Release 4.9.0 - RC 2 - Footprint Metrics - ALL-EXCEPT-LOGCOLLECTOR (2.5d)

[wazuhci]

Footprint metrics information

Main release stage issue #	#25475
Main footprint metrics issue #	#25488
Version	4.9.0
Release stage #	RC 2
Tag	https://github.com/wazuh/wazuh/tree/v4.9.0-rc2

Stress test documentation

Packages used

• Repository: packages-dev.wazuh.com

• Package path: pre-release

• Package revision: 1

• Jenkins build: https://ci.wazuh.info/job/Test_stress/5577/

---

Manager

+

Plots

                  

• Logs and configuration

  [ossec_Test_stress_B5577_manager_2024-09-02.zip](https://ci.wazuh.com/data/Test_stress/pre-release/4.9.0/B5577-3600m/B5577_manager_centos/logs/ossec_Test_stress_B5577_manager_2024-09-02.zip)
• CSV

  [monitor-manager-Test_stress_B5577_manager-pre-release.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.9.0/B5577-3600m/B5577_manager_centos/data/monitor-manager-Test_stress_B5577_manager-pre-release.csv) [Test_stress_B5577_manager_analysisd_events.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.9.0/B5577-3600m/B5577_manager_centos/data/Test_stress_B5577_manager_analysisd_events.csv) [Test_stress_B5577_manager_analysisd_state.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.9.0/B5577-3600m/B5577_manager_centos/data/Test_stress_B5577_manager_analysisd_state.csv) [Test_stress_B5577_manager_remoted_state.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.9.0/B5577-3600m/B5577_manager_centos/data/Test_stress_B5577_manager_remoted_state.csv)

Centos agent

+

Plots

                

• Logs and configuration

  [ossec_Test_stress_B5577_centos_2024-09-02.zip](https://ci.wazuh.com/data/Test_stress/pre-release/4.9.0/B5577-3600m/B5577_agent_centos/logs/ossec_Test_stress_B5577_centos_2024-09-02.zip)
• CSV

  [monitor-agent-Test_stress_B5577_centos-pre-release.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.9.0/B5577-3600m/B5577_agent_centos/data/monitor-agent-Test_stress_B5577_centos-pre-release.csv) [Test_stress_B5577_centos_agentd_state.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.9.0/B5577-3600m/B5577_agent_centos/data/Test_stress_B5577_centos_agentd_state.csv)

Ubuntu agent

+

Plots

                

• Logs and configuration

  [ossec_Test_stress_B5577_ubuntu_2024-09-02.zip](https://ci.wazuh.com/data/Test_stress/pre-release/4.9.0/B5577-3600m/B5577_agent_ubuntu/logs/ossec_Test_stress_B5577_ubuntu_2024-09-02.zip)
• CSV

  [monitor-agent-Test_stress_B5577_ubuntu-pre-release.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.9.0/B5577-3600m/B5577_agent_ubuntu/data/monitor-agent-Test_stress_B5577_ubuntu-pre-release.csv) [Test_stress_B5577_ubuntu_agentd_state.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.9.0/B5577-3600m/B5577_agent_ubuntu/data/Test_stress_B5577_ubuntu_agentd_state.csv)

Windows agent

+

Plots

              

• Logs and configuration

  [ossec_Test_stress_B5577_windows_2024-09-02.zip](https://ci.wazuh.com/data/Test_stress/pre-release/4.9.0/B5577-3600m/B5577_agent_windows/logs/ossec_Test_stress_B5577_windows_2024-09-02.zip)
• CSV

  [monitor-winagent-Test_stress_B5577_windows-pre-release.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.9.0/B5577-3600m/B5577_agent_windows/data/monitor-winagent-Test_stress_B5577_windows-pre-release.csv) [Test_stress_B5577_windows_agentd_state.csv](https://ci.wazuh.com/data/Test_stress/pre-release/4.9.0/B5577-3600m/B5577_agent_windows/data/Test_stress_B5577_windows_agentd_state.csv)

macOS agent

+

Plots

• Logs and configuration
• CSV

Solaris agent

+

Plots

• Logs and configuration
• CSV

Conclusion :yellow_circle:

Plots :green_circle:

Logs :yellow_circle:

Known issues:

• https://github.com/wazuh/wazuh-jenkins/issues/4867
• https://github.com/wazuh/wazuh/issues/22565
• https://github.com/wazuh/wazuh-jenkins/issues/5287
• https://github.com/wazuh/wazuh-jenkins/issues/4469
• https://github.com/wazuh/wazuh/issues/12074
• https://github.com/wazuh/wazuh/issues/18995

[pro-akim]

Analysis report

Graphs :green_circle:

Compared to: https://github.com/wazuh/wazuh/issues/24472

Manager

Disk: increase of the peak size of modulesd Read_Ops: decrease of modulesd

Windows

No abnormalities were found

Centos

Disk: increase of the peak size of modulesd Disk_read: increase of modulesd VMS: increase of logcollector

Ubuntu

Disk: decrease of size of syscheckd peak size Disk_written: decrease of modulesd

Logs :yellow_circle:

Manager

- Expected in stress test ``` 2024/08/31 01:57:14 sca WARNING: Interval overtaken. 2024/08/31 07:58:52 wazuh-syscheckd WARNING: Real-time inotify kernel queue is full. Some events may be lost. Next scheduled scan will recover lost data. 2024/08/31 01:56:09 wazuh-logcollector WARNING: Target 'agent' message queue is full (1024). Log lines may be lost. 2024/08/31 01:57:29 wazuh-remoted WARNING: Message queue is full (10). Events may be lost. 2024/08/31 08:00:19 wazuh-analysisd WARNING: Syscheck decoder queue is full. 2024/08/31 11:58:34 wazuh-db WARNING: After vacuum, the database '003' has become just as fragmented or worse 2024/08/31 01:54:03 wazuh-analysisd WARNING: Security Configuration Assessment decoder queue is full. ``` - Reported: https://github.com/wazuh/wazuh/issues/22565 - Kwnon issue ``` 2024/08/31 01:54:03 indexer-connector WARNING: No username and password found in the keystore, using default values. 2024/08/31 01:54:03 indexer-connector WARNING: IndexerConnector initialization failed for index 'wazuh-states-vulnerabilities-ip-172-31-10-55.ec2.internal', retrying until the connection is successful. ``` - Reported: https://github.com/wazuh/wazuh-jenkins/issues/4867 - Known issue ``` 2024/08/31 01:56:48 wazuh-remoted WARNING: Agent key already in use: agent ID '001' ``` - Reported: https://github.com/wazuh/wazuh-jenkins/issues/4469 - Known issue ``` 2024/08/31 01:57:04 wazuh-modulesd:ciscat WARNING: No evals defined. Exiting... ```

Windows

- Reported: https://github.com/wazuh/wazuh-jenkins/issues/4867 - Known issue ``` 2024/08/31 01:56:59 wazuh-agent ERROR: (1216): Unable to connect to '[172.31.10.55]:1514/tcp': 'No connection could be made because the target machine actively refused it.'. ``` - Reported: https://github.com/wazuh/wazuh-jenkins/issues/4469 - Known issue ``` 2024/08/31 01:57:15 wazuh-modulesd:ciscat ERROR: Report result file 'tmp\ciscat-report.txt' missing: No such file or directory 2024/08/31 01:57:15 wazuh-modulesd:ciscat ERROR: Failed reading scan results for policy 'C:\cis-cat\benchmarks\CIS_Microsoft_Windows_Server_2016_Benchmark_v1.0.0-xccdf.xml' 2024/08/31 04:32:48 wazuh-modulesd:ciscat WARNING: Interval overtaken. ``` - Reported: https://github.com/wazuh/wazuh-jenkins/issues/5287 - Known issue ``` 2024/08/31 08:07:40 wazuh-agent ERROR: (6716): Could not open handle for 'c:\tmp\syscheck_test\files\fimstress.66250'. Error code: 2 ``` - Reported: https://github.com/wazuh/wazuh/issues/12074 - Known issue ``` 2024/09/02 01:58:00 wazuh-agent ERROR: (6613): Real time Windows callback process: 'Access is denied.' (5). [2024-08-31_12:00:22] [ERROR] (create_delete): files\fimStress.1665136 file cannot be deleted. ``` - Expected in stress test ``` 2024/08/31 02:03:12 sca WARNING: Interval overtaken. 2024/08/31 07:58:14 wazuh-agent WARNING: (6906): Real time process: no data. Probably buffer overflow. 2024/09/01 07:58:42 wazuh-agent WARNING: Agent buffer at 90 %. ``` - Reported: https://github.com/wazuh/wazuh/issues/18995 - Known issue ``` 2024/08/31 08:00:25 wazuh-agent WARNING: (6922): Cannot open 'c:\tmp\syscheck_test\directories\dir3952': No such file or directory 2024/08/31 08:07:40 wazuh-agent WARNING: At get_user(c:\tmp\syscheck_test\files\fimstress.66250): CreateFile(): The system cannot find the file specified. (2) ```

Centos

- Reported: https://github.com/wazuh/wazuh-jenkins/issues/4469 - Known issue ``` 2024/08/31 01:57:43 wazuh-modulesd:ciscat ERROR: Report result file 'tmp/ciscat-report.txt' missing: No such file or directory 2024/08/31 01:57:43 wazuh-modulesd:ciscat ERROR: Failed reading scan results for policy '/var/ossec/wodles/cis-cat/benchmarks/CIS_Google_Chrome_Benchmark_v1.2.0-xccdf.xml' 2024/08/31 01:57:43 wazuh-modulesd:ciscat ERROR: Unable to open 'tmp/ciscat-report.xml': No such file or directory ``` - Reported: https://github.com/wazuh/wazuh-jenkins/issues/4867 - Known issue ``` 2024/08/31 01:56:49 wazuh-agentd ERROR: (1137): Lost connection with manager. Setting lock. 2024/08/31 01:56:49 wazuh-agentd ERROR: (1216): Unable to connect to '[172.31.10.55]:1514/tcp': 'Connection refused'. ``` - Expected in stress test ``` 2024/08/31 07:58:37 wazuh-syscheckd WARNING: Real-time inotify kernel queue is full. Some events may be lost. Next scheduled scan will recover lost data. 2024/08/31 08:01:32 sca WARNING: Interval overtaken. 2024/08/31 01:56:50 wazuh-modulesd WARNING: Process locked due to agent is offline. Waiting for connection... ```

Ubuntu

- Reported: https://github.com/wazuh/wazuh-jenkins/issues/4469 - Known issue ``` 2024/08/31 01:56:39 wazuh-modulesd:ciscat ERROR: CIS-CAT tool not found at '/var/ossec/wodles/cis-cat'. ``` - Reported: https://github.com/wazuh/wazuh-jenkins/issues/4867 - Known issue ``` 2024/08/31 01:56:56 wazuh-agentd ERROR: (1216): Unable to connect to '[172.31.10.55]:1514/tcp': 'Connection refused'. ``` - Expected in stress test ``` 2024/08/31 07:58:52 wazuh-syscheckd WARNING: Real-time inotify kernel queue is full. Some events may be lost. Next scheduled scan will recover lost data. 2024/08/31 01:57:24 sca WARNING: Interval overtaken. ``` - Reported: https://github.com/wazuh/wazuh-jenkins/issues/5287 - Known issue ``` 2024/08/31 11:42:19 wazuh-syscheckd WARNING: (6922): Cannot open '/tmp/syscheck_test/directories/dir4289': No such file or directory ```

[MARCOSD4]

LGTM