Release 4.8.0 - RC 1 - Footprint Metrics - LOGCOLLECTOR (2.5d)

[wazuhci]

Footprint metrics information

Main release stage issue #	#23246
Main footprint metrics issue #	#23254
Version	4.8.0
Release stage #	RC 1
Tag	https://github.com/wazuh/wazuh/tree/v4.8.0-rc1

Stress test documentation

Packages used

• Repository: packages-dev.wazuh.com

• Package path: pre-release

• Package revision: 1

• Jenkins build: https://ci.wazuh.info/job/Test_stress/5103/

---

Manager

+

Plots

                  

• Logs and configuration

  [ossec_Test_stress_B5103_manager_2024-05-06.zip](https://ci.wazuh.com/data/Test_stress/pre-release/4.8.0/B5103-3600m/B5103_manager_centos/logs/ossec_Test_stress_B5103_manager_2024-05-06.zip)
• CSV

  [monitor-manager-Test_stress_B5103_manager-pre-release.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.8.0/B5103-3600m/B5103_manager_centos/data/monitor-manager-Test_stress_B5103_manager-pre-release.csv) [Test_stress_B5103_manager_analysisd_events.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.8.0/B5103-3600m/B5103_manager_centos/data/Test_stress_B5103_manager_analysisd_events.csv) [Test_stress_B5103_manager_analysisd_state.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.8.0/B5103-3600m/B5103_manager_centos/data/Test_stress_B5103_manager_analysisd_state.csv) [Test_stress_B5103_manager_remoted_state.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.8.0/B5103-3600m/B5103_manager_centos/data/Test_stress_B5103_manager_remoted_state.csv)

Centos agent

+

Plots

                

• Logs and configuration

  [ossec_Test_stress_B5103_centos_2024-05-06.zip](https://ci.wazuh.com/data/Test_stress/pre-release/4.8.0/B5103-3600m/B5103_agent_centos/logs/ossec_Test_stress_B5103_centos_2024-05-06.zip)
• CSV

  [monitor-agent-Test_stress_B5103_centos-pre-release.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.8.0/B5103-3600m/B5103_agent_centos/data/monitor-agent-Test_stress_B5103_centos-pre-release.csv) [Test_stress_B5103_centos_agentd_state.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.8.0/B5103-3600m/B5103_agent_centos/data/Test_stress_B5103_centos_agentd_state.csv)

Ubuntu agent

+

Plots

                

• Logs and configuration

  [ossec_Test_stress_B5103_ubuntu_2024-05-06.zip](https://ci.wazuh.com/data/Test_stress/pre-release/4.8.0/B5103-3600m/B5103_agent_ubuntu/logs/ossec_Test_stress_B5103_ubuntu_2024-05-06.zip)
• CSV

  [monitor-agent-Test_stress_B5103_ubuntu-pre-release.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.8.0/B5103-3600m/B5103_agent_ubuntu/data/monitor-agent-Test_stress_B5103_ubuntu-pre-release.csv) [Test_stress_B5103_ubuntu_agentd_state.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.8.0/B5103-3600m/B5103_agent_ubuntu/data/Test_stress_B5103_ubuntu_agentd_state.csv)

Windows agent

+

Plots

              

• Logs and configuration

  [ossec_Test_stress_B5103_windows_2024-05-06.zip](https://ci.wazuh.com/data/Test_stress/pre-release/4.8.0/B5103-3600m/B5103_agent_windows/logs/ossec_Test_stress_B5103_windows_2024-05-06.zip)
• CSV

  [monitor-winagent-Test_stress_B5103_windows-pre-release.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.8.0/B5103-3600m/B5103_agent_windows/data/monitor-winagent-Test_stress_B5103_windows-pre-release.csv) [Test_stress_B5103_windows_agentd_state.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.8.0/B5103-3600m/B5103_agent_windows/data/Test_stress_B5103_windows_agentd_state.csv)

macOS agent

+

Plots

• Logs and configuration
• CSV

Solaris agent

+

Plots

• Logs and configuration
• CSV

Conclusion

Graphs :red_circle:

New issues

• https://github.com/wazuh/wazuh/issues/23304

Known issues

• https://github.com/wazuh/wazuh-jenkins/issues/5939

Logs :yellow_circle:

Known Issues

• https://github.com/wazuh/wazuh-jenkins/issues/5287
• https://github.com/wazuh/wazuh-jenkins/issues/4867
• https://github.com/wazuh/wazuh/issues/22565

[Rebits]

Analysis report

Graphs :red_circle:

Plots compared with https://github.com/wazuh/wazuh/issues/23156

[!NOTE] Due to https://github.com/wazuh/wazuh-jenkins/issues/5939, this analysis will not include reliable data for comparison for the agents

Manager

- **RSS/PSS/VMS**: Increasal of memory used by modulesd. Reported in https://github.com/wazuh/wazuh/issues/23304

Centos

- Missing metrics. Reported in https://github.com/wazuh/wazuh-jenkins/issues/5939

Ubuntu

- Missing metrics. Reported in https://github.com/wazuh/wazuh-jenkins/issues/5939

Windows

- No abnormal behaviour detected

Logs :yellow_circle:

Manager

- Reported in https://github.com/wazuh/wazuh/issues/22565 ``` ./ossec_Test_stress_B5103_manager_2024-05-06(1)/var/ossec/logs/wazuh/2024/May/ossec-03_WARNING.log:2024/05/03 15:16:58 indexer-connector: WARNING: IndexerConnector initialization failed for index 'wazuh-states-vulnerabilities', retrying until the connection is successful. ./ossec_Test_stress_B5103_manager_2024-05-06(1)/var/ossec/logs/wazuh/2024/May/ossec-03_WARNING.log:2024/05/03 15:18:11 indexer-connector: WARNING: Failed to sync agent '000' with the indexer. ``` - Expected for stress test: ``` ./ossec_Test_stress_B5103_manager_2024-05-06(1)/var/ossec/logs/wazuh/2024/May/ossec-04.log:2024/05/04 23:52:13 wazuh-logcollector: WARNING: (1960): File limit has been reached (1000). Please reduce the number of files or increase "logcollector.max_files". ./ossec_Test_stress_B5103_manager_2024-05-06(1)/var/ossec/logs/wazuh/2024/May/ossec-03_WARNING.log:2024/05/03 15:19:04 wazuh-logcollector: WARNING: Target 'agent' message queue is full (1024). Log lines may be lost. ./ossec_Test_stress_B5103_manager_2024-05-06(1)/var/ossec/logs/wazuh/2024/May/ossec-03_WARNING.log:2024/05/03 15:19:04 wazuh-logcollector: WARNING: Target 'agent' message queue is full (1024). Log lines may be lost. ```

Centos

- Expected for stress test ``` ./ossec_Test_stress_B5103_centos_2024-05-06(1)/var/ossec/logs/wazuh/2024/May/ossec-05_WARNING.log:2024/05/05 00:00:18 wazuh-agentd: WARNING: Agent buffer is full: Events may be lost. ./ossec_Test_stress_B5103_centos_2024-05-06(1)/var/ossec/logs/wazuh/2024/May/ossec-05_WARNING.log:2024/05/05 00:06:40 wazuh-logcollector: WARNING: (1960): File limit has been reached (1000). Please reduce the number of files or increase "logcollector.max_files". ./ossec_Test_stress_B5103_centos_2024-05-06(1)/var/ossec/logs/wazuh/2024/May/ossec-05_WARNING.log:2024/05/05 00:21:37 wazuh-logcollector: WARNING: (1960): File limit has been reached (1000). Please reduce the number of files or increase "logcollector.max_files". ``` - Reported in https://github.com/wazuh/wazuh-jenkins/issues/4867 ``` ./ossec_Test_stress_B5103_centos_2024-05-06(1)/var/ossec/logs/wazuh/2024/May/ossec-03.log:2024/05/03 15:19:37 wazuh-agentd: ERROR: (1216): Unable to connect to '[172.31.5.44]:1514/tcp': 'Connection refused'. ```

Ubuntu

- Expected in stress test ``` ./ossec_Test_stress_B5103_ubuntu_2024-05-06(1)/var/ossec/logs/wazuh/2024/May/ossec-05.log:2024/05/05 08:38:31 wazuh-logcollector: WARNING: (1960): File limit has been reached (1000). Please reduce the number of files or increase "logcollector.max_files". ./ossec_Test_stress_B5103_ubuntu_2024-05-06(1)/var/ossec/logs/wazuh/2024/May/ossec-05.log:2024/05/05 08:38:18 wazuh-agentd: WARNING: Agent buffer is full: Events may be lost. ./ossec_Test_stress_B5103_windows_2024-05-06(1)/logs\2024\May\ossec-03.log:2024/05/03 21:21:31 wazuh-agent: WARNING: Target 'agent' message queue is full (1024). Log lines may be lost. ``` - Reported in https://github.com/wazuh/wazuh-jenkins/issues/4867 ``` ./ossec_Test_stress_B5103_ubuntu_2024-05-06(1)/var/ossec/logs/wazuh/2024/May/ossec-03_ERROR.log:2024/05/03 15:19:44 wazuh-agentd: ERROR: (1216): Unable to connect to '[172.31.5.44]:1514/tcp': 'Connection refused'. ```

Windows

- Expected in stress test ``` ./ossec_Test_stress_B5103_windows_2024-05-06(1)/logs\2024\May\ossec-05_WARNING.log:2024/05/05 00:00:51 wazuh-agent: WARNING: (1960): File limit has been reached (200). ./ossec_Test_stress_B5103_windows_2024-05-06(1)/logs\2024\May\ossec-05_WARNING.log:2024/05/05 00:00:29 wazuh-agent: WARNING: Agent buffer at 90 %. ./ossec_Test_stress_B5103_ubuntu_2024-05-06(1)/var/ossec/logs/wazuh/2024/May/ossec-05.log:2024/05/05 15:19:19 wazuh-agentd: WARNING: Agent buffer is full: Events may be lost. ./ossec_Test_stress_B5103_windows_2024-05-06(1)/logs\2024\May\ossec-03.log:2024/05/03 21:21:31 wazuh-agent: WARNING: Target 'agent' message queue is full (1024). Log lines may be lost. ``` - Reported in https://github.com/wazuh/wazuh-jenkins/issues/5287 ``` ./ossec_Test_stress_B5103_windows_2024-05-06(1)/logs\2024\May\ossec-04_ERROR.log:2024/05/04 04:16:21 wazuh-agent: ERROR: (1103): Could not open file 'C:\tmp\logcollector_test\date-2024-05-04-27-421.log' due to [(2)-(No such file or directory)]. ```

[Rebits]

Detected missing fields in some graphics. Currently researching the issue

---

Updated issue, referencing to https://github.com/wazuh/wazuh-jenkins/issues/5939 known issue

[santipadilla]

LGTM

[juliamagan]

LGTM