wazuh-packages icon indicating copy to clipboard operation
wazuh-packages copied to clipboard

Timing issues when upgrading

Open BraulioV opened this issue 4 years ago • 1 comments

Hi team,

While testing the packages we found several issues while upgrading. These issues are related to when the upgrade is started and what happens while the package is been upgraded. For example, in RPM packages we found an issue related to the installation of SCA files.

If the Wazuh Agent is restarted by the manager due to a triggered active response while the package is restarted, the temporary SCA files stored in ${INSTALLATION_DIR}/tmp may be deleted, so the package won't upgrade the SCA files.

This issue affects RPM packages mainly, but Deb packages may be affected too.

Regards.

BraulioV avatar Sep 10 '19 11:09 BraulioV

Hi again,

Here you can see how to reproduce this issue on the RPM packages:

  1. Install in a Wazuh Manager package (v3.10.0 for example) in the host A and a Wazuh Agent package with a lower version (v3.9.5 for example) in the host B.
  2. Connect the Agent in B to the Manager in A.
  3. Wait until the Agent gets restarted by the Manager from B after pushing the files belonging to the default group.
  4. Upgrade the Agent to the same version of the Manager from A and run at the same time this command in your host A: /var/ossec/bin/agent_control -R -a.

This will restart the agent while it is being upgraded and the temporary SCA files (which are stored in /var/ossec/tmp/sca...) will be deleted by the ossec-control file. This makes that the package won't upgrade the SCA files: https://github.com/wazuh/wazuh-packages/blob/3049159f9274a152d752d3f57968f8ab77b6dcf4/rpms/SPECS/3.10.0/wazuh-agent-3.10.0.spec#L349-L369

You can also try to reproduce this error by upgrading the manager and the agent at the same time, but the logic is the same.

BraulioV avatar Sep 10 '19 11:09 BraulioV