Closed santipadilla closed 4 months ago
AlexRuiz7
commented
4 months ago I think this is expected. I haven't tested it, but if the package detects a previous installation (if /etc/wazuh-indexer folder exists), it doesn't overwrite the configuration files.
We will need to test this behavior in OpenSearch to be sure.
santipadilla
commented
4 months ago Before uninstalling and installing another version without purge, it warned us that there were files or directories from another previously installed version (case 2 and 3 tested here).
Now when installing v4.8.1 it does not alert, and recreates the directories with missing files (case 1 tested here).
rauldpm
commented
4 months ago Note that the only case where the installation failed is when the previous package was removed from the system without a purge
Removing installed files from a package broke the package and the system DDBB, as it can be seen, after removal, the system still has those /etc/wazuh-indexer files indexed in the DDBB
root@ubuntu22:/home/vagrant# dpkg -L wazuh-indexer
/usr
/usr/lib
/usr/lib/systemd
/usr/lib/systemd/system
/var
/var/lib
/var/lib/wazuh-indexer
/etc
/etc/init.d
/etc/init.d/wazuh-indexer
/etc/wazuh-indexer/opensearch-observability/observability.yml
/etc/wazuh-indexer/opensearch-security/roles_mapping.yml
/etc/wazuh-indexer/opensearch-security/nodes_dn.yml
/etc/wazuh-indexer/opensearch-security/internal_users.yml
/etc/wazuh-indexer/opensearch-security/roles.yml
/etc/wazuh-indexer/opensearch-security/allowlist.yml
/etc/wazuh-indexer/opensearch-security/audit.yml
/etc/wazuh-indexer/opensearch-security/whitelist.yml
/etc/wazuh-indexer/opensearch-security/tenants.yml
/etc/wazuh-indexer/opensearch-security/config.yml
/etc/wazuh-indexer/opensearch-security/action_groups.yml
/etc/wazuh-indexer/opensearch-security/opensearch.yml.example
/etc/wazuh-indexer/log4j2.properties
/etc/wazuh-indexer/opensearch-notifications-core/notifications-core.yml
/etc/wazuh-indexer/opensearch-reports-scheduler/reports-scheduler.yml
/etc/wazuh-indexer/opensearch-performance-analyzer/rca_idle_cluster_manager.conf
/etc/wazuh-indexer/opensearch-performance-analyzer/supervisord.conf
/etc/wazuh-indexer/opensearch-performance-analyzer/performance-analyzer.properties
/etc/wazuh-indexer/opensearch-performance-analyzer/log4j2.xml
/etc/wazuh-indexer/opensearch-performance-analyzer/plugin-stats-metadata
/etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy
/etc/wazuh-indexer/opensearch-performance-analyzer/rca.conf
/etc/wazuh-indexer/opensearch-performance-analyzer/rca_cluster_manager.conf
/etc/wazuh-indexer/opensearch-performance-analyzer/agent-stats-metadata
/etc/wazuh-indexer/jvm.options
/etc/wazuh-indexer/opensearch-notifications/notifications.yml
/etc/wazuh-indexer/opensearch.yml
/etc/default
/etc/default/wazuh-indexerThe apt remove command without the purge option does not clean the DDBB, and the system assumes that those files are still present in the system (they are not as they have been removed manually)
Note that this does not only happen with the opensearch.yml file but also with other files like log4j2.properties and jvm.options, the only existing file is opensearch.keystore because we create it if not exist due to the username and password https://github.com/wazuh/wazuh-packages/blob/ddaaabf81b1c0509656ffa1df29517184ea8bcb2/stack/indexer/deb/debian/postinst#L119-L125
In the 4.7.5 -> 4.8.0 upgrade, the error is the same, the only difference is that the package manager detects that some files are different (checksum check), and as the default value is N, the Jenkins build reported in the referenced issue keeps the current system file (the files do not exist as it was removed manually but the DDBB still thinks that it exists), then, the package is upgraded but the file is maintained, and as the file does not exist, is missing after the upgrade
Configuration file '/etc/wazuh-indexer/opensearch-security/roles_mapping.yml'
==> Deleted (by you or by a script) since installation.
==> Package distributor has shipped an updated version.
What would you like to do about it ? Your options are:
Y or I : install the package maintainer's version
N or O : keep your currently-installed version
D : show the differences between the versions
Z : start a shell to examine the situation
The default action is to keep your current version.
*** roles_mapping.yml (Y/I/N/O/D/Z) [default=N] ?This is an expected error related to the system package management, we can't control it from the package itself (we can't do anything if someone removes files deliberately from the system), and this is the purpose of the purge option
juliamagan
commented
4 months ago LGTM
Description
An error occurred in the indexer by uninstalling version 4.8.0, cleaning indexer directories and reinstalling it with version v4.8.1, investigated in this issue we see the steps to reproduce it in Ubuntu 22.04, replicated in the following case:
opensearch.yml file in 4.8.0
```console root@wazuh-indexer-1:/home/vagrant# ls /etc/wazuh-indexer/ certs opensearch.keystore opensearch-performance-analyzer jvm.options opensearch-notifications opensearch-reports-scheduler jvm.options.d opensearch-notifications-core opensearch-security log4j2.properties opensearch-observability opensearch.yml ```remove opensearch.yml
```console root@wazuh-indexer-1:/home/vagrant# rm /etc/wazuh-indexer/opensearch.yml root@wazuh-indexer-1:/home/vagrant# ls /etc/wazuh-indexer/ certs opensearch.keystore opensearch-performance-analyzer jvm.options opensearch-notifications opensearch-reports-scheduler jvm.options.d opensearch-notifications-core opensearch-security log4j2.properties opensearch-observability ```uninstall without purge
```console root@wazuh-indexer-1:/home/vagrant# apt-get remove wazuh-indexer -y Reading package lists... Done Building dependency tree... Done Reading state information... Done The following packages will be REMOVED: wazuh-indexer 0 upgraded, 0 newly installed, 1 to remove and 164 not upgraded. After this operation, 1,050 MB disk space will be freed. (Reading database ... 77203 files and directories currently installed.) Removing wazuh-indexer (4.8.0-1) ... Stopping wazuh-indexer service... OK ```Install v4.8.1 and opensearch.yml file is missing
```console root@wazuh-indexer-1:/home/vagrant# ls /etc/wazuh-indexer/ certs opensearch.keystore opensearch-performance-analyzer jvm.options opensearch-notifications opensearch-reports-scheduler jvm.options.d opensearch-notifications-core opensearch-security log4j2.properties opensearch-observability ```