wazuh-packages
wazuh-packages copied to clipboard
Wazuh server show `tallylog` error message in CentOS 7
| Wazuh version | Install type | Action performed | Platform |
|---|---|---|---|
| 4.3.x | Manager/Agent | Install | CentOS 7 |
Installing the Wazuh server package in CentOS 7 I have seen an error in the installation output, this has been reproduced in 4.3.2 and 4.3.3 versions.
pam_tally2: Error opening /var/log/tallylog for update: Permission denied
pam_tally2: Authentication error
useradd: failed to reset the tallylog entry of user "wazuh"
Full output
[root@ip-172-31-23-186 centos]# yum -y install wazuh-manager
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: download.cf.centos.org
* extras: download.cf.centos.org
* updates: download.cf.centos.org
Resolving Dependencies
There are unfinished transactions remaining. You might consider running yum-complete-transaction, or "yum-complete-transaction --cleanup-only" and "yum history redo last", first to finish them. If those don't work you'll have to try removing/installing packages by hand (maybe package-cleanup can help).
--> Running transaction check
---> Package wazuh-manager.x86_64 0:4.3.2-1 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
===================================================================================================================================================================================================================
Package Arch Version Repository Size
===================================================================================================================================================================================================================
Installing:
wazuh-manager x86_64 4.3.2-1 wazuh 114 M
Transaction Summary
===================================================================================================================================================================================================================
Install 1 Package
Total size: 114 M
Installed size: 435 M
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
pam_tally2: Error opening /var/log/tallylog for update: Permission denied
pam_tally2: Authentication error
useradd: failed to reset the tallylog entry of user "wazuh"
Installing : wazuh-manager-4.3.2-1.x86_64 1/1
Verifying : wazuh-manager-4.3.2-1.x86_64 1/1
Installed:
wazuh-manager.x86_64 0:4.3.2-1
Complete!
[root@ip-172-31-23-186 centos]#
It doesn't seem to affect the performance or usability of the package. The wazuh user and group are created.
The /var/log/tallylog file shows the following content repeatedly: ^@^@^@^@^@^@^@^@^@^@^@^@^