jnasselle
commented
1 year ago DEB - Ubuntu 22.04 LTS :red_circle:
-
Running on ubuntu:22:04 container
-
Manager: v4.5.2-rc1 OVA
TOKEN=$(curl -s -u wazuh:wazuh -k -X POST "https://localhost:55000/security/user/authenticate?raw=true") AGENTID=002 TESTPACKAGE=7zip -
Package to be installed/removed
Wazuh Agent 4.1.5
Package: https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.1.5-1_amd64.deb Agent info
[root@wazuh-server wazuh-user]# /var/ossec/bin/agent_control -i 002
Wazuh agent_control. Agent information: Agent ID: 002 Agent Name: 58346f6ed610 IP address: any Status: Disconnected
Operating system: Linux |58346f6ed610 |5.15.125-1-MANJARO |#1 SMP PREEMPT Wed Aug 9 06:31:14 UTC 2023 |x86_64 Client version: Wazuh v4.1.5 Configuration hash: ab73af41699f13fdd81903b5f23d8d00 Shared file hash: 4a8724b20dee0124ff9656783c490c4e Last keep alive: 1693324872
Syscheck last started at: Unknown Syscheck last ended at: Unknown
- Agent
- First scan: no package
- Second scan: new package detection
- Third scan: package removal
- First scan: no package
- Manager
- First scan: no package[root@wazuh-server wazuh-user]# TOKEN=$(curl -s -u wazuh:wazuh -k -X POST "https://localhost:55000/security/user/authenticate?raw=true") [root@wazuh-server wazuh-user]# LASTSCAN=$(curl -s -k -X GET "https://localhost:55000/syscollector/002/os?select=scan.time&pretty=true" -H "Authorization: Bearer $TOKEN" | jq -r '.data.affected_items[0].scan.time' | date +"%Y/%m/%d %H:%M" -f -) [root@wazuh-server wazuh-user]# curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/packages?select=name&pretty=true" -H "Authorization: Bearer $TOKEN" | grep $TESTPACKAGE [root@wazuh-server wazuh-user]# grep -A10000 $LASTSCAN /var/ossec/logs/ossec.log | grep "Agent $AGENTID query: package" | grep $TESTPACKAGE grep: 16:11: No such file or directory
- Second scan: new package detection[root@wazuh-server wazuh-user]# TOKEN=$(curl -s -u wazuh:wazuh -k -X POST "https://localhost:55000/security/user/authenticate?raw=true") [root@wazuh-server wazuh-user]# LASTSCAN=$(curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/os?select=scan.time&pretty=true" -H "Authorization: Bearer $TOKEN" | jq -r '.data.affected_items[0].scan.time' | date +"%Y/%m/%d %H:%M" -f -) [root@wazuh-server wazuh-user]# curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/packages?select=name&pretty=true" -H "Authorization: Bearer $TOKEN" | grep $TESTPACKAGE "name": "7zip", [root@wazuh-server wazuh-user]# grep -A10000 $LASTSCAN /var/ossec/logs/ossec.log | grep "Agent $AGENTID query: package" | grep $TESTPACKAGE grep: 16:14: No such file or directory /var/ossec/logs/ossec.log:2023/08/29 16:14:07 wazuh-db[18548] wdb_parser.c:263 at wdb_parse(): DEBUG: Agent 002 query: package save 1500947758|2023/08/29 16:14:07|deb|7zip|optional|utils|2396|Ubuntu Developers ubuntu-devel-discuss@lists.ubuntu.com|NULL|21.07+dfsg-4|amd64|NULL|NULL|7-Zip file archiver with a high compression ratio|NULL|569f6ff9040271f10542b6ca7e8afd8055b7a7de
- Third scan: package removal[root@wazuh-server wazuh-user]# TOKEN=$(curl -s -u wazuh:wazuh -k -X POST "https://localhost:55000/security/user/authenticate?raw=true") [root@wazuh-server wazuh-user]# LASTSCAN=$(curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/os?select=scan.time&pretty=true" -H "Authorization: Bearer $TOKEN" | jq -r '.data.affected_items[0].scan.time' | date +"%Y/%m/%d %H:%M" -f -) [root@wazuh-server wazuh-user]# curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/packages?select=name&pretty=true" -H "Authorization: Bearer $TOKEN" | grep $TESTPACKAGE [root@wazuh-server wazuh-user]# grep -A10000 $LASTSCAN /var/ossec/logs/ossec.log | grep "Agent $AGENTID query: package" | grep $TESTPACKAGE grep: 16:20: No such file or directory
- First scan: no package[root@wazuh-server wazuh-user]# TOKEN=$(curl -s -u wazuh:wazuh -k -X POST "https://localhost:55000/security/user/authenticate?raw=true") [root@wazuh-server wazuh-user]# LASTSCAN=$(curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/os?select=scan.time&pretty=true" -H "Authorization: Bearer $TOKEN" | jq -r '.data.affected_items[0].scan.time' | date +"%Y/%m/%d %H:%M" -f -) [root@wazuh-server wazuh-user]# curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/packages?select=name&pretty=true" -H "Authorization: Bearer $TOKEN" | grep $TESTPACKAGE [root@wazuh-server wazuh-user]# grep -A10000 $LASTSCAN /var/ossec/logs/ossec.log | grep "Agent $AGENTID query: package" | grep $TESTPACKAGE grep: 16:20: No such file or directory
## Wazuh Agent 4.2.7
Package: https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.2.7-1_amd64.deb[root@wazuh-server wazuh-user]# /var/ossec/bin/agent_control -i 002 Wazuh agent_control. Agent information: Agent ID: 002 Agent Name: 58346f6ed610 IP address: any Status: Active
Operating system: Linux |58346f6ed610 |5.15.125-1-MANJARO |#1 SMP PREEMPT Wed Aug 9 06:31:14 UTC 2023 |x86_64 Client version: Wazuh v4.2.7 Configuration hash: ab73af41699f13fdd81903b5f23d8d00 Shared file hash: 4a8724b20dee0124ff9656783c490c4e Last keep alive: 1693326449
Syscheck last started at: Unknown Syscheck last ended at: Unknown
- Agent
- First scan: no package
- Second scan: new package detection
- Third scan: package removal
- First scan: no package
- Manager
- First scan: no package
[root@wazuh-server wazuh-user]# TOKEN=$(curl -s -u wazuh:wazuh -k -X POST "https://localhost:55000/security/user/authenticate?raw=true") [root@wazuh-server wazuh-user]# LASTSCAN=$(curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/os?select=scan.time&pretty=true" -H "Authorization: Bearer $TOKEN" | jq -r '.data.affected_items[0].scan.time' | date +"%Y/%m/%d %H:%M" -f -) [root@wazuh-server wazuh-user]# curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/packages?select=name&pretty=true" -H "Authorization: Bearer $TOKEN" | grep $TESTPACKAGE [root@wazuh-server wazuh-user]# grep -A10000 $LASTSCAN /var/ossec/logs/ossec.log | grep "DB($AGENTID) syscollector_packages" | grep $TESTPACKAGE grep: 16:26: No such file or directory
- Second scan: new package detection
[root@wazuh-server wazuh-user]# TOKEN=$(curl -s -u wazuh:wazuh -k -X POST "https://localhost:55000/security/user/authenticate?raw=true") [root@wazuh-server wazuh-user]# LASTSCAN=$(curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/os?select=scan.time&pretty=true" -H "Authorization: Bearer $TOKEN" | jq -r '.data.affected_items[0].scan.time' | date +"%Y/%m/%d %H:%M" -f -) [root@wazuh-server wazuh-user]# curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/packages?select=name&pretty=true" -H "Authorization: Bearer $TOKEN" | grep $TESTPACKAGE "name": "7zip", [root@wazuh-server wazuh-user]# grep -A10000 $LASTSCAN /var/ossec/logs/ossec.log | grep "Agent $AGENTID query: syscollector_packages" | grep $TESTPACKAGE grep: 16:32: No such file or directory /var/ossec/logs/ossec.log:2023/08/29 16:32:35 wazuh-db[20214] wdb_parser.c:263 at wdb_parse(): DEBUG: Agent 002 query: syscollector_packages save2 {"attributes":{"architecture":"amd64","checksum":"69d774cf970b11a6cac9c87f9792a1de1e9049fa","description":"7-Zip file archiver with a high compression ratio","format":"deb","groups":"utils","item_id":"569f6ff9040271f10542b6ca7e8afd8055b7a7de","multiarch":null,"name":"7zip","priority":"optional","scan_time":"2023/08/29 16:32:35","size":2396,"source":null,"vendor":"Ubuntu Developers ubuntu-devel-discuss@lists.ubuntu.com","version":"21.07+dfsg-4"},"index":"569f6ff9040271f10542b6ca7e8afd8055b7a7de","timestamp":""}
- Third scan: package removal
[root@wazuh-server wazuh-user]# TOKEN=$(curl -s -u wazuh:wazuh -k -X POST "https://localhost:55000/security/user/authenticate?raw=true") [root@wazuh-server wazuh-user]# curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/packages?select=name&pretty=true" -H "Authorization: Bearer $TOKEN" | grep $TESTPACKAGE
[root@wazuh-server wazuh-user]# grep "Agent $AGENTID query:" /var/ossec/logs/ossec.log| grep $TESTPACKAGE 2023/08/29 16:32:35 wazuh-db[20214] wdb_parser.c:263 at wdb_parse(): DEBUG: Agent 002 query: syscollector_packages save2 {"attributes":{"architecture":"amd64","checksum":"69d774cf970b11a6cac9c87f9792a1de1e9049fa","description":"7-Zip file archiver with a high compression ratio","format":"deb","groups":"utils","item_id":"569f6ff9040271f10542b6ca7e8afd8055b7a7de","multiarch":null,"name":"7zip","priority":"optional","scan_time":"2023/08/29 16:32:35","size":2396,"source":null,"vendor":"Ubuntu Developers ubuntu-devel-discuss@lists.ubuntu.com","version":"21.07+dfsg-4"},"index":"569f6ff9040271f10542b6ca7e8afd8055b7a7de","timestamp":""}
- First scan: no package
[root@wazuh-server wazuh-user]# TOKEN=$(curl -s -u wazuh:wazuh -k -X POST "https://localhost:55000/security/user/authenticate?raw=true") [root@wazuh-server wazuh-user]# curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/packages?select=name&pretty=true" -H "Authorization: Bearer $TOKEN" | grep $TESTPACKAGE [root@wazuh-server wazuh-user]# grep "Agent $AGENTID query:" /var/ossec/logs/ossec.log| grep $TESTPACKAGE 2023/08/29 16:32:35 wazuh-db[20214] wdb_parser.c:263 at wdb_parse(): DEBUG: Agent 002 query: syscollector_packages save2 {"attributes":{"architecture":"amd64","checksum":"69d774cf970b11a6cac9c87f9792a1de1e9049fa","description":"7-Zip file archiver with a high compression ratio","format":"deb","groups":"utils","item_id":"569f6ff9040271f10542b6ca7e8afd8055b7a7de","multiarch":null,"name":"7zip","priority":"optional","scan_time":"2023/08/29 16:32:35","size":2396,"source":null,"vendor":"Ubuntu Developers ubuntu-devel-discuss@lists.ubuntu.com","version":"21.07+dfsg-4"},"index":"569f6ff9040271f10542b6ca7e8afd8055b7a7de","timestamp":""}
## Wazuh Agent 4.4.5
Package: https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.4.5-1_amd64.deb[root@wazuh-server wazuh-user]# /var/ossec/bin/agent_control -i 002
Wazuh agent_control. Agent information: Agent ID: 002 Agent Name: 58346f6ed610 IP address: any Status: Active
Operating system: Linux |58346f6ed610 |5.15.125-1-MANJARO |#1 SMP PREEMPT Wed Aug 9 06:31:14 UTC 2023 |x86_64 Client version: Wazuh v4.4.5 Configuration hash: ab73af41699f13fdd81903b5f23d8d00 Shared file hash: 4a8724b20dee0124ff9656783c490c4e Last keep alive: 1693328438
Syscheck last started at: Unknown Syscheck last ended at: Unknown
- Agent
- First scan: no package
- Second scan: new package detection
- Third scan: package removal
- First scan: no package
- Manager
- First scan: no package :green_circle:
[root@wazuh-server wazuh-user]# TOKEN=$(curl -s -u wazuh:wazuh -k -X POST "https://localhost:55000/security/user/authenticate?raw=true") [root@wazuh-server wazuh-user]# curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/os?select=scan.time&pretty=true" -H "Authorization: Bearer $TOKEN" | jq -r '.data.affected_items[0].scan.time' 2023-08-29T17:00:38+00:00 [root@wazuh-server wazuh-user]# curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/packages?select=name&pretty=true" -H "Authorization: Bearer $TOKEN" | grep $TESTPACKAGE [root@wazuh-server wazuh-user]# grep "Agent $AGENTID query:" /var/ossec/logs/ossec.log| grep $TESTPACKAGE
- Second scan: new package detection :red_circle:
[root@wazuh-server wazuh-user]# TOKEN=$(curl -s -u wazuh:wazuh -k -X POST "https://localhost:55000/security/user/authenticate?raw=true") [root@wazuh-server wazuh-user]# curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/os?select=scan.time&pretty=true" -H "Authorization: Bearer $TOKEN" | jq -r '.data.affected_items[0].scan.time' 2023-08-29T17:03:38+00:00 [root@wazuh-server wazuh-user]# curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/packages?select=name&pretty=true" -H "Authorization: Bearer $TOKEN" | grep $TESTPACKAGE "name": "7zip", [root@wazuh-server wazuh-user]# grep "Agent $AGENTID query:" /var/ossec/logs/ossec.log| grep $TESTPACKAGE 2023/08/29 17:03:39 wazuh-db[22172] wdb_parser.c:263 at wdb_parse(): DEBUG: Agent 002 query: dbsync packages INSERTED {"architecture":"amd64","checksum":"69d774cf970b11a6cac9c87f9792a1de1e9049fa","description":"7-Zip file archiver with a high compression ratio","format":"deb","groups":"utils","item_id":"569f6ff9040271f10542b6ca7e8afd8055b7a7de","multiarch":null,"name":"7zip","priority":"optional","scan_time":"2023/08/29 17:03:38","size":2396,"source":null,"vendor":"Ubuntu Developers ubuntu-devel-discuss@lists.ubuntu.com","version":"21.07+dfsg-4"} 2023/08/29 17:03:42 wazuh-db[22172] wdb_parser.c:263 at wdb_parse(): DEBUG: Agent 002 query: syscollector_packages save2 {"attributes":{"architecture":"amd64","checksum":"69d774cf970b11a6cac9c87f9792a1de1e9049fa","description":"7-Zip file archiver with a high compression ratio","format":"deb","groups":"utils","item_id":"569f6ff9040271f10542b6ca7e8afd8055b7a7de","multiarch":null,"name":"7zip","priority":"optional","scan_time":"2023/08/29 17:03:42","size":2396,"source":null,"vendor":"Ubuntu Developers ubuntu-devel-discuss@lists.ubuntu.com","version":"21.07+dfsg-4"},"index":"569f6ff9040271f10542b6ca7e8afd8055b7a7de","timestamp":""}
- Third scan: package removal[root@wazuh-server wazuh-user]# TOKEN=$(curl -s -u wazuh:wazuh -k -X POST "https://localhost:55000/security/user/authenticate?raw=true")[root@wazuh-server wazuh-user]# curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/os?select=scan.time&pretty=true" -H "Authorization: Bearer $TOKEN" | jq -r '.data.affected_items[0].scan.time' 2023-08-29T17:12:44+00:00 [root@wazuh-server wazuh-user]# curl -s -k -X GET "https://localhost:55000/syscollector/$AGENTID/packages?select=name&pretty=true" -H "Authorization: Bearer $TOKEN" | grep $TESTPACKAGE [root@wazuh-server wazuh-user]# grep "Agent $AGENTID query:" /var/ossec/logs/ossec.log| grep $TESTPACKAGE 2023/08/29 17:03:39 wazuh-db[22172] wdb_parser.c:263 at wdb_parse(): DEBUG: Agent 002 query: dbsync packages INSERTED {"architecture":"amd64","checksum":"69d774cf970b11a6cac9c87f9792a1de1e9049fa","description":"7-Zip file archiver with a high compression ratio","format":"deb","groups":"utils","item_id":"569f6ff9040271f10542b6ca7e8afd8055b7a7de","multiarch":null,"name":"7zip","priority":"optional","scan_time":"2023/08/29 17:03:38","size":2396,"source":null,"vendor":"Ubuntu Developers ubuntu-devel-discuss@lists.ubuntu.com","version":"21.07+dfsg-4"} 2023/08/29 17:03:42 wazuh-db[22172] wdb_parser.c:263 at wdb_parse(): DEBUG: Agent 002 query: syscollector_packages save2 {"attributes":{"architecture":"amd64","checksum":"69d774cf970b11a6cac9c87f9792a1de1e9049fa","description":"7-Zip file archiver with a high compression ratio","format":"deb","groups":"utils","item_id":"569f6ff9040271f10542b6ca7e8afd8055b7a7de","multiarch":null,"name":"7zip","priority":"optional","scan_time":"2023/08/29 17:03:42","size":2396,"source":null,"vendor":"Ubuntu Developers ubuntu-devel-discuss@lists.ubuntu.com","version":"21.07+dfsg-4"},"index":"569f6ff9040271f10542b6ca7e8afd8055b7a7de","timestamp":""} 2023/08/29 17:12:45 wazuh-db[22172] wdb_parser.c:263 at wdb_parse(): DEBUG: Agent 002 query: dbsync packages DELETED {"architecture":"amd64","checksum":"69d774cf970b11a6cac9c87f9792a1de1e9049fa","description":"7-Zip file archiver with a high compression ratio","format":"deb","groups":"utils","install_time":null,"item_id":"569f6ff9040271f10542b6ca7e8afd8055b7a7de","location":null,"multiarch":null,"name":"7zip","priority":"optional","scan_time":"2023/08/29 17:12:44","size":2396,"source":null,"vendor":"Ubuntu Developers ubuntu-devel-discuss@lists.ubuntu.com","version":"21.07+dfsg-4"}
BelenValdivia
davidjiglesias
Description
This issue aims to execute some manual smoke and backward compatibility tests related to https://github.com/wazuh/wazuh/issues/18219 changes
Proposed checks
Check current manager (v4.5.2-rc1) behavior with older Wazuh Agents on different OS families
From version to version, Upgrading it is the method to be used
Scope and history
Preconditions
Expected results
For 4.1.5 agents: