False negative in Installation Assistant when removing packages - RPM

[davidcr01]

Wazuh version	Install type	Action performed	Platform
4.8.0	Any	Remove	RPM-based system

Description

Working on https://github.com/wazuh/wazuh-automation/issues/1485, I have noticed that there is a warning message generated in the RPM-based system when removing the Wazuh installation.

[root@amazonlinux21 vagrant]# bash wazuh-install.sh -u -v
02/04/2024 10:28:37 DEBUG: Checking root permissions.
02/04/2024 10:28:37 DEBUG: Checking sudo package.
02/04/2024 10:28:37 INFO: Starting Wazuh installation assistant. Wazuh version: 4.8.0
02/04/2024 10:28:37 INFO: Verbose logging redirected to /var/log/wazuh-install.log
02/04/2024 10:28:37 DEBUG: YUM package manager will be used.
02/04/2024 10:28:37 DEBUG: Checking system distribution.
02/04/2024 10:28:37 DEBUG: Detected distribution name: rhel
02/04/2024 10:28:37 DEBUG: Detected distribution version: 9
02/04/2024 10:28:37 DEBUG: Checking Wazuh installation.
02/04/2024 10:28:37 DEBUG: There are Wazuh remaining files.
02/04/2024 10:28:37 DEBUG: There are Wazuh indexer remaining files.
02/04/2024 10:28:37 DEBUG: There are Filebeat remaining files.
02/04/2024 10:28:37 DEBUG: There are Wazuh dashboard remaining files.
02/04/2024 10:28:37 INFO: Removing Wazuh manager.
Updating Subscription Management repositories.
Unable to read consumer identity

This system is not registered with an entitlement server. You can use subscription-manager to register.

Dependencies resolved.
================================================================================
 Package                Architecture    Version           Repository       Size
================================================================================
Removing:
 wazuh-manager          x86_64          4.8.0-1           @wazuh          879 M

Transaction Summary
================================================================================
Remove  1 Package

Freed space: 879 M
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Running scriptlet: wazuh-manager-4.8.0-1.x86_64                           1/1 
  Erasing          : wazuh-manager-4.8.0-1.x86_64                           1/1 
warning: file /var/ossec/tmp/vd_1.0.0_vd_4.8.0.tar.xz: remove failed: No such file or directory
warning: /var/ossec/etc/ossec.conf saved as /var/ossec/etc/ossec.conf.rpmsave

  Running scriptlet: wazuh-manager-4.8.0-1.x86_64                           1/1 
  Verifying        : wazuh-manager-4.8.0-1.x86_64                           1/1 
Installed products updated.

Removed:
  wazuh-manager-4.8.0-1.x86_64                                                  

Complete!
02/04/2024 10:29:18 INFO: Wazuh manager removed.
02/04/2024 10:29:18 INFO: Removing Wazuh indexer.
Updating Subscription Management repositories.
Unable to read consumer identity

This system is not registered with an entitlement server. You can use subscription-manager to register.

Dependencies resolved.
================================================================================
 Package                Architecture    Version           Repository       Size
================================================================================
Removing:
 wazuh-indexer          x86_64          4.8.0-1           @wazuh          1.0 G

Transaction Summary
================================================================================
Remove  1 Package

Freed space: 1.0 G
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Running scriptlet: wazuh-indexer-4.8.0-1.x86_64                           1/1 
Stopping wazuh-indexer service... OK

  Erasing          : wazuh-indexer-4.8.0-1.x86_64                           1/1 
warning: /etc/wazuh-indexer/opensearch.yml saved as /etc/wazuh-indexer/opensearch.yml.rpmsave
warning: /etc/wazuh-indexer/opensearch-security/internal_users.yml saved as /etc/wazuh-indexer/opensearch-security/internal_users.yml.rpmsave
warning: /etc/wazuh-indexer/jvm.options saved as /etc/wazuh-indexer/jvm.options.rpmsave

  Running scriptlet: wazuh-indexer-4.8.0-1.x86_64                           1/1 
  Verifying        : wazuh-indexer-4.8.0-1.x86_64                           1/1 
Installed products updated.

Removed:
  wazuh-indexer-4.8.0-1.x86_64                                                  

Complete!
02/04/2024 10:29:21 WARNING: The Wazuh indexer package could not be removed.
02/04/2024 10:29:21 INFO: Removing Filebeat.
Updating Subscription Management repositories.
Unable to read consumer identity

This system is not registered with an entitlement server. You can use subscription-manager to register.

Dependencies resolved.
================================================================================
 Package            Architecture     Version             Repository        Size
================================================================================
Removing:
 filebeat           x86_64           7.10.2-1            @wazuh            70 M

Transaction Summary
================================================================================
Remove  1 Package

Freed space: 70 M
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Erasing          : filebeat-7.10.2-1.x86_64                               1/1 
warning: /etc/filebeat/filebeat.yml saved as /etc/filebeat/filebeat.yml.rpmsave

  Running scriptlet: filebeat-7.10.2-1.x86_64                               1/1 
  Verifying        : filebeat-7.10.2-1.x86_64                               1/1 
Installed products updated.

Removed:
  filebeat-7.10.2-1.x86_64                                                      

Complete!
02/04/2024 10:29:23 WARNING: The Filebeat package could not be removed.
02/04/2024 10:29:23 INFO: Removing Wazuh dashboard.
Updating Subscription Management repositories.
Unable to read consumer identity

This system is not registered with an entitlement server. You can use subscription-manager to register.

Dependencies resolved.
================================================================================
 Package                 Architecture   Version            Repository      Size
================================================================================
Removing:
 wazuh-dashboard         x86_64         4.8.0-1            @wazuh         902 M

Transaction Summary
==================
==============================================================
Remove  1 Package

Freed space: 902 M
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Running scriptlet: wazuh-dashboard-4.8.0-1.x86_64                         1/1 
Stopping wazuh-dashboard service...
  Erasing          : wazuh-dashboard-4.8.0-1.x86_64                         1/1 
warning: /etc/wazuh-dashboard/opensearch_dashboards.yml saved as /etc/wazuh-dashboard/opensearch_dashboards.yml.rpmsave

  Running scriptlet: wazuh-dashboard-4.8.0-1.x86_64                         1/1 
  Verifying        : wazuh-dashboard-4.8.0-1.x86_64                         1/1 
Installed products updated.

Removed:
  wazuh-dashboard-4.8.0-1.x86_64                                                

Complete!
02/04/2024 10:29:37 WARNING: The Wazuh dashboard package could not be removed.
02/04/2024 10:29:37 DEBUG: Removing GPG key from system.

Notice that the packages are removed but the Installation assistant warns that they could not be removed:

02/04/2024 10:29:23 INFO: Removing Wazuh dashboard.
Updating Subscription Management repositories.
Unable to read consumer identity

This system is not registered with an entitlement server. You can use subscription-manager to register.

Dependencies resolved.
================================================================================
 Package                 Architecture   Version            Repository      Size
================================================================================
Removing:
 wazuh-dashboard         x86_64         4.8.0-1            @wazuh         902 M

Transaction Summary
==================
==============================================================
Remove  1 Package

Freed space: 902 M
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Running scriptlet: wazuh-dashboard-4.8.0-1.x86_64                         1/1 
Stopping wazuh-dashboard service...
  Erasing          : wazuh-dashboard-4.8.0-1.x86_64                         1/1 
warning: /etc/wazuh-dashboard/opensearch_dashboards.yml saved as /etc/wazuh-dashboard/opensearch_dashboards.yml.rpmsave

  Running scriptlet: wazuh-dashboard-4.8.0-1.x86_64                         1/1 
  Verifying        : wazuh-dashboard-4.8.0-1.x86_64                         1/1 
Installed products updated.

Removed:
  wazuh-dashboard-4.8.0-1.x86_64                                                

Complete!
02/04/2024 10:29:37 WARNING: The Wazuh dashboard package could not be removed.

This happens only in RPM-based systems, as investigated in the mentioned issue. And it happens with every removed component.

Tasks

• [ ] Investigate the cause of the issue.
• [ ] Fix it.
• [ ] Validate it (the package is removed and the message confirms it)