Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

wazuh not creating alert indexes #6941

Open
oldamilyas opened this issue Aug 22, 2024 · 1 comment
Open

wazuh not creating alert indexes #6941

oldamilyas opened this issue Aug 22, 2024 · 1 comment
Assignees
Labels
level/task Task issue reporter/community Issue reported by the community request/operational Operational requests type/troubleshooting

Comments

@oldamilyas
Copy link

oldamilyas commented Aug 22, 2024

Wazuh version Browser plateforme
4.8.1 Chrome debian 12

Description
wazuh shows two agent as connected, there are indexes like wazuh-statistics and wazuh-monitering that recieve data as expected, however there are no indexes for for wazuh-allerts as shown byt the list of indexes bellow.

Expected Result

  1. i would expect at least one index for wazuh-alerts to be created.

Actual Result

  1. these are all the indexes that i have:

green open wazuh-statistics-2024.33w ayYZx1eXSduS7oYgPFoecA 1 0 280 0 252.6kb 252.6kb
green open wazuh-statistics-2024.34w j1xD02R_SBOGAHZAgLSzbg 1 0 74 0 298.4kb 298.4kb
green open .opensearch-observability Dbup7mpUQJq8CPVukXWsYA 1 0 0 0 208b 208b
green open .plugins-ml-config Xd_8Vyl0SEG1Jx_baYPy4Q 1 0 1 0 3.9kb 3.9kb
green open wazuh-monitoring-2024.34w lG8xH9xfRcC0mIYfVQ97vQ 1 0 25 0 144.6kb 144.6kb
green open wazuh-monitoring-2024.33w X10SFiQ1SSWinFVcxLSnkg 1 0 57 0 84.1kb 84.1kb
green open wazuh-states-vulnerabilities-elk.test-demo.com iTdpCSUVQNyxxMYmjprYuQ 1 0 19 0 63.3kb 63.3kb
green open .opendistro_security Ewrj36AuToeNcuLw8oqKdg 1 0 10 0 65.1kb 65.1kb
green open .kibana_1 wtwUwfJUSTyc035PfPaxyg 1 0 12 1 63.4kb 63.4kb
green open .tasks 66BGCKOtRuu3ZMVBxSXd9Q 1 0 2 0 14.2kb 14.2kb

Additional context
i thought at first it must be a filebeat issue but filebeat is connecting properly:

filebeat test output
elasticsearch: https://192.168.210.128:9201...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 192.168.210.128
dial up... OK
TLS...
security... WARN server's certificate chain verification is disabled
handshake... OK
TLS version: TLSv1.3
dial up... OK
talk to server... OK
version: 7.10.2

the alerts file: /var/ossec/logs/alerts/alerts.json , shows alerts correctly, so it appears that they are arriving to my server:
image

@asteriscos asteriscos self-assigned this Sep 1, 2024
@asteriscos asteriscos added reporter/community Issue reported by the community level/task Task issue request/operational Operational requests type/troubleshooting labels Sep 1, 2024
@JuanGarriuz JuanGarriuz self-assigned this Nov 12, 2024
@JuanGarriuz
Copy link
Member

Good morning, @oldamilyas

I have been trying to replicate the issue you mentioned, but I haven’t been able to pinpoint the exact problem. I’d like to ask you a few questions:

  • Have you recently updated the version of the Wazuh installation? If so, from which version?
  • Did you use an assisted installation version or a step-by-step installation?

Thank you very much for your patience. I hope we can resolve the issue as soon as possible.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
level/task Task issue reporter/community Issue reported by the community request/operational Operational requests type/troubleshooting
Projects
None yet
Development

No branches or pull requests

3 participants