Wazuh dashboard server is not ready yet

[wforumw]

Hi,
I have installed wazuh (v4.10.1) from scratch following https://documentation.wazuh.com/current/deployment-options/docker/wazuh-container.html#single-node-deployment in single node

I did not change anything in the docker-compose.yml

After bringing up the containers I get Wazuh dashboard server is not ready yet when I connect to the dashboard.

The logs are telling me

wazuh.manager-1    | 2025-01-17T19:01:49.120Z   WARN    [transport]     transport/tcp.go:52     DNS lookup failure "wazuh.indexer": lookup wazuh.indexer: no such host
wazuh.dashboard-1  | {"type":"log","@timestamp":"2025-01-17T19:01:50Z","tags":["error","opensearch","data"],"pid":53,"message":"[ConnectionError]: getaddrinfo ENOTFOUND wazuh.indexer"}
wazuh.dashboard-1  | {"type":"log","@timestamp":"2025-01-17T19:02:00Z","tags":["error","opensearch","data"],"pid":53,"message":"[ConnectionError]: connect ECONNREFUSED 172.18.0.2:9200"} wazuh.indexer-1 exited with code 137
wazuh.dashboard-1  | {"type":"log","@timestamp":"2025-01-17T19:02:18Z","tags":["error","opensearch","data"],"pid":53,"message":"[ConnectionError]: getaddrinfo ENOTFOUND wazuh.indexer"}
wazuh.dashboard-1  | {"type":"log","@timestamp":"2025-01-17T19:02:20Z","tags":["error","opensearch","data"],"pid":53,"message":"[ConnectionError]: getaddrinfo ENOTFOUND wazuh.indexer"}
wazuh.dashboard-1  | {"type":"log","@timestamp":"2025-01-17T19:02:23Z","tags":["error","opensearch","data"],"pid":53,"message":"[ConnectionError]: getaddrinfo ENOTFOUND wazuh.indexer"}
wazuh.dashboard-1  | {"type":"log","@timestamp":"2025-01-17T19:02:25Z","tags":["error","opensearch","data"],"pid":53,"message":"[ConnectionError]: getaddrinfo ENOTFOUND wazuh.indexer"}
wazuh.manager-1    | 2025-01-17T19:02:25.689Z   ERROR   [publisher_pipeline_output]     pipeline/output.go:154  Failed to connect to backoff(elasticsearch(https://wazuh.indexer:9200)): Get "https://wazuh.indexer:9200": lookup wazuh.indexer: no such host
wazuh.manager-1    | 2025-01-17T19:02:25.698Z   INFO    [publisher_pipeline_output]     pipeline/output.go:145  Attempting to reconnect to backoff(elasticsearch(https://wazuh.indexer:9200)) with 37 reconnect attempt(s)
wazuh.manager-1    | 2025-01-17T19:02:25.723Z   WARN    [transport]     transport/tcp.go:52     DNS lookup failure "wazuh.indexer": lookup wazuh.indexer: no such host
wazuh.dashboard-1  | {"type":"log","@timestamp":"2025-01-17T19:02:28Z","tags":["error","opensearch","data"],"pid":53,"message":"[ConnectionError]: getaddrinfo ENOTFOUND wazuh.indexer"}
wazuh.dashboard-1  | {"type":"log","@timestamp":"2025-01-17T19:02:30Z","tags":["error","opensearch","data"],"pid":53,"message":"[ConnectionError]: getaddrinfo ENOTFOUND wazuh.indexer"}
wazuh.dashboard-1  | {"type":"log","@timestamp":"2025-01-17T19:02:33Z","tags":["error","opensearch","data"],"pid":53,"message":"[ConnectionError]: getaddrinfo ENOTFOUND wazuh.indexer"}
wazuh.dashboard-1  | {"type":"log","@timestamp":"2025-01-17T19:02:35Z","tags":["error","opensearch","data"],"pid":53,"message":"[ConnectionError]: getaddrinfo ENOTFOUND wazuh.indexer"}

Do I overlook something?
Many thanks for the help

[CptChaos]

For some reason the wazuh.dashboard container, seem not to be able to reach wazuh.indexer, it doesn't find it's IP-adress. Is the name of this container correct? And is it running? :)

[wforumw]

I see that the wazuh.indexer container is trying to restart after a minute. In the wazuh.indexer logs I don't see any message why.
Is there any way to find out why the container is constantly restarting?

[CptChaos]

Check the file permissions, if the volumes exist and if the volumes that ought to be files, are no folders. These are the .pem files and they should be files, not folders. If they are folders, you need to remove them and follow the installation guide about the generation of the certificates.

[wforumw]

I reinstalled wazuh following the documentation (single mode)
FirstI removed the old volumes.

Then I cloned the latest repository
git clone https://github.com/wazuh/wazuh-docker.git -b v4.10.1

Then generated the certs
docker-compose -f generate-indexer-certs.yml run --rm generator

Checked file permissions and volumes exist

Then started the Wazuh single-node deployment
docker-compose up -d

But after about a minute the wazuh.indexer container is constantly restarting again.
`

[CptChaos]

Did you check if these:

- ./config/wazuh_indexer_ssl_certs/root-ca.pem
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem
- ./config/wazuh_indexer_ssl_certs/admin.pem
- ./config/wazuh_indexer_ssl_certs/admin-key.pem

are files and NOT folders? They are the certificates and won't get generated when they exist already as folders.

What is the container saying when you do docker logs -f wazuh.indexer after you started the container?

[wforumw]

Yes these are all files

This is the log

WARNING: A terminally deprecated method in java.lang.System has been called
WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.16.0.jar)
WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
WARNING: System::setSecurityManager will be removed in a future release
Jan 20, 2025 6:41:02 AM sun.util.locale.provider.LocaleProviderAdapter <clinit>
WARNING: COMPAT locale provider will be removed in a future release
WARNING: A terminally deprecated method in java.lang.System has been called
WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.16.0.jar)
WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
WARNING: System::setSecurityManager will be removed in a future release
[2025-01-20T06:41:05,561][INFO ][o.o.n.Node               ] [wazuh.indexer] version[2.16.0], pid[1], build[rpm/7149046c7c9c64aa43e437826af0b8b0dcabd730/2025-01-15T11:02:52.707428Z], OS[Linux/6.1.0-30-amd64/amd64], JVM[Eclipse Adoptium/OpenJDK 64-Bit Server VM/21.0.3/21.0.3+9-LTS]
[2025-01-20T06:41:05,586][INFO ][o.o.n.Node               ] [wazuh.indexer] JVM home [/usr/share/wazuh-indexer/jdk], using bundled JDK/JRE [true]
[2025-01-20T06:41:05,593][INFO ][o.o.n.Node               ] [wazuh.indexer] JVM arguments [-Xshare:auto, -Dopensearch.networkaddress.cache.ttl=60, -Dopensearch.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -XX:+ShowCodeDetailsInExceptionMessages, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.security.manager=allow, -Djava.locale.providers=SPI,COMPAT, -XX:+UseG1GC, -XX:G1ReservePercent=25, -XX:InitiatingHeapOccupancyPercent=30, -Djava.io.tmpdir=/tmp/opensearch-6556558646036262468, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=/var/lib/wazuh-indexer, -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Djava.security.manager=allow, -Djava.util.concurrent.ForkJoinPool.common.threadFactory=org.opensearch.secure_sm.SecuredForkJoinWorkerThreadFactory, -Dclk.tck=100, -Djdk.attach.allowAttachSelf=true, -Djava.security.policy=file:///usr/share/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy, --add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED, -Xms1g, -Xmx1g, -XX:MaxDirectMemorySize=536870912, -Dopensearch.path.home=/usr/share/wazuh-indexer, -Dopensearch.path.conf=/usr/share/wazuh-indexer, -Dopensearch.distribution.type=rpm, -Dopensearch.bundled_jdk=true]
[2025-01-20T06:41:06,455][WARN ][o.a.l.i.v.VectorizationProvider] [wazuh.indexer] Java vector incubator module is not readable. For optimal vector performance, pass '--add-modules jdk.incubator.vector' to enable Vector API.

And then the container restarts