Release 4.3.0 - Manual tests - Wazuh indexer - Second revision #2793
Comments
Invalid config.yml format when editing with vi editor (CRLF issue)Reported issues
Details
DescriptionTesting the usability and user experience when generating the necessary certificates for encrypted communication between components and cluster configuration. Test 🟢DescriptionIt has been downloaded the following file: Edited the DetailsConfiguration file
|
Update
|
| Issue | Description |
|---|---|
| wazuh/wazuh#12973 | Update kibana_read_only role name |
Details
| Wazuh version | Install type | Platform |
|---|---|---|
| 4.3 | Wazuh-Dashboard | CentOS 8 |
Description
The file that contains the Wazuh-Dashboard configuration /etc/wazuh-dashboard/opensearch_dashboards.yml has a variable name kibana_read_only that could create confusion.
Test 🔴
Description
Wazuh-Dashboard has been installed and it has been checked if the kibana read_only keeps remaining in the /etc/wazuh-dashboard/opensearch _dashboards.yml file.
Details
Configuration file /etc/wazuh-dashboard/opensearch_dashboards.yml
server.host: 0.0.0.0
server.port: 443
opensearch.hosts: ["https://192.168.0.14:9200", "https://192.168.0.13:9200","https://192.168.0.17:9200"]
opensearch.ssl.verificationMode: certificate
#opensearch.username:
#opensearch.password:
opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
opensearch_security.multitenancy.enabled: true
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
server.ssl.enabled: true
server.ssl.key: "/etc/wazuh-dashboard/certs/dashboard-key.pem"
server.ssl.certificate: "/etc/wazuh-dashboard/certs/dashboard.pem"
opensearch.ssl.certificateAuthorities: ["/etc/wazuh-dashboard/certs/root-ca.pem"]
uiSettings.overrides.defaultRoute: /app/wazuh?security_tenant=global
Comments
The variable name kibana_read_only still remain in RC6 but it will be solved in a future release as it says in this comment.
Permission error in
|
| Issue | Description |
|---|---|
| wazuh/wazuh-dashboard-plugins#3941 | Permission error in wazuh-dashboard logs when running for first time |
Details
| Wazuh version | Install type | Platform |
|---|---|---|
| 4.3 | Wazuh-Dashboard | CentOS 8 |
Description
After doing a clean installation of the Wazuh-Dashboard, the following error can be seen in the log /usr/share/wazuh-dashboard/data/wazuh/logs/wazuhapp.log:
ERROR Could not check if the index .wazuh exists due to no permissions for create, delete or check
Test 🔴
Description
Wazuh-Dashboard has been installed and it has been checked if the /usr/share/wazuh-dashboard/data/wazuh/logs/wazuhapp.log file.
Details
Log file /usr/share/wazuh-dashboard/data/wazuh/logs/wazuhapp.log
[root@qactl-centos-8-6 vagrant]# cat /usr/share/wazuh-dashboard/data/wazuh/logs/wazuhapp.log
{"date":"2022-04-18T22:36:30.020Z","level":"info","location":"initialize","message":"Wazuh dashboard index: .kibana"}
{"date":"2022-04-18T22:36:30.021Z","level":"info","location":"initialize","message":"App revision: 4301-1"}
{"date":"2022-04-18T22:36:30.021Z","level":"info","location":"initialize","message":"Total RAM: 970MB"}
{"date":"2022-04-18T22:36:30.308Z","level":"error","location":"initialize:checkKibanaStatus","message":"Could not check if the index .wazuh exists due to no permissions for create, delete or check"}
{"date":"2022-04-18T22:36:30.909Z","level":"error","location":"monitoring:getApiInfo","message":"connect ECONNREFUSED 127.0.0.1:55000"}
{"date":"2022-04-18T22:40:00.747Z","level":"error","location":"cron-scheduler|SaveDocument","message":"resource_already_exists_exception"}
Comments
The error messages still remain in RC6.
Infinite loop when restarting
|
| Issue | Description |
|---|---|
| wazuh/wazuh-packages#1414 | Infinite loop when restarting wazuh-indexer with configuration error |
Details
| Wazuh version | Install type | Platform |
|---|---|---|
| 4.3 | Wazuh-Indexer | CentOS 8 |
Description
While testing for the wazuh-indexer package in 4.3.0-rc6, I noticed that if you restart the wazuh-indexer service with an error in the /etc/wazuh-indexer/opensearch.yml configuration file, the process does not end up staying in an infinite loop and without showing any type of error.
Test 🔴
Description
Edit the file /etc/wazuh-indexer/opensearch.yml and set network.host to the following value
network.host: asd
Details
Result
Restart the wazuh-indexer service:
systemctl restart wazuh-indexer
Comments
The process will be stuck indefinitely in RC6 as well and the explanation why is specified here.
Request for changes on the Wazuh 4.3 installation guideReported issues
Details
DescriptionAs part of the manual tests of Wazuh 4.3 that are being performed, where the installation guide must be followed and verified, some errors were detected. Part of the errors found are related to the description of the steps that are needed to be followed to perform the installation and others appeared when trying to execute the installation commands. Test 🟢DescriptionIt has been performance the step-by-step installation guide without any problem DetailsResultInstallation clean and completed succesfully CommentsThe step-by-step installation guide now it complete and well described steps in |
Fix the yml format of the
|
| Issue | Description |
|---|---|
| wazuh/wazuh-packages#1413 | Fix the yml format of the config.yml file to generate the certificates |
Details
| Wazuh version | Install type | Platform |
|---|---|---|
| 4.3 | Wazuh-Indexer | CentOS 8 |
Description
The content of the config.yml file does not comply with the actual yaml syntax.
Test 🟢
Description
It has been checked the content of config.yml file to check if the syntax complies with the actual yaml syntax.
Details
Result
nodes:
# Wazuh indexer nodes
indexer:
- name: node-1
ip: 192.168.0.14
- name: node-2
ip: 192.168.0.13
- name: node-3
ip: 192.168.0.17
# Wazuh server nodes
# Use node_type only with more than one Wazuh manager
server:
- name: wazuh-1
ip: 192.168.0.19
node_type: master
- name: wazuh-2
ip: 192.168.0.20
node_type: worker
# Wazuh dashboard nodes
dashboard:
- name: dashboard
ip: 192.168.0.18
Comments
The content of the config.yml file now is what is expected in a yaml file in RC6.
Warnings messages when checking Wazuh-Indexer statusReported issues
Details
DescriptionChecking the status of Test 🔴DescriptionTo get WARNINGS messages the following command has been executed: DetailsResultCommentsThe WARNINGS messages remain in the status and in the documentation does not say anything about it in |
Indices from wazuh-indexer are not created when reinstalling the indexer with yumReported issues
Details
DescriptionWhen we reinstall the component with yum, the alerts are not indexed anymore until we restart the services Test 🔴DescriptionAfter reinstalling the component It is needed to restart the related services so the indices are indexed again. DetailsResultWhen installing the indexer all seems good. Then, we uninstall it. When reinstalling the component, the alerts indices are not indexed . When restarting the services, the alerts show up. |
Request for changes on the Wazuh 4.3 installation guideReported issues
Details
DescriptionAs part of the manual tests of Wazuh 4.3 that are being performed, where the installation guide must be followed and verified, some suggestions were provided. This was discussed with the team and we are not adding steps for removal recomendations in our guides. Test 🟢 |
Missing information in the documentation when configuring
|
| Issue | Description |
|---|---|
| wazuh/wazuh-documentation#5008 | Suggestions to add to the wazuh-indexer documentation |
Details
| Wazuh version | Install type | Platform |
|---|---|---|
| 4.3 | Wazuh-Indexer | CentOS 8 |
Description
The /etc/wazuh-indexer/opensearch.yml file has some fields that are not well commented and some others fields that are not commented.
Test 🟢
Description
The requested information was added in this release.
Details
Result
In the following link, the missing information was added.
Comments
This issue was solved in RC6.
Infinite loop when running
|
| Issue | Description |
|---|---|
| wazuh/wazuh-packages#1885 | Infinite loop when running indexer-security-init.sh |
Details
| Wazuh version | Install type | Platform |
|---|---|---|
| 4.3 | Wazuh-Indexer | CentOS 8 |
Description
When trying to execute the indexer-security-init.sh script and getting an error (probably due to configuration or bad certificates), the wazuh-indexer remains in an infinite loop executing indexer-security-init.sh all the time, leaving the terminal unusable.
Test 🔴
Description
To achieve this problem, I installed 2 wazuh-indexer following the documentation of this link and I loaded bad certs to one of the nodes and then run the command in both nodes:
indexer-security-init.sh
Details
Result
[root@qactl-centos-8-8 vagrant]# /usr/share/wazuh-indexer/bin/indexer-security-init.sh
Security Admin v7
Will connect to 192.168.0.18:9300 ... done
Connected as CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US
OpenSearch Version: 1.2.4
OpenSearch Security Version: 1.2.4.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Cannot retrieve cluster state due to: null. This is not an error, will keep on trying ...
Root cause: MasterNotDiscoveredException[null] (org.opensearch.discovery.MasterNotDiscoveredException/org.opensearch.discovery.MasterNotDiscoveredException)
* Try running securityadmin.sh with -icl (but no -cl) and -nhnv (If that works you need to check your clustername as well as hostnames in your TLS certificates)
* Make sure that your keystore or PEM certificate is a client certificate (not a node certificate) and configured properly in opensearch.yml
* If this is not working, try running securityadmin.sh with --diagnose and see diagnose trace log file)
* Add --accept-red-cluster to allow securityadmin to operate on a red cluster.
Comments
This problem remains in RC6 and the explanation why is here.
After wazuh/wazuh#12901 testing some issues were reported. With the creation of a new release candidate is required to evaluate the current status of those anomalous behaviors and perform a report with the global status.
Test information
Test description
Environment to be deployed and configured
Test report procedure
Reported issues to review
opensearch.yamlymlformat of theconfig.ymlfile to generate the certificateswazuh-indexerservice remains blocked indefinitely.wazuh-indexerconfusing for the user. Mention in documentationindexer-security-init.shconfig.yml format when editing with vieditor (CRLF issue)kibana_read_onlyrole namewazuh-dashboardlogs when running for first timewazuh-indexerdocumentationThe text was updated successfully, but these errors were encountered: