Node.java:401) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:242) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:242) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:404) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:180) ~[opensearch-2.10.0.jar:2.10.0]
        ... 6 more
dgriswo commented 3 weeks ago

Check the memory parameters for the wazuh.indexer container, they have been increased from 512m to 1024m

https://github.com/wazuh/wazuh-docker/commit/b55cfaa9a078e793b1febab4c517c49e196be1ea#diff-ff92654ea5306bf927ae7b486b4cbdf6d534925279d041ce8f9704f67be869c8L55

alec-jensen commented 2 weeks ago

Weird, I had 1G set in my compose file, but I switched it to 1024m and that issue doesn't happen anymore. But now, I get this when trying to access the dashboard. I can't find any errors anywhere. image

dgriswo commented 2 weeks ago

The url has changed as well. It is now located at /app/wz-home.

https://documentation.wazuh.com/current/upgrade-guide/troubleshooting.html#application-not-found

alec-jensen commented 2 weeks ago

Ok. So it started working normally, so I thought it was fixed, but it seems to actually be happening randomly. And yes the url is set to the correct thing.

7djs7 commented 2 weeks ago

I had to change this value in my docker compose under wazuh.indexer `environment:

7djs7 commented 2 weeks ago

edit wazuh-docker/single-node/config/wazuh_dashboard/opensearch_dashboards.yml and change uiSettings.overrides.defaultRoute: /app/wazuh to uiSettings.overrides.defaultRoute: /app/wz-home

Restart your docker container