rauldpm
commented
8 months ago Update report
test_fim/test_files/test_files_cud.py::test_file_cud[testdir1-add]
Case 1 :green_circle:
- Found errors in Wazuh agent ossec.log - Probably related to the environment itself - A Vagrant Ubuntu 22 box does not include this directory by default - Confirmed, the provided environment does not have the secure file in any instance ``` root@ubuntu22:/home/vagrant# ls -l /var/log/secure ls: cannot access '/var/log/secure': No such file or directory root@ubuntu22:/home/vagrant# cat /etc/os-release PRETTY_NAME="Ubuntu 22.04.2 LTS" NAME="Ubuntu" VERSION_ID="22.04" VERSION="22.04.2 LTS (Jammy Jellyfish)" VERSION_CODENAME=jammy ID=ubuntu ID_LIKE=debian HOME_URL="https://www.ubuntu.com/" SUPPORT_URL="https://help.ubuntu.com/" BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/" PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy" UBUNTU_CODENAME=jammy ``` ``` 2024/02/26 10:55:01 wazuh-logcollector: ERROR: (1103): Could not open file '/var/log/secure' due to [(2)-(No such file or directory)]. ```Case 2 :red_circle:
- Found timeout error in `check_result(self)` call: - Already reported at https://github.com/wazuh/wazuh-qa/issues/5025 ``` E TimeoutError: Did not found the expected callback in wazuh-manager: .*Agent 001 query: (.+) save2 ``` ---test_fim/test_synchronization/test_synchronization.py::test_synchronization[testdir1-delete-wazuh-agent1]
Case 3 :yellow_circle:
- Found warning in the Wazuh manager ossec.log file - Related https://github.com/wazuh/wazuh-qa/issues/3225 - https://github.com/wazuh/wazuh-qa/issues/3262 - Probably a missing change in the wazuh-qa repository, the configuration must be fixed to use actual configuration - This should not have a significant impact in the test results - Reported at https://github.com/wazuh/wazuh-qa/issues/5040 ``` 2024/02/26 11:03:43 wazuh-authd: WARNING: TheCase 4 :green_circle:
- Found errors/warnings in the Wazuh agent ossec.log file - Probably related to the environment - Confirmed, the provided environment does not have the secure file in any instance - Confirmed, the provided environment does not have the Auditd package installed in any instance ``` 2024/02/26 11:04:42 wazuh-syscheckd[19502] syscheck_audit.c:330 at audit_init(): WARNING: (6923): Who-data engine cannot start because Auditd is not running. 2024/02/26 11:04:42 wazuh-syscheckd[19502] main.c:300 at main(): WARNING: (6913): Who-data engine could not start. Switching who-data to real-time. 2024/02/26 11:04:43 wazuh-logcollector: ERROR: (1103): Could not open file '/var/log/secure' due to [(2)-(No such file or directory)]. ```Case 5 :red_circle:
- Found JSONDecoderError exception in `raw_decode(self, s, idx=0):` call - Reported at https://github.com/wazuh/wazuh-qa/issues/5043 ``` s = "[(u'/testdir1/testdir1.txt', u'/testdir1/testdir1.txt', u'file', 1708941796, 1, None, None, None, 0, u'rw-r--r--', u'...44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855', u'', None, u'2f0d51ab6e087d9175a7865ebdbdf6d557bc71d9')]" (...) E json.decoder.JSONDecodeError: Expecting value: line 1 column 2 (char 1) ``` --- - Asked for access to the environment: https://github.com/wazuh/internal-devel-requests/issues/794#issuecomment-1966627579 - A new test has been executed and the following output has been obtained:Test
``` (system_env) root@ip-172-31-32-151:/home/ubuntu/wazuh-qa# python3 -m pytest tests/system/ -m one_manager_agent_env --html=one_manager_agent.html ========================================= test session starts ========================================== platform linux -- Python 3.10.12, pytest-7.1.2, pluggy-1.4.0 rootdir: /home/ubuntu/wazuh-qa/tests/system, configfile: pytest.ini plugins: testinfra-5.0.0, metadata-3.1.1, html-3.1.1 collected 144 items / 129 deselected / 15 selected tests/system/test_fim/test_files/test_files_cud.py .F....... [ 60%] tests/system/test_fim/test_synchronization/test_synchronization.py .....F [100%] =============================================== FAILURES =============================================== ____________________________________ test_file_cud[testdir1-modify] ____________________________________ folder_path = 'testdir1', case = 'modify' @pytest.mark.parametrize('case', ['add', 'modify', 'delete']) @pytest.mark.parametrize('folder_path', ['testdir1', 'testdir2', 'testdir3']) def test_file_cud(folder_path, case): ''' description: The test will monitor a directory. Finally, it will verify that the FIM event is generated in agent and manager side. wazuh_min_version: 4.2.0 parameters: - folder_path: type: str brief: Name of the folder that will be created in the test. - case: type: str brief: Name of the test case that will be created in the test. assertions: - Verify that FIM events are generated correctly on the manager and agent sides. input_description: Different test cases are included with Pytest parametrize. The test cases are: add, modify and delete files. expected_output: - Different test cases are contained in external YAML file (delete_message.yml and messages.yml) tags: - fim_basic_usage - scheduled - realtime - who_data ''' messages = messages_path[0] enviroment_files = [('wazuh-manager', os.path.join(WAZUH_LOGS_PATH, 'ossec.log')), ('wazuh-agent1', os.path.join(WAZUH_LOGS_PATH, 'ossec.log'))] clean_environment(host_manager, enviroment_files) create_folder_file(host_manager, folder_path) # Restart Wazuh agent host_manager.control_service(host='wazuh-agent1', service='wazuh', state="restarted") # Check if the scan monitors end if (folder_path == scheduled_mode): wait_for_fim_scan_end(HostMonitor, inventory_path, messages_path[2], tmp_path) if (case == 'modify'): host_manager.modify_file_content(host='wazuh-agent1', path=folder_path, content=folder_path) elif(case == 'delete'): host_manager.run_command('wazuh-agent1', f'rm -rf {folder_path}') messages = messages_path[1] try: # Run the callback checks for the ossec.log HostMonitor(inventory_path=inventory_path, messages_path=messages, > tmp_path=tmp_path).run() tests/system/test_fim/test_files/test_files_cud.py:126: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ system_env/lib/python3.10/site-packages/wazuh_testing-4.7.3-py3.10.egg/wazuh_testing/tools/monitoring.py:937: in run self.check_result() _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self =About /var/log/secure and audit logs
- No instance in the provided environment has the mentioned file or audit package installed, so the error/warning messages are expected.
Proposal
- Close the issue and add the
qa_knownlabel
jnasselle
Description
During the testing in Release 4.7.3 - RC 1 - System tests, an error has been encountered in the one_manager_agent environment, specifically in this test:
test_fim/test_synchronization/test_synchronization.py::test_synchronization[testdir1-delete-wazuh-agent1].The test was executed in a Ubuntu 22.04.2 LTS T3.Large 30GB SSD instance, provided by the devops team.
Current behavior
Error details
``` folder_path = "'/testdir1/testdir1.txt'", case = 'delete', host = 'wazuh-agent1' @pytest.mark.parametrize('host', ['wazuh-agent1', 'wazuh-manager']) @pytest.mark.parametrize('case', ['add', 'modify', 'delete']) @pytest.mark.parametrize('folder_path', ['testdir1']) def test_synchronization(folder_path, case, host): ''' Description: The test will monitor a directory and apply changes when agent/manager is stopped. Finally, it will verify that the FIM 'Synchronization' event is generated in agent and manager side. wazuh_min_version: 4.2.0 parameters: - folder_path: type: str brief: Name of the folder that will be created in the test. - case: type: str brief: Name of the test case that will be created in the test. - host: type: str brief: Name of the endpoint that will be use in the test. assertions: - Verify that FIM sync events are generated correctly on the manager and agent sides. input_description: Different test cases are included with Pytest parametrize. The test cases are: add, modify and delete files. expected_output: - Different test cases are contained in external YAML file (agent_initializing_synchronization.yml and manager_initializing_synchronization.yaml) tags: - fim_basic_usage - scheduled ''' message_path = messages_path[3] # Clear logs, create folder to monitored and restart the service create_folder_file(host_manager, folder_path) host_manager.control_service(host='wazuh-agent1', service='wazuh', state="restarted") # Check that the manager contains data to monitor try: HostMonitor(inventory_path=inventory_path, messages_path=messages_path[0], tmp_path=tmp_path).run() except Exception: host_manager.run_command('wazuh-agent1', f'rm -rf {folder_path}') clean_environment(host_manager, enviroment_files) # Stop host host_manager.run_command(host, '/var/ossec/bin/wazuh-control stop') if (case == 'add'): host_manager.run_command('wazuh-agent1', f'touch {folder_path}/{folder_path}.txt') elif (case == 'modify'): host_manager.modify_file_content(host='wazuh-agent1', path=folder_path, content=folder_path) else: host_manager.run_command('wazuh-agent1', f'rm -rf {folder_path}') folder_path = f"'/{folder_path}/{folder_path}.txt'" query = " select * from fim_entry where full_path='\"{}\"'".format(folder_path) # Start host host_manager.run_command(host, '/var/ossec/bin/wazuh-control start') if (host == 'wazuh-manager'): message_path = messages_path[4] try: HostMonitor(inventory_path=inventory_path, messages_path=message_path, tmp_path=tmp_path).run() if (case == 'delete'): # Execute query to DB sleep(5) result = query_db(host_manager, db_script, db_path, f'\"{query}\"') > assert not json.loads(result) tests/system/test_fim/test_synchronization/test_synchronization.py:154: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ /usr/lib/python3.10/json/__init__.py:346: in loads return _default_decoder.decode(s) /usr/lib/python3.10/json/decoder.py:337: in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self =Expected results
All the tests should be passed
Report: one_manager_agent_env.tar.gz