wazuh-packages
wazuh-packages copied to clipboard
Published
20 hours ago •
wazuh
wazuh
Installation assistant fails to remove wazuh component upon lack of space error
| Wazuh version | Install type | Action performed | Platform |
|---|---|---|---|
| 4.8.0-beta5 | Wazuh installation assistant | Install | Ubuntu 22 |
Description
It has been detected that in case of failing the installation of the wazuh-dashboard due to lack of space in the system, the wazuh component previously installed are not removed correctly
Steps to reproduce
- Deploy an instance with not enough disk space for AIO installation
- Download assistance and install all component in the instance:
curl -sO https://packages-dev.wazuh.com/4.8/wazuh-install.sh && sudo bash ./wazuh-install.sh -a - After failure check that wazuh-manager and wazuh-indexer are installed
root@ip-172-31-44-9:/home/ubuntu# apt list --installed | grep wazuh-manager
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
wazuh-manager/now 4.8.0-1 amd64 [installed,local]
root@ip-172-31-44-9:/home/ubuntu# apt list --installed | grep wazuh-indexer
wazuh-indexer/now 4.8.0-1 amd64 [installed,local]
- Check that the uninstall process removes configuration files
root@ip-172-31-44-9:/home/ubuntu# ls /var/ossec
ls: cannot access '/var/ossec': No such file or directory
root@ip-172-31-44-9:/home/ubuntu# ls /etc | grep wazuh
Evidence
Installation log
- First installation
root@ip-172-31-44-9:/home/ubuntu# curl -sO https://packages-dev.wazuh.com/4.8/wazuh-install.sh && sudo bash ./wazuh-install.sh -a
12/04/2024 08:46:28 INFO: Starting Wazuh installation assistant. Wazuh version: 4.8.0
12/04/2024 08:46:28 INFO: Verbose logging redirected to /var/log/wazuh-install.log
12/04/2024 08:46:38 INFO: Verifying that your system meets the recommended minimum hardware requirements.
12/04/2024 08:46:38 INFO: Wazuh web interface port will be 443.
12/04/2024 08:46:44 INFO: --- Dependencies ----
12/04/2024 08:46:44 INFO: Installing apt-transport-https.
12/04/2024 08:46:54 INFO: Wazuh development repository added.
12/04/2024 08:46:54 INFO: --- Configuration files ---
12/04/2024 08:46:54 INFO: Generating configuration files.
12/04/2024 08:46:54 INFO: Generating the root certificate.
12/04/2024 08:46:54 INFO: Generating Admin certificates.
12/04/2024 08:46:55 INFO: Generating Wazuh indexer certificates.
12/04/2024 08:46:56 INFO: Generating Filebeat certificates.
12/04/2024 08:46:56 INFO: Generating Wazuh dashboard certificates.
12/04/2024 08:46:57 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
12/04/2024 08:46:57 INFO: --- Wazuh indexer ---
12/04/2024 08:46:57 INFO: Starting Wazuh indexer installation.
12/04/2024 08:48:36 INFO: Wazuh indexer installation finished.
12/04/2024 08:48:36 INFO: Wazuh indexer post-install configuration finished.
12/04/2024 08:48:36 INFO: Starting service wazuh-indexer.
12/04/2024 08:49:01 INFO: wazuh-indexer service started.
12/04/2024 08:49:01 INFO: Initializing Wazuh indexer cluster security settings.
12/04/2024 08:49:12 INFO: Wazuh indexer cluster security configuration initialized.
12/04/2024 08:49:12 INFO: Wazuh indexer cluster initialized.
12/04/2024 08:49:12 INFO: --- Wazuh server ---
12/04/2024 08:49:12 INFO: Starting the Wazuh manager installation.
12/04/2024 08:50:46 INFO: Wazuh manager installation finished.
12/04/2024 08:50:46 INFO: Wazuh manager vulnerability detection configuration finished.
12/04/2024 08:50:46 INFO: Starting service wazuh-manager.
12/04/2024 08:51:07 INFO: wazuh-manager service started.
12/04/2024 08:51:07 INFO: Starting Filebeat installation.
12/04/2024 08:51:22 INFO: Filebeat installation finished.
12/04/2024 08:51:24 INFO: Filebeat post-install configuration finished.
12/04/2024 08:51:24 INFO: Starting service filebeat.
12/04/2024 08:51:26 INFO: filebeat service started.
12/04/2024 08:51:26 INFO: --- Wazuh dashboard ---
12/04/2024 08:51:26 INFO: Starting Wazuh dashboard installation.
12/04/2024 08:51:36 ERROR: Wazuh dashboard installation failed.
12/04/2024 08:51:36 INFO: --- Removing existing Wazuh installation ---
12/04/2024 08:51:39 INFO: Installation cleaned. Check the /var/log/wazuh-install.log file to learn more about the issue.
/var/log/wazuh-install.log
root@ip-172-31-44-9:/home/ubuntu# cat /var/log/wazuh-install.log^C
root@ip-172-31-44-9:/home/ubuntu# cat /var/log/wazuh-install.log
12/04/2024 08:46:28 INFO: Starting Wazuh installation assistant. Wazuh version: 4.8.0
12/04/2024 08:46:28 INFO: Verbose logging redirected to /var/log/wazuh-install.log
Hit:1 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy InRelease
Hit:2 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy-updates InRelease
Hit:3 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy-backports InRelease
Hit:4 http://security.ubuntu.com/ubuntu jammy-security InRelease
Reading package lists...
12/04/2024 08:46:38 INFO: Verifying that your system meets the recommended minimum hardware requirements.
12/04/2024 08:46:38 INFO: Wazuh web interface port will be 443.
Hit:1 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy InRelease
Hit:2 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy-updates InRelease
Hit:3 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy-backports InRelease
Hit:4 http://security.ubuntu.com/ubuntu jammy-security InRelease
Reading package lists...
12/04/2024 08:46:44 INFO: --- Dependencies ----
12/04/2024 08:46:44 INFO: Installing apt-transport-https.
Reading package lists... Building dependency tree... Reading state information... The following NEW packages will be installed: apt-transport-https 0 upgraded, 1 newly installed, 0 to remove and 43 not upgraded. Need to get 1,510 B of archives. After this operation, 170 kB of additional disk space will be used. Get:1 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy-updates/ NEEDRESTART-VER: 3.5 NEEDRESTART-KCUR: 6.5.0-1014-aws NEEDRESTART-KEXP: 6.5.0-1014-aws NEEDRESTART-KSTA: 1sly unselected package apt-transport-https.
gpg: keyring '/usr/share/keyrings/wazuh.gpg' created
gpg: directory '/root/.gnupg' created
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key 96B3EE5F29111145: public key "Wazuh.com (Wazuh Signing Key) <[email protected]>" imported
gpg: Total number processed: 1
gpg: imported: 1
deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages-dev.wazuh.com/pre-release/apt/ unstable main
Hit:1 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy InRelease
Hit:2 http://security.ubuntu.com/ubuntu jammy-security InRelease
Hit:3 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy-updates InRelease
Hit:4 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy-backports InRelease
Get:5 https://packages-dev.wazuh.com/pre-release/apt unstable InRelease [17.3 kB]
Get:6 https://packages-dev.wazuh.com/pre-release/apt unstable/main amd64 Packages [37.1 kB]
Fetched 54.4 kB in 1s (41.8 kB/s)
Reading package lists...
12/04/2024 08:46:54 INFO: Wazuh development repository added.
12/04/2024 08:46:54 INFO: --- Configuration files ---
12/04/2024 08:46:54 INFO: Generating configuration files.
12/04/2024 08:46:54 INFO: Generating the root certificate.
12/04/2024 08:46:54 INFO: Generating Admin certificates.
12/04/2024 08:46:55 INFO: Generating Wazuh indexer certificates.
12/04/2024 08:46:56 INFO: Generating Filebeat certificates.
12/04/2024 08:46:56 INFO: Generating Wazuh dashboard certificates.
12/04/2024 08:46:57 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
12/04/2024 08:46:57 INFO: --- Wazuh indexer ---
12/04/2024 08:46:57 INFO: Starting Wazuh indexer installation.
Reading package lists... Building dependency tree... Reading state information... The following NEW packages will be installed: wazuh-indexer 0 upgraded, 1 newly installed, 0 to remove and 43 not upgraded. Need to get 757 MB of archives. After this operation, 1,050 MB of additional disk space will be used. Get:1 https://packages-dev.wazuh.com/pre-release/apt unstable/main amd64 NEEDRESTART-VER: 3.5 NEEDRESTART-KCUR: 6.5.0-1014-aws NEEDRESTART-KEXP: 6.5.0-1014-aws NEEDRESTART-KSTA: 1kage wazuh-indexer.
12/04/2024 08:48:36 INFO: Wazuh indexer installation finished.
12/04/2024 08:48:36 INFO: Wazuh indexer post-install configuration finished.
12/04/2024 08:48:36 INFO: Starting service wazuh-indexer.
Created symlink /etc/systemd/system/multi-user.target.wants/wazuh-indexer.service → /lib/systemd/system/wazuh-indexer.service.
12/04/2024 08:49:01 INFO: wazuh-indexer service started.
12/04/2024 08:49:01 INFO: Initializing Wazuh indexer cluster security settings.
**************************************************************************
** This tool will be deprecated in the next major release of OpenSearch **
** https://github.com/opensearch-project/security/issues/1755 **
**************************************************************************
Security Admin v7
Will connect to 127.0.0.1:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.10.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
Populate config from /etc/wazuh-indexer/opensearch-security/
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml
SUCC: Configuration for 'config' created or updated
Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml
SUCC: Configuration for 'roles' created or updated
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml
SUCC: Configuration for 'rolesmapping' created or updated
Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml
SUCC: Configuration for 'internalusers' created or updated
Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml
SUCC: Configuration for 'actiongroups' created or updated
Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml
SUCC: Configuration for 'tenants' created or updated
Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml
SUCC: Configuration for 'nodesdn' created or updated
Will update '/whitelist' with /etc/wazuh-indexer/opensearch-security/whitelist.yml
SUCC: Configuration for 'whitelist' created or updated
Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml
SUCC: Configuration for 'audit' created or updated
Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml
SUCC: Configuration for 'allowlist' created or updated
SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"]) due to: null
Done with success
12/04/2024 08:49:12 INFO: Wazuh indexer cluster security configuration initialized.
12/04/2024 08:49:12 INFO: Wazuh indexer cluster initialized.
12/04/2024 08:49:12 INFO: --- Wazuh server ---
12/04/2024 08:49:12 INFO: Starting the Wazuh manager installation.
Reading package lists... Building dependency tree... Reading state information... Suggested packages: expect The following NEW packages will be installed: wazuh-manager 0 upgraded, 1 newly installed, 0 to remove and 43 not upgraded. Need to get 311 MB of archives. After this operation, 914 MB of additional disk space will be used. Get:1 https://packages-dev.wazuh.com/pre-releas NEEDRESTART-VER: 3.5 NEEDRESTART-KCUR: 6.5.0-1014-aws NEEDRESTART-KEXP: 6.5.0-1014-aws NEEDRESTART-KSTA: 1reviously unselected package wazuh-manager.
12/04/2024 08:50:46 INFO: Wazuh manager installation finished.
12/04/2024 08:50:46 INFO: Wazuh manager vulnerability detection configuration finished.
12/04/2024 08:50:46 INFO: Starting service wazuh-manager.
Created symlink /etc/systemd/system/multi-user.target.wants/wazuh-manager.service → /lib/systemd/system/wazuh-manager.service.
12/04/2024 08:51:07 INFO: wazuh-manager service started.
12/04/2024 08:51:07 INFO: Starting Filebeat installation.
Reading package lists... Building dependency tree... Reading state information... The following NEW packages will be installed: filebeat 0 upgraded, 1 newly installed, 0 to remove and 43 not upgraded. Need to get 22.1 MB of archives. After this operation, 73.6 MB of additional disk space will be used. Get:1 https://packages-dev.wazuh.com/pre-release/apt unstable/main amd64 file NEEDRESTART-VER: 3.5 NEEDRESTART-KCUR: 6.5.0-1014-aws NEEDRESTART-KEXP: 6.5.0-1014-aws NEEDRESTART-KSTA: 1eat.
12/04/2024 08:51:22 INFO: Filebeat installation finished.
wazuh/
wazuh/_meta/
wazuh/_meta/docs.asciidoc
wazuh/_meta/fields.yml
wazuh/_meta/config.yml
wazuh/alerts/
wazuh/alerts/config/
wazuh/alerts/config/alerts.yml
wazuh/alerts/manifest.yml
wazuh/alerts/ingest/
wazuh/alerts/ingest/pipeline.json
wazuh/module.yml
wazuh/archives/
wazuh/archives/config/
wazuh/archives/config/archives.yml
wazuh/archives/manifest.yml
wazuh/archives/ingest/
wazuh/archives/ingest/pipeline.json
Created filebeat keystore
Successfully updated the keystore
Successfully updated the keystore
12/04/2024 08:51:24 INFO: Filebeat post-install configuration finished.
12/04/2024 08:51:24 INFO: Starting service filebeat.
Synchronizing state of filebeat.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable filebeat
Created symlink /etc/systemd/system/multi-user.target.wants/filebeat.service → /lib/systemd/system/filebeat.service.
12/04/2024 08:51:26 INFO: filebeat service started.
12/04/2024 08:51:26 INFO: --- Wazuh dashboard ---
12/04/2024 08:51:26 INFO: Starting Wazuh dashboard installation.
Reading package lists... Building dependency tree... Reading state information... The following NEW packages will be installed: wazuh-dashboard 0 upgraded, 1 newly installed, 0 to remove and 43 not upgraded. Need to get 186 MB of archives. After this operation, 988 MB of additional disk space will be used. Get:1 https://packages-dev.wazuh.com/pre-release/apt unstable/main amd64 E: Sub-process /usr/bin/dpkg returned an error code (2)ut 'bolt' to '/var/lib/dpkg/status': No space left on devicetes
12/04/2024 08:51:36 ERROR: Wazuh dashboard installation failed.
12/04/2024 08:51:36 INFO: --- Removing existing Wazuh installation ---
12/04/2024 08:51:39 INFO: Installation cleaned. Check the /var/log/wazuh-install.log file to learn more about the issue.
root@ip-172-31-44-9:/home/ubuntu# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/root 7.6G 4.2G 3.4G 56% /
tmpfs 3.9G 516K 3.9G 1% /dev/shm
tmpfs 1.6G 872K 1.6G 1% /run
tmpfs 5.0M 0 5.0M 0% /run/lock
efivarfs 128K 3.6K 120K 3% /sys/firmware/efi/efivars
/dev/nvme0n1p15 105M 6.1M 99M 6% /boot/efi
tmpfs 784M 4.0K 784M 1% /run/user/1000
