wazuh-packages icon indicating copy to clipboard operation
wazuh-packages copied to clipboard

Wazuh server show `tallylog` error message in CentOS 7

Open rauldpm opened this issue 3 years ago • 0 comments

Wazuh version Install type Action performed Platform
4.3.x Manager/Agent Install CentOS 7

Installing the Wazuh server package in CentOS 7 I have seen an error in the installation output, this has been reproduced in 4.3.2 and 4.3.3 versions.

pam_tally2: Error opening /var/log/tallylog for update: Permission denied
pam_tally2: Authentication error
useradd: failed to reset the tallylog entry of user "wazuh"
Full output
[root@ip-172-31-23-186 centos]# yum -y install wazuh-manager
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: download.cf.centos.org
 * extras: download.cf.centos.org
 * updates: download.cf.centos.org
Resolving Dependencies
There are unfinished transactions remaining. You might consider running yum-complete-transaction, or "yum-complete-transaction --cleanup-only" and "yum history redo last", first to finish them. If those don't work you'll have to try removing/installing packages by hand (maybe package-cleanup can help).
--> Running transaction check
---> Package wazuh-manager.x86_64 0:4.3.2-1 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

===================================================================================================================================================================================================================
 Package                                                 Arch                                             Version                                            Repository                                       Size
===================================================================================================================================================================================================================
Installing:
 wazuh-manager                                           x86_64                                           4.3.2-1                                            wazuh                                           114 M

Transaction Summary
===================================================================================================================================================================================================================
Install  1 Package

Total size: 114 M
Installed size: 435 M
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
pam_tally2: Error opening /var/log/tallylog for update: Permission denied
pam_tally2: Authentication error
useradd: failed to reset the tallylog entry of user "wazuh"
  Installing : wazuh-manager-4.3.2-1.x86_64                                                                                                                                                                    1/1 
  Verifying  : wazuh-manager-4.3.2-1.x86_64                                                                                                                                                                    1/1 

Installed:
  wazuh-manager.x86_64 0:4.3.2-1                                                                                                                                                                                   

Complete!
[root@ip-172-31-23-186 centos]#

It doesn't seem to affect the performance or usability of the package. The wazuh user and group are created.

The /var/log/tallylog file shows the following content repeatedly: ^@^@^@^@^@^@^@^@^@^@^@^@^

rauldpm avatar May 31 '22 17:05 rauldpm