Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Filebeat rollback error on unattended installation #1736

Closed
okynos opened this issue Jul 13, 2022 · 5 comments · May be fixed by #1760
Closed

Filebeat rollback error on unattended installation #1736

okynos opened this issue Jul 13, 2022 · 5 comments · May be fixed by #1760
Assignees
@DFolchA @fcaffieri

Comments

@okynos
Copy link
Contributor

okynos commented Jul 13, 2022 •
edited by alberpilot

Hello,

The Filebeat module installation doesn't perform rollback when some conditions are met.
We have to review the trace error and try to reproduce and fix such error.

07/07/2022 10:29:53 INFO: Starting Filebeat installation.
07/07/2022 10:30:07 INFO: Filebeat installation finished.
chmod: cannot access '/etc/filebeat/wazuh-template.json': No such file or directory

gzip: stdin: unexpected end of file
tar: Child returned status 1
tar: Error is not recoverable: exiting now
Created filebeat keystore
Successfully updated the keystore
Successfully updated the keystore
07/07/2022 10:30:07 INFO: Filebeat post-install configuration finished.
07/07/2022 10:30:07 INFO: Starting service filebeat.
07/07/2022 10:30:07 INFO: filebeat service started.

@havidarou reported this issue.
@jmv74211
Copy link
Contributor

Just want to report the same case, when filebeat installation failed, no rollback is performed.

root@kibana:/home/vagrant# curl -sO https://packages.wazuh.com/4.3/wazuh-install.sh && sudo bash ./wazuh-install.sh -a
13/07/2022 15:32:30 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.5
13/07/2022 15:32:30 INFO: Verbose logging redirected to /var/log/wazuh-install.log
13/07/2022 15:32:37 INFO: --- Dependencies ----
13/07/2022 15:32:37 INFO: Installing apt-transport-https.
13/07/2022 15:32:39 INFO: Installing software-properties-common.
13/07/2022 15:32:47 INFO: Wazuh repository added.
13/07/2022 15:32:47 INFO: --- Configuration files ---
13/07/2022 15:32:47 INFO: Generating configuration files.
13/07/2022 15:32:48 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
13/07/2022 15:32:48 INFO: --- Wazuh indexer ---
13/07/2022 15:32:48 INFO: Starting Wazuh indexer installation.
13/07/2022 15:33:50 INFO: Wazuh indexer installation finished.
13/07/2022 15:33:50 INFO: Wazuh indexer post-install configuration finished.
13/07/2022 15:33:50 INFO: Starting service wazuh-indexer.
13/07/2022 15:34:01 INFO: wazuh-indexer service started.
13/07/2022 15:34:01 INFO: Initializing Wazuh indexer cluster security settings.
13/07/2022 15:34:06 INFO: Wazuh indexer cluster initialized.
13/07/2022 15:34:06 INFO: --- Wazuh server ---
13/07/2022 15:34:06 INFO: Starting the Wazuh manager installation.
13/07/2022 15:34:46 INFO: Wazuh manager installation finished.
13/07/2022 15:34:46 INFO: Starting service wazuh-manager.
13/07/2022 15:35:03 INFO: wazuh-manager service started.
13/07/2022 15:35:03 INFO: Starting Filebeat installation.
13/07/2022 15:35:03 INFO: An external process is using APT. This process has to end to proceed with the Wazuh installation. Next retry in 30 seconds (1/10)
13/07/2022 15:35:33 INFO: An external process is using APT. This process has to end to proceed with the Wazuh installation. Next retry in 30 seconds (2/10)
13/07/2022 15:36:03 INFO: An external process is using APT. This process has to end to proceed with the Wazuh installation. Next retry in 30 seconds (3/10)
13/07/2022 15:36:33 INFO: An external process is using APT. This process has to end to proceed with the Wazuh installation. Next retry in 30 seconds (4/10)
13/07/2022 15:37:03 INFO: An external process is using APT. This process has to end to proceed with the Wazuh installation. Next retry in 30 seconds (5/10)
13/07/2022 15:37:33 INFO: An external process is using APT. This process has to end to proceed with the Wazuh installation. Next retry in 30 seconds (6/10)
13/07/2022 15:38:03 INFO: An external process is using APT. This process has to end to proceed with the Wazuh installation. Next retry in 30 seconds (7/10)
13/07/2022 15:38:33 INFO: An external process is using APT. This process has to end to proceed with the Wazuh installation. Next retry in 30 seconds (8/10)
13/07/2022 15:39:03 INFO: An external process is using APT. This process has to end to proceed with the Wazuh installation. Next retry in 30 seconds (9/10)
13/07/2022 15:39:33 INFO: An external process is using APT. This process has to end to proceed with the Wazuh installation. Next retry in 30 seconds (10/10)
13/07/2022 15:40:05 ERROR: Filebeat installation failed.

@fcaffieri fcaffieri self-assigned this Jul 18, 2022
@fcaffieri
Copy link
Member

Update report

The problem is that rollbacks are generally performed in controlled situations, through some validation.
In cases where the script fails due to some unexpected error, the execution is interrupted and the rollback is not executed.
I am working on a try-catch implementation to apply to the wazuh install assistant.
Since bash doesn't have this implementation, I'm building and testing it so I can implement it throughout the setup wizard.
Then, in the event of an unexpected failure, this situation would be captured, a descriptive message of the failure would be reported and the rollback would be executed.

@fcaffieri
Copy link
Member

After a little more research, I found another problem, in addition to the one stated above, which occurs in the following situation:

if verbose mode is set, this causes the debug variable to contain the following value:
debug="2>&1 | tee -a ${logfile}".

This produces that in the following command:
eval "chmod 777 /etc/filebeat/wazuh-template.json ${debug}"

The result of the said command, even if it fails, returns a 0.
As an example, the following was executed:

echo $debug
eval "chmod 777 /etc/filebeat/wazuh-template.json ${debug}"
echo $?
debug=""
echo $debug
chmod go+r /etc/filebeat/wazuh-template.json $debug
echo $?

The output of these commands is:

2>&1 | tee -a wazuh-install.log
chmod: Cannot access '/etc/filebeat/wazuh-template.json': No such file or directory
0

chmod: Cannot access '/etc/filebeat/wazuh-template.json': No such file or directory
1

As you can see, the eval returned a 0 as status, which the chmod returns 1, since it failed.

This was clarified, since the first intention of implementing a try-catch, this situation caused me problems.
After improving this implementation, I managed to capture the error, even though the eval command does not return an error.
I leave an example:

Script:

#!/bin/bash

source ./trycatch2.sh

function filebeat_install() {

    echo "${debug}"
    eval "chmod 777 /etc/filebeat/wazuh-template.json ${debug}"
    echo $?
    eval "tar -xvz -C /usr/share/filebeat/module ${debug}"
    echo $?
    debug=""
    chmod go+r /etc/filebeat/wazuh-template.json $debug
    echo $?
    tar -xvz -C /usr/share/filebeat/module $debug
    echo $?

}

try {
    echo 'Hello'
    logfile="wazuh-install.log"
    debug="2>&1 | tee -a ${logfile}"
    filebeat_install
    echo "End"
} catch {
    echo "Unknown error: $?"
}

Output:

$ ./test-try-catch2.sh 
Hello
20/07/2022 18:32:04 INFO: Starting Filebeat installation.
2>&1 | tee -a wazuh-install.log
chmod: no se puede acceder a '/etc/filebeat/wazuh-template.json': No existe el archivo o el directorio
Unknown error: 1
$

The possibility of implementing this logic will be discussed with the team.

@fcaffieri
Copy link
Member

Update report

Generate a try-catch implementation on the branch:
1736-wazuh-install-assistant-rollback-to4.3

Summarizing:
We have 2 situations.
1- Failure due to controlled or known errors: in this case, there would be no major problem, since validation is performed to avoid the error and execute the rollback. They are controlled situations.
2- Unexpected errors:
In this case, which is the one reported in the issue, the problem is due to the script failing due to an unexpected error.
For example, in the first case reported, the script fails at the following point:

Inside the filebeat_configure function, it fails on:
eval "chmod go+r /etc/filebeat/wazuh-template.json ${debug}"

One possibility in the face of this error is that in the previous step the template.json could not be downloaded for some reason:
eval "curl -so /etc/filebeat/wazuh-template.json ${filebeat_wazuh_template} --max-time 300 ${debug}"

Anyway, I couldn't reproduce the mentioned error, because the previous command shouldn't throw an error since the errors are being redirected to the log file.
debug=">> ${logfile} 2>&1"

However, any type of unexpected error could produce this situation, where the script fails, and continues with its execution.

So the proposal would be to implement a try-catch block so that if it fails due to an unexpected error, print said error and then perform the rollback.
For this, the following is implemented:

if [ -n "${wazuh}" ]; then
        common_logger "--- Wazuh server ---"

        manager_install
        if [ -n "${server_node_types[*]}" ]; then
            manager_startCluster
        fi
        installCommon_startService "wazuh-manager"
        try {
            filebeat_install
            filebeat_configure
        } catch {
            installCommon_rollBack
        }
        installCommon_changePasswords
        installCommon_startService "filebeat"
    fi

The idea is to add this type of validation in each step of the different types of installations (AIO, Distributed, etc.)

The definition of the try catch was done with shopt and expand_aliases:

set -o pipefail
shopt -s expand_aliases
alias try="(set -e;"
alias catch=" ); Error \$? || "

function Error() {
    local retVal=$1
    if [[ $retVal -gt 0 ]]
    then
        return 1
    fi
}

Test

The error was forced in the same command as the one reported, and two installation scripts were generated, one with the improvement and the other is the current one.

[root@manager-wpk vagrant]# bash ./wazuh-install.sh -ws wazuh-1
21/07/2022 23:54:25 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.6
21/07/2022 23:54:25 INFO: Verbose logging redirected to /var/log/wazuh-install.log
21/07/2022 23:54:31 INFO: Wazuh repository added.
21/07/2022 23:54:31 INFO: --- Wazuh server ---
21/07/2022 23:54:31 INFO: Starting the Wazuh manager installation.
21/07/2022 23:55:06 INFO: Wazuh manager installation finished.
21/07/2022 23:55:06 INFO: Starting service wazuh-manager.
21/07/2022 23:55:20 INFO: wazuh-manager service started.
21/07/2022 23:55:20 INFO: Starting Filebeat installation.
21/07/2022 23:55:25 INFO: Filebeat installation finished.
chmod: cannot access '/etc/filebeat/wazuh-template.json': No such file or directory
21/07/2022 23:55:25 INFO: Filebeat post-install configuration finished.
21/07/2022 23:55:31 INFO: Starting service filebeat.
21/07/2022 23:55:31 INFO: filebeat service started.
21/07/2022 23:55:31 INFO: Installation finished.
[root@manager-wpk vagrant]# 
[root@manager-wpk vagrant]# 
[root@manager-wpk vagrant]# vi wazuh-install-with-try.sh 
[root@manager-wpk vagrant]# 
[root@manager-wpk vagrant]# bash ./wazuh-install.sh -u
21/07/2022 23:56:16 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.6
21/07/2022 23:56:16 INFO: Verbose logging redirected to /var/log/wazuh-install.log
21/07/2022 23:56:18 INFO: Wazuh indexer not found in the system so it was not uninstalled.
21/07/2022 23:56:18 INFO: Wazuh dashboard not found in the system so it was not uninstalled.
21/07/2022 23:56:18 INFO: Removing Wazuh manager.
21/07/2022 23:56:34 INFO: Wazuh manager removed.
21/07/2022 23:56:34 INFO: Removing Filebeat.
21/07/2022 23:56:34 INFO: Filebeat removed.
[root@manager-wpk vagrant]# 
[root@manager-wpk vagrant]# 
[root@manager-wpk vagrant]# bash ./wazuh-install-with-try.sh -ws wazuh-1
21/07/2022 23:56:46 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.6
21/07/2022 23:56:46 INFO: Verbose logging redirected to /var/log/wazuh-install.log
21/07/2022 23:56:51 INFO: Wazuh repository added.
21/07/2022 23:56:51 INFO: --- Wazuh server ---
21/07/2022 23:56:51 INFO: Starting the Wazuh manager installation.
21/07/2022 23:57:27 INFO: Wazuh manager installation finished.
21/07/2022 23:57:27 INFO: Starting service wazuh-manager.
21/07/2022 23:57:41 INFO: wazuh-manager service started.
21/07/2022 23:57:41 INFO: Starting Filebeat installation.
21/07/2022 23:57:45 INFO: --- Removing existing Wazuh installation ---
21/07/2022 23:57:45 INFO: Removing Wazuh manager.
21/07/2022 23:58:01 INFO: Wazuh manager removed.
21/07/2022 23:58:01 INFO: Installation cleaned. Check the /var/log/wazuh-install.log file to learn more about the issue.
21/07/2022 23:58:01 INFO: Installation finished.
[root@manager-wpk vagrant]#

As seen in the second execution with the script that contains the improvement, the execution of the rollback occurred immediately after the failure.

@fcaffieri
Copy link
Member

Update report

After several tests I found a situation:
To validate which components were installed, run the following command:
wazuh_installed=$(apt list --installed 2>/dev/null | grep wazuh-manager)

The problem with this command is that when grep does not match a value, the status returned to the script is a status 1 error, but it does not cause the script to fail. As an example:

$ wazuh_installed=$(apt list --installed 2>/dev/null | grep zip)
$ echo $?
0
$ ^C$(apt list --installed 2>/dev/null | grep zip)
$ wazuh_installed=$(apt list --installed 2>/dev/null | grep adsadfasd)
$ echo $?
1
$

As seen in the example, the grep that searches for the zip return a status of 0. But the grep that searches for a component not installed returns a status of 1.
So, with the try-catch implementation, status 1 is taken as an error, and the execution of the script ends with the catch.
After many tests, I found a way to solve this:
wazuh_installed=$(apt list --installed 2>/dev/null | grep wazuh-manager || true)

Tests:

$ wazuh_installed=$(apt list --installed 2>/dev/null | grep sadfgafd || true)
$ echo $?
0
$ echo $wazuh_installed

$ wazuh_installed=$(apt list --installed 2>/dev/null | grep zip || true)
$ echo $?
0
$ echo $wazuh_installed
bzip2/focal,now 1.0.8-2 amd64 [installed, automatic] gzip/focal-updates,focal-security,now 1.10-0ubuntu4.1 amd64 [installed] libzip5/focal,now 1.5.1-0ubuntu1 amd64 [installed, auto-uninstallable] python3-zipp/focal,focal,now 1.0.0-1 all [installed, automatic] unzip/focal,now 6.0-25ubuntu1 amd64 [installed] zip/focal,now 3.0-11build1 amd64 [installed, automatic]
$

After resolving this situation, try-catch was implemented for all types of installations.
Some tests were carried out, but it remains to go deeper.

Another issue to keep in mind is how an error redirection is being used in this way:
debug=">> ${logfile} 2>&1"
The unexpected error does not appear on the screen, it only appears in the log.
But if verbose mode is used, the error appears both on the screen and in the log.

Test forcing error without verbose:

[root@manager-wpk vagrant]# bash ./wazuh-install-with-try-2.sh -ws wazuh-1 
22/07/2022 11:23:06 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.6
22/07/2022 11:23:06 INFO: Verbose logging redirected to /var/log/wazuh-install.log
22/07/2022 11:23:13 INFO: Wazuh repository added.
22/07/2022 11:23:13 INFO: --- Wazuh server ---
22/07/2022 11:23:13 INFO: Starting the Wazuh manager installation.
22/07/2022 11:23:55 INFO: Wazuh manager installation finished.
22/07/2022 11:23:55 INFO: Starting service wazuh-manager.
22/07/2022 11:24:10 INFO: wazuh-manager service started.
22/07/2022 11:24:10 INFO: Starting Filebeat installation.
22/07/2022 11:24:17 INFO: Filebeat installation finished.
22/07/2022 11:24:17 INFO: Filebeat installation failed
22/07/2022 11:24:17 INFO: --- Removing existing Wazuh installation ---
22/07/2022 11:24:17 INFO: Removing Filebeat.
22/07/2022 11:24:18 INFO: Filebeat removed.
22/07/2022 11:24:18 INFO: Installation cleaned. Check the /var/log/wazuh-install.log file to learn more about the issue.
22/07/2022 11:24:18 INFO: Installation finished.
[root@manager-wpk vagrant]# sh ./wazuh-install-with-try-2.sh -u
22/07/2022 11:25:28 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.6
22/07/2022 11:25:28 INFO: Verbose logging redirected to /var/log/wazuh-install.log
22/07/2022 11:25:31 INFO: Filebeat not found in the system so it was not uninstalled.
22/07/2022 11:25:31 INFO: Wazuh indexer not found in the system so it was not uninstalled.
22/07/2022 11:25:31 INFO: Wazuh dashboard not found in the system so it was not uninstalled.
22/07/2022 11:25:31 INFO: Removing Wazuh manager.
22/07/2022 11:25:49 INFO: Wazuh manager removed.
[root@manager-wpk vagrant]#

Test forcing error with verbose:

[root@manager-wpk vagrant]# 
[root@manager-wpk vagrant]# bash ./wazuh-install-with-try-2.sh -ws wazuh-1 -v 
22/07/2022 11:25:59 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.6
22/07/2022 11:25:59 INFO: Verbose logging redirected to /var/log/wazuh-install.log
22/07/2022 11:26:05 DEBUG: Adding the Wazuh repository.
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-${releasever} - Wazuh
baseurl=https://packages.wazuh.com/4.x/yum/
protect=1
22/07/2022 11:26:06 INFO: Wazuh repository added.
22/07/2022 11:26:06 INFO: --- Wazuh server ---
22/07/2022 11:26:06 INFO: Starting the Wazuh manager installation.
Failed to set locale, defaulting to C
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: centos.zero.com.ar
 * extras: mirrors.eze.sysarmy.com
 * updates: mirrors.eze.sysarmy.com
Resolving Dependencies
--> Running transaction check
---> Package wazuh-manager.x86_64 0:4.3.6-1 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package                Arch            Version            Repository      Size
================================================================================
Installing:
 wazuh-manager          x86_64          4.3.6-1            wazuh          114 M

Transaction Summary
================================================================================
Install  1 Package

Total download size: 114 M
Installed size: 437 M
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : wazuh-manager-4.3.6-1.x86_64                                 1/1 
  Verifying  : wazuh-manager-4.3.6-1.x86_64                                 1/1 

Installed:
  wazuh-manager.x86_64 0:4.3.6-1                                                

Complete!
22/07/2022 11:26:45 INFO: Wazuh manager installation finished.
22/07/2022 11:26:45 INFO: Starting service wazuh-manager.
Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-manager.service to /usr/lib/systemd/system/wazuh-manager.service.
22/07/2022 11:27:00 INFO: wazuh-manager service started.
22/07/2022 11:27:00 INFO: Starting Filebeat installation.
Failed to set locale, defaulting to C
22/07/2022 11:27:05 INFO: Filebeat installation finished.
chmod: cannot access '/etc/filebeat/wazuh-template.json': No such file or directory
22/07/2022 11:27:05 INFO: Filebeat installation failed
22/07/2022 11:27:05 INFO: --- Removing existing Wazuh installation ---
22/07/2022 11:27:05 INFO: Removing Filebeat.
Failed to set locale, defaulting to C
Loaded plugins: fastestmirror
Resolving Dependencies
--> Running transaction check
---> Package filebeat.x86_64 0:7.10.2-1 will be erased
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package            Arch             Version             Repository        Size
================================================================================
Removing:
 filebeat           x86_64           7.10.2-1            @wazuh            70 M

Transaction Summary
================================================================================
Remove  1 Package

Installed size: 70 M
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Erasing    : filebeat-7.10.2-1.x86_64                                     1/1 
  Verifying  : filebeat-7.10.2-1.x86_64                                     1/1 

Removed:
  filebeat.x86_64 0:7.10.2-1                                                    

Complete!
22/07/2022 11:27:06 INFO: Filebeat removed.
22/07/2022 11:27:06 INFO: Installation cleaned. Check the /var/log/wazuh-install.log file to learn more about the issue.
22/07/2022 11:27:06 INFO: Installation finished.
[root@manager-wpk vagrant]# bash ./wazuh-install-with-try-2.sh -u            
22/07/2022 11:42:27 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.6
22/07/2022 11:42:27 INFO: Verbose logging redirected to /var/log/wazuh-install.log
22/07/2022 11:42:29 INFO: Filebeat not found in the system so it was not uninstalled.
22/07/2022 11:42:29 INFO: Wazuh indexer not found in the system so it was not uninstalled.
22/07/2022 11:42:29 INFO: Wazuh dashboard not found in the system so it was not uninstalled.
22/07/2022 11:42:29 INFO: Removing Wazuh manager.
22/07/2022 11:42:45 INFO: Wazuh manager removed.
[root@manager-wpk vagrant]#

Test finish ok:

[root@manager-wpk vagrant]# vi wazuh-install-with-try-2.sh 
[root@manager-wpk vagrant]# bash ./wazuh-install-with-try-2.sh -ws wazuh-1 -v
22/07/2022 11:44:29 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.6
22/07/2022 11:44:29 INFO: Verbose logging redirected to /var/log/wazuh-install.log
22/07/2022 11:44:35 DEBUG: Adding the Wazuh repository.
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-${releasever} - Wazuh
baseurl=https://packages.wazuh.com/4.x/yum/
protect=1
22/07/2022 11:44:35 INFO: Wazuh repository added.
22/07/2022 11:44:35 INFO: --- Wazuh server ---
22/07/2022 11:44:35 INFO: Starting the Wazuh manager installation.
Failed to set locale, defaulting to C
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: centos.zero.com.ar
 * extras: mirrors.eze.sysarmy.com
 * updates: mirrors.eze.sysarmy.com
Resolving Dependencies
--> Running transaction check
---> Package wazuh-manager.x86_64 0:4.3.6-1 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package                Arch            Version            Repository      Size
================================================================================
Installing:
 wazuh-manager          x86_64          4.3.6-1            wazuh          114 M

Transaction Summary
================================================================================
Install  1 Package

Total download size: 114 M
Installed size: 437 M
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : wazuh-manager-4.3.6-1.x86_64                                 1/1 
  Verifying  : wazuh-manager-4.3.6-1.x86_64                                 1/1 

Installed:
  wazuh-manager.x86_64 0:4.3.6-1                                                

Complete!
22/07/2022 11:45:12 INFO: Wazuh manager installation finished.
22/07/2022 11:45:12 INFO: Starting service wazuh-manager.
Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-manager.service to /usr/lib/systemd/system/wazuh-manager.service.
22/07/2022 11:45:27 INFO: wazuh-manager service started.
22/07/2022 11:45:27 INFO: Starting Filebeat installation.
Failed to set locale, defaulting to C
22/07/2022 11:45:32 INFO: Filebeat installation finished.
wazuh/alerts/
wazuh/alerts/config/
wazuh/alerts/config/alerts.yml
wazuh/alerts/manifest.yml
wazuh/alerts/ingest/
wazuh/alerts/ingest/pipeline.json
wazuh/archives/
wazuh/archives/config/
wazuh/archives/config/archives.yml
wazuh/archives/manifest.yml
wazuh/archives/ingest/
wazuh/archives/ingest/pipeline.json
wazuh/module.yml
Created filebeat keystore
Successfully updated the keystore
Successfully updated the keystore
22/07/2022 11:45:33 INFO: Filebeat post-install configuration finished.
22/07/2022 11:45:33 DEBUG: Setting Wazuh indexer cluster passwords.
Successfully updated the keystore
22/07/2022 11:45:37 DEBUG: filebeat started
22/07/2022 11:45:39 INFO: Starting service filebeat.
Created symlink from /etc/systemd/system/multi-user.target.wants/filebeat.service to /usr/lib/systemd/system/filebeat.service.
22/07/2022 11:45:39 INFO: filebeat service started.
22/07/2022 11:45:39 INFO: Installation finished.
[root@manager-wpk vagrant]#

@fcaffieri fcaffieri mentioned this issue Jul 22, 2022
Open
@fcaffieri fcaffieri linked a pull request Jul 22, 2022 that will close this issue
Wazuh install assistant with error handler #1760
Open
@DFolchA DFolchA mentioned this issue Jul 29, 2022
Merged
@okynos okynos closed this as completed Aug 1, 2022
@fcaffieri fcaffieri mentioned this issue Nov 6, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@DFolchA DFolchA

@fcaffieri fcaffieri

Labels
None yet
Projects
No open projects
Release 4.3.7
Status: Done
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Wazuh install assistant with error handler wazuh/wazuh-packages
4 participants
@okynos @DFolchA @jmv74211 @fcaffieri