rauldpm
commented
2 years ago Update report - Wazuh dashboard
- A call has been made with @c-bordon to analyze the issue, after analysis, the issue has been edited to incorporate new tasks and validations.
- Investigated Wazuh server package behavior for the 4.4.0 version
- When using the service command, it was automatically redirected to systemctl.
[root@redhat9 vagrant]# service wazuh-manager stop
Redirecting to /bin/systemctl stop wazuh-manager.service- This behavior differs from the Wazuh dashboard package, in Red Hat 9, it indicates that the service has started and immediately shows output by the terminal, however, in Red Hat 7, the service is started via systemctl and no log output is observed.
[root@redhat9 vagrant]# service wazuh-dashboard start
wazuh-dashboard started
[root@redhat9 vagrant]# log [19:03:01.643] [info][plugins-service] Plugin "visTypeXy" is disabled.[root@redhat7 vagrant]# service wazuh-dashboard start
Starting wazuh-dashboard (via systemctl): [ OK ]- In Red Hat 9 there is a change regarding
init.d, for the Red Hat systemifstatement that is incorporated into the Wazuh dashboard base package, a reference is made to the/etc/rc.d/init.d/functionsscript, this script exists in Red Hat 7 and 8 but not in Red Hat 9.
[root@redhat9 vagrant]# ls -l /etc/rc.d/init.d/functions
ls: cannot access '/etc/rc.d/init.d/functions': No such file or directory[root@redhat8 vagrant]# ls -l /etc/rc.d/init.d/functions
-rw-r--r--. 1 root root 18434 Feb 15 2021 /etc/rc.d/init.d/functions[root@redhat7 vagrant]# ls -l /etc/rc.d/init.d/functions
-rw-r--r--. 1 root root 18281 May 22 2020 /etc/rc.d/init.d/functionsInstalling OpenSearch Dashboard on Red Hat 7 and Red Hat 9
Red Hat 9 install test
``` [root@redhat9 vagrant]# wget https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.3.0/opensearch-dashboards-2.3.0-linux-x64.rpm --2022-10-17 19:32:49-- https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.3.0/opensearch-dashboards-2.3.0-linux-x64.rpm Resolving artifacts.opensearch.org (artifacts.opensearch.org)... 18.67.240.6, 18.67.240.49, 18.67.240.45, ... Connecting to artifacts.opensearch.org (artifacts.opensearch.org)|18.67.240.6|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 197339708 (188M) [application/octet-stream] Saving to: ‘opensearch-dashboards-2.3.0-linux-x64.rpm’ opensearch-dashboards-2.3 100%[=====================================>] 188.20M 78.6MB/s in 2.4s 2022-10-17 19:32:51 (78.6 MB/s) - ‘opensearch-dashboards-2.3.0-linux-x64.rpm’ saved [197339708/197339708] [root@redhat9 vagrant]# yum localinstall opensearch-dashboards-2.3.0-linux-x64.rpm -y Updating Subscription Management repositories. This system is registered with an entitlement server, but is not receiving updates. You can use subscription-manager to assign subscriptions. Last metadata expiration check: 1:50:39 ago on Mon 17 Oct 2022 05:42:40 PM UTC. Dependencies resolved. ======================================================================================================== Package Architecture Version Repository Size ======================================================================================================== Installing: opensearch-dashboards x86_64 2.3.0-1 @commandline 188 M Transaction Summary ======================================================================================================== Install 1 Package Total size: 188 M Installed size: 782 M Downloading Packages: Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Running scriptlet: opensearch-dashboards-2.3.0-1.x86_64 1/1 Installing : opensearch-dashboards-2.3.0-1.x86_64 1/1 Running scriptlet: opensearch-dashboards-2.3.0-1.x86_64 1/1 /usr/lib/tmpfiles.d/opensearch-dashboards.conf:1: Line references path below legacy directory /var/run/, updating /var/run/opensearch-dashboards → /run/opensearch-dashboards; please update the tmpfiles.d/ drop-in file accordingly. ### NOT starting on installation, please execute the following statements to configure opensearch service to start automatically using systemd sudo systemctl daemon-reload sudo systemctl enable opensearch-dashboards.service ### You can start opensearch-dashboards service by executing sudo systemctl start opensearch-dashboards.service /usr/lib/tmpfiles.d/opensearch-dashboards.conf:1: Line references path below legacy directory /var/run/, updating /var/run/opensearch-dashboards → /run/opensearch-dashboards; please update the tmpfiles.d/ drop-in file accordingly. /usr/lib/tmpfiles.d/opensearch.conf:1: Line references path below legacy directory /var/run/, updating /var/run/opensearch → /run/opensearch; please update the tmpfiles.d/ drop-in file accordingly. Verifying : opensearch-dashboards-2.3.0-1.x86_64 1/1 Installed products updated. Installed: opensearch-dashboards-2.3.0-1.x86_64 Complete! [root@redhat9 vagrant]# systemctl status opensearch-dashboards ○ opensearch-dashboards.service - "OpenSearch Dashboards" Loaded: loaded (/usr/lib/systemd/system/opensearch-dashboards.service; disabled; vendor preset: di> Active: inactive (dead) [root@redhat9 vagrant]# service opensearch-dashboards status env: ‘/etc/init.d/opensearch-dashboards’: Permission denied [root@redhat9 vagrant]# service opensearch-dashboards start env: ‘/etc/init.d/opensearch-dashboards’: Permission denied [root@redhat9 vagrant]# ls -l /etc/init.d/opensearch-dashboards -rw-r--r--. 1 root root 4174 Sep 9 00:05 /etc/init.d/opensearch-dashboards [root@redhat9 vagrant]# systemctl start opensearch-dashboards.service [root@redhat9 vagrant]# systemctl status opensearch-dashboards.service ● opensearch-dashboards.service - "OpenSearch Dashboards" Loaded: loaded (/usr/lib/systemd/system/opensearch-dashboards.service; disabled; vendor preset: disabled) Active: active (running) since Mon 2022-10-17 19:38:48 UTC; 1s ago Main PID: 1894 (node) Tasks: 11 (limit: 23585) Memory: 118.6M CPU: 1.988s CGroup: /system.slice/opensearch-dashboards.service └─1894 /usr/share/opensearch-dashboards/bin/../node/bin/node /usr/share/opensearch-dashboards/bin/../src/cli/dist Oct 17 19:38:48 redhat9 systemd[1]: Started "OpenSearch Dashboards". [root@redhat9 ~]$ service opensearch-dashboards status env: ‘/etc/init.d/opensearch-dashboards’: Permission denied [root@redhat9 ~]$ service opensearch-dashboards start env: ‘/etc/init.d/opensearch-dashboards’: Permission denied [root@redhat9 vagrant]# systemctl status opensearch-dashboards.service ● opensearch-dashboards.service - "OpenSearch Dashboards" Loaded: loaded (/usr/lib/systemd/system/opensearch-dashboards.service; disabled; vendor preset: disabled) Active: active (running) since Mon 2022-10-17 19:49:48 UTC; 6s ago Main PID: 2190 (node) Tasks: 11 (limit: 23585) Memory: 150.3M CPU: 3.307s CGroup: /system.slice/opensearch-dashboards.service └─2190 /usr/share/opensearch-dashboards/bin/../node/bin/node /usr/share/opensearch-dashboards/bin/../src/cli/dist ```Red Hat 7 install test
``` [root@redhat7 vagrant]# wget https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.3.0/opensearch-dashboards-2.3.0-linux-x64.rpm --2022-10-17 19:33:01-- https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.3.0/opensearch-dashboards-2.3.0-linux-x64.rpm Resolving artifacts.opensearch.org (artifacts.opensearch.org)... 18.67.240.45, 18.67.240.49, 18.67.240.13, ... Connecting to artifacts.opensearch.org (artifacts.opensearch.org)|18.67.240.45|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 197339708 (188M) [application/octet-stream] Saving to: ‘opensearch-dashboards-2.3.0-linux-x64.rpm’ 100%[==============================================================>] 197,339,708 87.1MB/s in 2.2s 2022-10-17 19:33:03 (87.1 MB/s) - ‘opensearch-dashboards-2.3.0-linux-x64.rpm’ saved [197339708/197339708] [root@redhat7 vagrant]# yum localinstall opensearch-dashboards-2.3.0-linux-x64.rpm -y Loaded plugins: product-id, search-disabled-repos Examining opensearch-dashboards-2.3.0-linux-x64.rpm: opensearch-dashboards-2.3.0-1.x86_64 Marking opensearch-dashboards-2.3.0-linux-x64.rpm to be installed Resolving Dependencies --> Running transaction check ---> Package opensearch-dashboards.x86_64 0:2.3.0-1 will be installed --> Finished Dependency Resolution Dependencies Resolved ======================================================================================================== Package Arch Version Repository Size ======================================================================================================== Installing: opensearch-dashboards x86_64 2.3.0-1 /opensearch-dashboards-2.3.0-linux-x64 782 M Transaction Summary ======================================================================================================== Install 1 Package Total size: 782 M Installed size: 782 M Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Warning: RPMDB altered outside of yum. Installing : opensearch-dashboards-2.3.0-1.x86_64 1/1 ### NOT starting on installation, please execute the following statements to configure opensearch service to start automatically using systemd sudo systemctl daemon-reload sudo systemctl enable opensearch-dashboards.service ### You can start opensearch-dashboards service by executing sudo systemctl start opensearch-dashboards.service Verifying : opensearch-dashboards-2.3.0-1.x86_64 1/1 Installed: opensearch-dashboards.x86_64 0:2.3.0-1 Complete! [root@redhat7 vagrant]# systemctl status opensearch-dashboards ● opensearch-dashboards.service - "OpenSearch Dashboards" Loaded: loaded (/usr/lib/systemd/system/opensearch-dashboards.service; disabled; vendor preset: disabled) Active: inactive (dead) [root@redhat7 vagrant]# service opensearch-dashboards status env: /etc/init.d/opensearch-dashboards: Permission denied [root@redhat7 vagrant]# systemctl start opensearch-dashboards.service [root@redhat7 vagrant]# systemctl status opensearch-dashboards.service ● opensearch-dashboards.service - "OpenSearch Dashboards" Loaded: loaded (/usr/lib/systemd/system/opensearch-dashboards.service; disabled; vendor preset: disabled) Active: active (running) since Mon 2022-10-17 19:51:12 UTC; 5s ago Main PID: 3946 (node) CGroup: /system.slice/opensearch-dashboards.service └─3946 /usr/share/opensearch-dashboards/bin/../node/bin/node /usr/share/opensearch-dashboards/bin/../src/cli/dist Oct 17 19:51:12 redhat7 systemd[1]: Started "OpenSearch Dashboards". Oct 17 19:51:15 redhat7 opensearch-dashboards[3946]: {"type":"log","@timestamp":"2022-10-17T19:51:15Z","tags":["info","plugins-service"],"pid":3946,"message":"Plugin \"visTypeXy\" is disabled."} Oct 17 19:51:15 redhat7 opensearch-dashboards[3946]: {"type":"log","@timestamp":"2022-10-17T19:51:15Z","tags":["info","plugins-service"],"pid":3946,"message":"Plugin \"wizard\" is disabled."} Oct 17 19:51:15 redhat7 opensearch-dashboards[3946]: {"type":"log","@timestamp":"2022-10-17T19:51:15Z","tags":["warning","config","deprecation"],"pid":3946,"message":"\"opensearch.requestHeadersW...Allowlist\""} Oct 17 19:51:15 redhat7 opensearch-dashboards[3946]: {"type":"log","@timestamp":"2022-10-17T19:51:15Z","tags":["info","plugins-system"],"pid":3946,"message":"Setting up [46] plugins: [alertingDas...beddable,expr Oct 17 19:51:15 redhat7 opensearch-dashboards[3946]: {"type":"log","@timestamp":"2022-10-17T19:51:15Z","tags":["info","savedobjects-service"],"pid":3946,"message":"Waiting until all OpenSearch no...grations..."} Oct 17 19:51:15 redhat7 opensearch-dashboards[3946]: {"type":"log","@timestamp":"2022-10-17T19:51:15Z","tags":["error","opensearch","data"],"pid":3946,"message":"[ConnectionError]: connect ECONNR....0.0.1:9200"} Oct 17 19:51:15 redhat7 opensearch-dashboards[3946]: {"type":"log","@timestamp":"2022-10-17T19:51:15Z","tags":["error","savedobjects-service"],"pid":3946,"message":"Unable to retrieve version inf...arch nodes."} Oct 17 19:51:18 redhat7 opensearch-dashboards[3946]: {"type":"log","@timestamp":"2022-10-17T19:51:18Z","tags":["error","opensearch","data"],"pid":3946,"message":"[ConnectionError]: connect ECONNR....0.0.1:9200"} Hint: Some lines were ellipsized, use -l to show in full. [root@redhat7 vagrant]# service opensearch-dashboards status env: /etc/init.d/opensearch-dashboards: Permission denied [root@redhat7 vagrant]# service opensearch-dashboards stop env: /etc/init.d/opensearch-dashboards: Permission denied [root@redhat7 vagrant]# ls -l /etc/init.d/opensearch-dashboards -rw-r--r--. 1 root root 4174 Sep 9 00:05 /etc/init.d/opensearch-dashboards ```- After granting execute permissions to
/etc/init.d/opensearch-dashboardsfile, it is possible to start theopensearch-dashboardsservice without the logs being displayed by the terminal.
[root@redhat9 vagrant]# chmod +x /etc/init.d/opensearch-dashboards
[root@redhat9 vagrant]# /etc/init.d/opensearch-dashboards status
opensearch-dashboards is not running
[root@redhat9 vagrant]# service opensearch-dashboards status
opensearch-dashboards is not running
[root@redhat9 vagrant]# service opensearch-dashboards start
opensearch-dashboards started
[root@redhat9 vagrant]#- In Red Hat 7 the same result is obtained, only that the
servicecommand indicates that it has been done viasystemctl
[root@redhat7 vagrant]# chmod +x /etc/init.d/opensearch-dashboards
[root@redhat7 vagrant]# service opensearch-dashboards status
opensearch-dashboards is not running
[root@redhat7 vagrant]# service opensearch-dashboards start
Starting opensearch-dashboards (via systemctl): [ OK ]
[root@redhat7 vagrant]# - This is because, in Red Hat 7, the functions script says so.
[root@redhat7 vagrant]# grep "via" /etc/rc.d/init.d/functions
s=$"Starting $prog (via systemctl): "
s=$"Stopping $prog (via systemctl): "
s=$"Reloading $prog configuration (via systemctl): "
s=$"Restarting $prog (via systemctl):-
The reported error also occurs on CentOS 9 Stream.
-
The error could be reproduced by commenting the line https://github.com/wazuh/wazuh-packages/blob/da21a806dc8667626cfc52a8b76a8e570dd84eea/stack/dashboard/base/files/etc/services/wazuh-dashboard#L10
Description
Unexpected behavior was detected in the RPM package when manipulating the service with
init.dBy default,
Wazuh dashboardlogs are thrown tostr.out, what happens when you start the service with init.d is that the logs are constantly thrown to the console:An issue in
Red Hat 9withinit.dandWazuh indexer:Tasks
Wazuh dashboard
Wazuh indexer
Validation
Wazuh dashboard
Wazuh indexer