Closed vcerenu closed 10 months ago
I was performing some tests on the single node installation and the execution is not working, I cannot see in the output of the command why it is failing, I continue investigating, but the first proposal is to execute the indexer-init.sh script to start the security admin and then create the ISM policy
# Copyright (C) 2015, Wazuh Inc.
# Wazuh repository installation
class wazuh::securityadmin (
$indexer_init_lockfile = '/var/tmp/indexer-init.lock',
) {
exec { 'Initialize the Opensearch security index and ISM Polciy in Wazuh indexer':
path => ['/usr/bin', '/bin', '/usr/sbin', '/sbin'],
command => "/usr/share/wazuh-indexer/bin/indexer-init.sh && touch ${indexer_init_lockfile}",
creates => $indexer_init_lockfile,
require => Service['wazuh-indexer'],
}
}
954f1b0f331dc53550e92a6bb73dc01b8918'
Info: /Stage[dashboard]/Wazuh::Dashboard/File[/etc/wazuh-dashboard/opensearch_dashboards.yml]: Scheduling refresh of Service[wazuh-dashboard]
Notice: /Stage[dashboard]/Wazuh::Dashboard/File[/usr/share/wazuh-dashboard/data/wazuh/]/ensure: created
Notice: /Stage[dashboard]/Wazuh::Dashboard/File[/usr/share/wazuh-dashboard/data/wazuh/config]/ensure: created
Notice: /Stage[dashboard]/Wazuh::Dashboard/File[/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml]/ensure: defined content as '{sha256}de216143369cebf9ffbfaa3969a55e74ecd91480f54e9e54b9eecc3755636fa0'
Info: /Stage[dashboard]/Wazuh::Dashboard/File[/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml]: Scheduling refresh of Service[wazuh-dashboard]
Notice: /Stage[dashboard]/Wazuh::Dashboard/Service[wazuh-dashboard]/ensure: ensure changed 'stopped' to 'running'
Info: /Stage[dashboard]/Wazuh::Dashboard/Service[wazuh-dashboard]: Unscheduling refresh on Service[wazuh-dashboard]
Notice: Applied catalog in 257.27 seconds
root@ubuntu20:~# systemctl status wazuh-dashboard.service
● wazuh-dashboard.service - wazuh-dashboard
Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2023-11-10 19:38:57 UTC; 22s ago
Main PID: 53097 (node)
Tasks: 11 (limit: 4749)
Memory: 157.9M
CGroup: /system.slice/wazuh-dashboard.service
└─53097 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist
Nov 10 19:38:59 ubuntu20 opensearch-dashboards[53097]: {"type":"log","@timestamp":"2023-11-10T19:38:59Z","tags":["warning","config","deprecation"],"pid":53097,"message":"\"opensearch.requestHeadersWhitelist\" is deprecated and has been>
Nov 10 19:39:00 ubuntu20 opensearch-dashboards[53097]: {"type":"log","@timestamp":"2023-11-10T19:39:00Z","tags":["info","plugins-system"],"pid":53097,"message":"Setting up [45] plugins: [usageCollection,opensearchDashboardsUsageCollect>
Nov 10 19:39:00 ubuntu20 opensearch-dashboards[53097]: {"type":"log","@timestamp":"2023-11-10T19:39:00Z","tags":["info","savedobjects-service"],"pid":53097,"message":"Waiting until all OpenSearch nodes are compatible with OpenSearch Da>
Nov 10 19:39:00 ubuntu20 opensearch-dashboards[53097]: {"type":"log","@timestamp":"2023-11-10T19:39:00Z","tags":["info","savedobjects-service"],"pid":53097,"message":"Starting saved objects migrations"}
Nov 10 19:39:00 ubuntu20 opensearch-dashboards[53097]: {"type":"log","@timestamp":"2023-11-10T19:39:00Z","tags":["info","savedobjects-service"],"pid":53097,"message":"Creating index .kibana_1."}
Nov 10 19:39:00 ubuntu20 opensearch-dashboards[53097]: {"type":"log","@timestamp":"2023-11-10T19:39:00Z","tags":["info","savedobjects-service"],"pid":53097,"message":"Pointing alias .kibana to .kibana_1."}
Nov 10 19:39:00 ubuntu20 opensearch-dashboards[53097]: {"type":"log","@timestamp":"2023-11-10T19:39:00Z","tags":["info","savedobjects-service"],"pid":53097,"message":"Finished in 138ms."}
Nov 10 19:39:00 ubuntu20 opensearch-dashboards[53097]: {"type":"log","@timestamp":"2023-11-10T19:39:00Z","tags":["info","plugins-system"],"pid":53097,"message":"Starting [45] plugins: [usageCollection,opensearchDashboardsUsageCollectio>
Nov 10 19:39:01 ubuntu20 opensearch-dashboards[53097]: {"type":"log","@timestamp":"2023-11-10T19:39:01Z","tags":["listening","info"],"pid":53097,"message":"Server running at https://0.0.0.0:443"}
Nov 10 19:39:01 ubuntu20 opensearch-dashboards[53097]: {"type":"log","@timestamp":"2023-11-10T19:39:01Z","tags":["info","http","server","OpenSearchDashboards"],"pid":53097,"message":"http server running at https://0.0.0.0:443"}
root@ubuntu20:~# curl -XGET https://localhost:9200/_plugins/_ism/policies -u admin:admin -k -s
{"policies":[],"total_policies":0}
root@ubuntu20:~# puppet agent -t
Info: Using environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Info: Caching catalog for ubuntu20
Info: Applying configuration version '1699876747'
Notice: /Stage[securityadmin]/Wazuh::Securityadmin/Exec[Initialize the Opensearch security index in Wazuh indexer]/returns: executed successfully
Notice: Applied catalog in 5.07 seconds
root@ubuntu20:~# systemctl status wazuh-indexer
● wazuh-indexer.service - Wazuh-indexer
Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
Active: active (running) since Mon 2023-11-13 11:46:55 UTC; 2h 5min ago
Docs: https://documentation.wazuh.com
Main PID: 5754 (java)
Tasks: 101 (limit: 4749)
Memory: 1.3G
CGroup: /system.slice/wazuh-indexer.service
└─5754 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8>
Nov 13 11:46:46 ubuntu20 systemd[1]: Starting Wazuh-indexer...
Nov 13 11:46:48 ubuntu20 systemd-entrypoint[5754]: WARNING: A terminally deprecated method in java.lang.System has been called
Nov 13 11:46:48 ubuntu20 systemd-entrypoint[5754]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Nov 13 11:46:48 ubuntu20 systemd-entrypoint[5754]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Nov 13 11:46:48 ubuntu20 systemd-entrypoint[5754]: WARNING: System::setSecurityManager will be removed in a future release
Nov 13 11:46:48 ubuntu20 systemd-entrypoint[5754]: WARNING: A terminally deprecated method in java.lang.System has been called
Nov 13 11:46:48 ubuntu20 systemd-entrypoint[5754]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Nov 13 11:46:48 ubuntu20 systemd-entrypoint[5754]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Nov 13 11:46:48 ubuntu20 systemd-entrypoint[5754]: WARNING: System::setSecurityManager will be removed in a future release
Nov 13 11:46:55 ubuntu20 systemd[1]: Started Wazuh-indexer.
root@ubuntu20:~# systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
Loaded: loaded (/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: enabled)
Active: active (running) since Mon 2023-11-13 11:48:16 UTC; 2h 3min ago
Tasks: 140 (limit: 4749)
Memory: 250.7M
CGroup: /system.slice/wazuh-manager.service
├─49952 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
├─49991 /var/ossec/bin/wazuh-authd
├─50007 /var/ossec/bin/wazuh-db
├─50029 /var/ossec/bin/wazuh-execd
├─50033 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
├─50036 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
├─50039 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
├─50052 /var/ossec/bin/wazuh-analysisd
├─50113 /var/ossec/bin/wazuh-syscheckd
├─50128 /var/ossec/bin/wazuh-remoted
├─50162 /var/ossec/bin/wazuh-logcollector
├─50186 /var/ossec/bin/wazuh-monitord
└─50213 /var/ossec/bin/wazuh-modulesd
Nov 13 11:48:07 ubuntu20 env[49879]: Started wazuh-db...
Nov 13 11:48:08 ubuntu20 env[49879]: Started wazuh-execd...
Nov 13 11:48:09 ubuntu20 env[49879]: Started wazuh-analysisd...
Nov 13 11:48:09 ubuntu20 env[49879]: Started wazuh-syscheckd...
Nov 13 11:48:10 ubuntu20 env[49879]: Started wazuh-remoted...
Nov 13 11:48:12 ubuntu20 env[49879]: Started wazuh-logcollector...
Nov 13 11:48:13 ubuntu20 env[49879]: Started wazuh-monitord...
Nov 13 11:48:14 ubuntu20 env[49879]: Started wazuh-modulesd...
Nov 13 11:48:16 ubuntu20 env[49879]: Completed.
Nov 13 11:48:16 ubuntu20 systemd[1]: Started Wazuh manager.
root@ubuntu20:~# systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)
Active: active (running) since Mon 2023-11-13 11:49:03 UTC; 2h 3min ago
Main PID: 51719 (node)
Tasks: 11 (limit: 4749)
Memory: 174.6M
CGroup: /system.slice/wazuh-dashboard.service
└─51719 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist
Nov 13 12:00:06 ubuntu20 opensearch-dashboards[51719]: {"type":"response","@timestamp":"2023-11-13T12:00:06Z","tags":[],"pid":51719,"method":"get","statusCode":200,"req":{"url":"/api/v1/configuration/account","method":"get","headers":{>
Nov 13 12:00:06 ubuntu20 opensearch-dashboards[51719]: {"type":"response","@timestamp":"2023-11-13T12:00:06Z","tags":[],"pid":51719,"method":"get","statusCode":200,"req":{"url":"/api/v1/auth/dashboardsinfo","method":"get","headers":{"h>
Nov 13 12:00:06 ubuntu20 opensearch-dashboards[51719]: {"type":"response","@timestamp":"2023-11-13T12:00:06Z","tags":[],"pid":51719,"method":"post","statusCode":200,"req":{"url":"/api/core/capabilities","method":"post","headers":{"host>
Nov 13 12:00:06 ubuntu20 opensearch-dashboards[51719]: {"type":"response","@timestamp":"2023-11-13T12:00:06Z","tags":[],"pid":51719,"method":"get","statusCode":200,"req":{"url":"/api/v1/configuration/account","method":"get","headers":{>
Nov 13 12:00:06 ubuntu20 opensearch-dashboards[51719]: {"type":"response","@timestamp":"2023-11-13T12:00:06Z","tags":[],"pid":51719,"method":"get","statusCode":200,"req":{"url":"/48000/bundles/plugin/indexManagementDashboards/indexMana>
Nov 13 12:00:06 ubuntu20 opensearch-dashboards[51719]: {"type":"response","@timestamp":"2023-11-13T12:00:06Z","tags":[],"pid":51719,"method":"get","statusCode":200,"req":{"url":"/48000/bundles/plugin/indexManagementDashboards/indexMana>
Nov 13 12:00:06 ubuntu20 opensearch-dashboards[51719]: {"type":"response","@timestamp":"2023-11-13T12:00:06Z","tags":[],"pid":51719,"method":"get","statusCode":200,"req":{"url":"/ui/logos/home.svg","method":"get","headers":{"host":"192>
Nov 13 12:00:06 ubuntu20 opensearch-dashboards[51719]: {"type":"response","@timestamp":"2023-11-13T12:00:06Z","tags":[],"pid":51719,"method":"get","statusCode":200,"req":{"url":"/api/v1/auth/dashboardsinfo","method":"get","headers":{"h>
Nov 13 12:00:06 ubuntu20 opensearch-dashboards[51719]: {"type":"response","@timestamp":"2023-11-13T12:00:06Z","tags":[],"pid":51719,"method":"get","statusCode":200,"req":{"url":"/ui/fonts/source_sans_3/SourceSans3-Bold.ttf.woff2","meth>
Nov 13 12:00:06 ubuntu20 opensearch-dashboards[51719]: {"type":"response","@timestamp":"2023-11-13T12:00:06Z","tags":[],"pid":51719,"method":"get","statusCode":200,"req":{"url":"/api/ism/policies?from=0&size=20&search=&sortField=id&sor>
New test of AIO with all changes:
Info: /Stage[dashboard]/Wazuh::Dashboard/File[/etc/wazuh-dashboard/opensearch_dashboards.yml]: Scheduling refresh of Service[wazuh-dashboard]
Notice: /Stage[dashboard]/Wazuh::Dashboard/File[/usr/share/wazuh-dashboard/data/wazuh/]/ensure: created
Notice: /Stage[dashboard]/Wazuh::Dashboard/File[/usr/share/wazuh-dashboard/data/wazuh/config]/ensure: created
Notice: /Stage[dashboard]/Wazuh::Dashboard/File[/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml]/ensure: defined content as '{sha256}de216143369cebf9ffbfaa3969a55e74ecd91480f54e9e54b9eecc3755636fa0'
Info: /Stage[dashboard]/Wazuh::Dashboard/File[/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml]: Scheduling refresh of Service[wazuh-dashboard]
Notice: /Stage[dashboard]/Wazuh::Dashboard/Service[wazuh-dashboard]/ensure: ensure changed 'stopped' to 'running'
Info: /Stage[dashboard]/Wazuh::Dashboard/Service[wazuh-dashboard]: Unscheduling refresh on Service[wazuh-dashboard]
Notice: Applied catalog in 272.74 seconds
root@ubuntu20-2:~# systemctl status wazuh-indexer
● wazuh-indexer.service - Wazuh-indexer
Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
Active: active (running) since Mon 2023-11-13 15:42:40 UTC; 12min ago
Docs: https://documentation.wazuh.com
Main PID: 6840 (java)
Tasks: 99 (limit: 4749)
Memory: 1.3G
CGroup: /system.slice/wazuh-indexer.service
└─6840 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8>
Nov 13 15:42:30 ubuntu20-2 systemd[1]: Starting Wazuh-indexer...
Nov 13 15:42:32 ubuntu20-2 systemd-entrypoint[6840]: WARNING: A terminally deprecated method in java.lang.System has been called
Nov 13 15:42:32 ubuntu20-2 systemd-entrypoint[6840]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Nov 13 15:42:32 ubuntu20-2 systemd-entrypoint[6840]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Nov 13 15:42:32 ubuntu20-2 systemd-entrypoint[6840]: WARNING: System::setSecurityManager will be removed in a future release
Nov 13 15:42:33 ubuntu20-2 systemd-entrypoint[6840]: WARNING: A terminally deprecated method in java.lang.System has been called
Nov 13 15:42:33 ubuntu20-2 systemd-entrypoint[6840]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Nov 13 15:42:33 ubuntu20-2 systemd-entrypoint[6840]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Nov 13 15:42:33 ubuntu20-2 systemd-entrypoint[6840]: WARNING: System::setSecurityManager will be removed in a future release
Nov 13 15:42:40 ubuntu20-2 systemd[1]: Started Wazuh-indexer.
root@ubuntu20-2:~# systemctl status wazuh-manager.service
● wazuh-manager.service - Wazuh manager
Loaded: loaded (/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: enabled)
Active: active (running) since Mon 2023-11-13 15:44:09 UTC; 10min ago
Tasks: 140 (limit: 4749)
Memory: 248.5M
CGroup: /system.slice/wazuh-manager.service
├─51187 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
├─51226 /var/ossec/bin/wazuh-authd
├─51243 /var/ossec/bin/wazuh-db
├─51258 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
├─51261 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
├─51264 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
├─51276 /var/ossec/bin/wazuh-execd
├─51290 /var/ossec/bin/wazuh-analysisd
├─51353 /var/ossec/bin/wazuh-syscheckd
├─51372 /var/ossec/bin/wazuh-remoted
├─51411 /var/ossec/bin/wazuh-logcollector
├─51458 /var/ossec/bin/wazuh-monitord
└─51506 /var/ossec/bin/wazuh-modulesd
Nov 13 15:44:00 ubuntu20-2 env[51109]: Started wazuh-db...
Nov 13 15:44:01 ubuntu20-2 env[51109]: Started wazuh-execd...
Nov 13 15:44:02 ubuntu20-2 env[51109]: Started wazuh-analysisd...
Nov 13 15:44:03 ubuntu20-2 env[51109]: Started wazuh-syscheckd...
Nov 13 15:44:04 ubuntu20-2 env[51109]: Started wazuh-remoted...
Nov 13 15:44:05 ubuntu20-2 env[51109]: Started wazuh-logcollector...
Nov 13 15:44:06 ubuntu20-2 env[51109]: Started wazuh-monitord...
Nov 13 15:44:07 ubuntu20-2 env[51109]: Started wazuh-modulesd...
Nov 13 15:44:09 ubuntu20-2 env[51109]: Completed.
Nov 13 15:44:09 ubuntu20-2 systemd[1]: Started Wazuh manager.
root@ubuntu20-2:~# systemctl status wazuh-dashboard.service
● wazuh-dashboard.service - wazuh-dashboard
Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)
Active: active (running) since Mon 2023-11-13 15:44:59 UTC; 9min ago
Main PID: 52973 (node)
Tasks: 11 (limit: 4749)
Memory: 165.6M
CGroup: /system.slice/wazuh-dashboard.service
└─52973 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist
Nov 13 15:45:02 ubuntu20-2 opensearch-dashboards[52973]: {"type":"log","@timestamp":"2023-11-13T15:45:02Z","tags":["warning","config","deprecation"],"pid":52973,"message":"\"opensearch.requestHeadersWhitelist\" is deprecated and has be>
Nov 13 15:45:02 ubuntu20-2 opensearch-dashboards[52973]: {"type":"log","@timestamp":"2023-11-13T15:45:02Z","tags":["info","plugins-system"],"pid":52973,"message":"Setting up [45] plugins: [usageCollection,opensearchDashboardsUsageColle>
Nov 13 15:45:02 ubuntu20-2 opensearch-dashboards[52973]: {"type":"log","@timestamp":"2023-11-13T15:45:02Z","tags":["info","savedobjects-service"],"pid":52973,"message":"Waiting until all OpenSearch nodes are compatible with OpenSearch >
Nov 13 15:45:03 ubuntu20-2 opensearch-dashboards[52973]: {"type":"log","@timestamp":"2023-11-13T15:45:03Z","tags":["info","savedobjects-service"],"pid":52973,"message":"Starting saved objects migrations"}
Nov 13 15:45:03 ubuntu20-2 opensearch-dashboards[52973]: {"type":"log","@timestamp":"2023-11-13T15:45:03Z","tags":["info","savedobjects-service"],"pid":52973,"message":"Creating index .kibana_1."}
Nov 13 15:45:03 ubuntu20-2 opensearch-dashboards[52973]: {"type":"log","@timestamp":"2023-11-13T15:45:03Z","tags":["info","savedobjects-service"],"pid":52973,"message":"Pointing alias .kibana to .kibana_1."}
Nov 13 15:45:03 ubuntu20-2 opensearch-dashboards[52973]: {"type":"log","@timestamp":"2023-11-13T15:45:03Z","tags":["info","savedobjects-service"],"pid":52973,"message":"Finished in 81ms."}
Nov 13 15:45:03 ubuntu20-2 opensearch-dashboards[52973]: {"type":"log","@timestamp":"2023-11-13T15:45:03Z","tags":["info","plugins-system"],"pid":52973,"message":"Starting [45] plugins: [usageCollection,opensearchDashboardsUsageCollect>
Nov 13 15:45:03 ubuntu20-2 opensearch-dashboards[52973]: {"type":"log","@timestamp":"2023-11-13T15:45:03Z","tags":["listening","info"],"pid":52973,"message":"Server running at https://0.0.0.0:443"}
Nov 13 15:45:03 ubuntu20-2 opensearch-dashboards[52973]: {"type":"log","@timestamp":"2023-11-13T15:45:03Z","tags":["info","http","server","OpenSearchDashboards"],"pid":52973,"message":"http server running at https://0.0.0.0:443"}
Distributed deployment:
Distributed deployment:
Description
The indexerRolloverAlias.sh script should be downloaded and executed after running the securityadmin script.
Related