Open Rebits opened 4 months ago
I was able to replicate the error, apparently the problem is in the handling of the validation of whether wazuh-manager or wazuh-indexer are uninstalled.
21/05/2024 18:54:48 INFO: --- Removing existing Wazuh installation ---
21/05/2024 18:54:48 INFO: Removing Wazuh manager.
Reading package lists...
E: Write error - write (28: No space left on device)
E: IO Error saving source cache
E: The package lists or status file could not be parsed or opened.
21/05/2024 18:54:49 INFO: Wazuh manager removed.
In turn, the uninstallation process was incomplete, causing problems when trying to manually uninstall the product:
ubuntu@ip-172-31-86-216:~$ sudo apt purge -y wazuh-manager
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages will be REMOVED:
wazuh-manager*
0 upgraded, 0 newly installed, 1 to remove and 195 not upgraded.
After this operation, 916 MB disk space will be freed.
(Reading database ... 86331 files and directories currently installed.)
Removing wazuh-manager (4.8.0-1) ...
dpkg: error processing package wazuh-manager (--remove):
installed wazuh-manager package pre-removal script subprocess returned error exit status 127
dpkg: too many errors, stopping
Errors were encountered while processing:
wazuh-manager
Processing was halted because there were too many errors.
E: Sub-process /usr/bin/dpkg returned an error code (1)
ubuntu@ip-172-31-86-216:~$ apt list --installed | grep wazuh-manager
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
wazuh-manager/now 4.8.0-1 amd64 [installed,local]
If the uninstall is truncated, you cannot retry the uninstall, perhaps the best solution is to validate available storage before installing
We should understand the needed space to install the different Wazuh components. The assistant must enforce the needed space is available prior to installation.
For this issue, we need to investigate:
The installation assistant must be able to identify the storage required at each installation point since the user may have different disks mounted in the different directories. We must be able to perform the prior analysis, according to the type of installation (AIO or distributed) and by component.
This issue goes on hold due to higher priority tasks
The main directories used in the installation of Wazuh components have been investigated.
The affected directories are common to all. These are:
/usr/share/
/etc/
/var/cache/apt/archives/
/var/lib/
In addition, the Wazuh manager makes use of /var/ossec/
.
Once we have figured out which directories each component uses, we have to estimate a used size of each one. To do this, we will download an AIO with both package managers (APT and RPM) and get the total size taken by each component in those directories.
Get the total size taken by each component in each directory. After obtaining the necessary information, we will start developing the code logic.
Description
It has been detected that in case of failing the installation of the wazuh-dashboard due to lack of space in the system, the wazuh component previously installed are not removed correctly
Steps to reproduce
curl -sO https://packages-dev.wazuh.com/4.8/wazuh-install.sh && sudo bash ./wazuh-install.sh -a
Evidence
Installation log
- First installation ``` root@ip-172-31-44-9:/home/ubuntu# curl -sO https://packages-dev.wazuh.com/4.8/wazuh-install.sh && sudo bash ./wazuh-install.sh -a 12/04/2024 08:46:28 INFO: Starting Wazuh installation assistant. Wazuh version: 4.8.0 12/04/2024 08:46:28 INFO: Verbose logging redirected to /var/log/wazuh-install.log 12/04/2024 08:46:38 INFO: Verifying that your system meets the recommended minimum hardware requirements. 12/04/2024 08:46:38 INFO: Wazuh web interface port will be 443. 12/04/2024 08:46:44 INFO: --- Dependencies ---- 12/04/2024 08:46:44 INFO: Installing apt-transport-https. 12/04/2024 08:46:54 INFO: Wazuh development repository added. 12/04/2024 08:46:54 INFO: --- Configuration files --- 12/04/2024 08:46:54 INFO: Generating configuration files. 12/04/2024 08:46:54 INFO: Generating the root certificate. 12/04/2024 08:46:54 INFO: Generating Admin certificates. 12/04/2024 08:46:55 INFO: Generating Wazuh indexer certificates. 12/04/2024 08:46:56 INFO: Generating Filebeat certificates. 12/04/2024 08:46:56 INFO: Generating Wazuh dashboard certificates. 12/04/2024 08:46:57 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation. 12/04/2024 08:46:57 INFO: --- Wazuh indexer --- 12/04/2024 08:46:57 INFO: Starting Wazuh indexer installation. 12/04/2024 08:48:36 INFO: Wazuh indexer installation finished. 12/04/2024 08:48:36 INFO: Wazuh indexer post-install configuration finished. 12/04/2024 08:48:36 INFO: Starting service wazuh-indexer. 12/04/2024 08:49:01 INFO: wazuh-indexer service started. 12/04/2024 08:49:01 INFO: Initializing Wazuh indexer cluster security settings. 12/04/2024 08:49:12 INFO: Wazuh indexer cluster security configuration initialized. 12/04/2024 08:49:12 INFO: Wazuh indexer cluster initialized. 12/04/2024 08:49:12 INFO: --- Wazuh server --- 12/04/2024 08:49:12 INFO: Starting the Wazuh manager installation. 12/04/2024 08:50:46 INFO: Wazuh manager installation finished. 12/04/2024 08:50:46 INFO: Wazuh manager vulnerability detection configuration finished. 12/04/2024 08:50:46 INFO: Starting service wazuh-manager. 12/04/2024 08:51:07 INFO: wazuh-manager service started. 12/04/2024 08:51:07 INFO: Starting Filebeat installation. 12/04/2024 08:51:22 INFO: Filebeat installation finished. 12/04/2024 08:51:24 INFO: Filebeat post-install configuration finished. 12/04/2024 08:51:24 INFO: Starting service filebeat. 12/04/2024 08:51:26 INFO: filebeat service started. 12/04/2024 08:51:26 INFO: --- Wazuh dashboard --- 12/04/2024 08:51:26 INFO: Starting Wazuh dashboard installation. 12/04/2024 08:51:36 ERROR: Wazuh dashboard installation failed. 12/04/2024 08:51:36 INFO: --- Removing existing Wazuh installation --- 12/04/2024 08:51:39 INFO: Installation cleaned. Check the /var/log/wazuh-install.log file to learn more about the issue. ```/var/log/wazuh-install.log