Fix 4.8.0-beta4 AL2023 vulnerabilities
#1260
Assignees
Labels
Comments
Merged
Docker Images Build:$ build-docker-images/build-images.sh
Building wazuh.manager
Step 1/25 : FROM amazonlinux:2023.3.20240304.0
2023.3.20240304.0: Pulling from library/amazonlinux
89b8a8416043: Pull complete
Digest: sha256:6ef0881ab074946ab8d1d68a56f3cae2c6f16b5885737601ff8a9325f806780e
Status: Downloaded newer image for amazonlinux:2023.3.20240304.0
---> d54cb79e59a5
Step 2/25 : RUN rm /bin/sh && ln -s /bin/bash /bin/sh
---> Running in 831609aeb532
---> Removed intermediate container 831609aeb532
---> 3721140e4a4d
Step 3/25 : ARG WAZUH_VERSION
---> Running in 1ff73191e13d
---> Removed intermediate container 1ff73191e13d
---> fd8a225d71e8
Step 4/25 : ARG WAZUH_TAG_REVISION
---> Running in 4bfa17f96b03
---> Removed intermediate container 4bfa17f96b03
---> 1d71658865bb
Step 5/25 : ARG FILEBEAT_TEMPLATE_BRANCH
---> Running in 415eea16f897
---> Removed intermediate container 415eea16f897
---> 8d62c2a5aa05
Step 6/25 : ARG FILEBEAT_CHANNEL=filebeat-oss
---> Running in 43007874a903
---> Removed intermediate container 43007874a903
---> 707103f12e97
Step 7/25 : ARG FILEBEAT_VERSION=7.10.2
---> Running in abda9241e155
---> Removed intermediate container abda9241e155
---> bd4c2314c809
Step 8/25 : ARG WAZUH_FILEBEAT_MODULE
---> Running in 748c00c9ffd4
---> Removed intermediate container 748c00c9ffd4
---> ba7177f8e2e3
Step 9/25 : ARG S6_VERSION="v2.2.0.3"
---> Running in 33aae06562ff
---> Removed intermediate container 33aae06562ff
---> 3a4fc04559f7
Step 10/25 : RUN yum install curl-minimal xz gnupg tar gzip openssl findutils procps -y && yum clean all
---> Running in 2252b2405152
Amazon Linux 2023 repository 7.3 MB/s | 25 MB 00:03
Last metadata expiration check: 0:00:07 ago on Wed Mar 13 15:01:19 2024.
Package curl-minimal-8.5.0-1.amzn2023.0.2.x86_64 is already installed.
Package gnupg2-minimal-2.3.7-1.amzn2023.0.4.x86_64 is already installed.
Dependencies resolved.
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
findutils x86_64 1:4.8.0-2.amzn2023.0.2 amazonlinux 539 k
gzip x86_64 1.12-1.amzn2023.0.1 amazonlinux 160 k
openssl x86_64 1:3.0.8-1.amzn2023.0.11 amazonlinux 1.2 M
procps-ng x86_64 3.3.17-1.amzn2023.0.2 amazonlinux 331 k
tar x86_64 2:1.34-1.amzn2023.0.4 amazonlinux 879 k
xz x86_64 5.2.5-9.amzn2023.0.2 amazonlinux 215 k
Installing dependencies:
systemd-libs x86_64 252.16-1.amzn2023.0.2 amazonlinux 623 k
Transaction Summary
================================================================================
Install 7 Packages
Total download size: 3.8 M
Installed size: 10 M
Downloading Packages:
(1/7): xz-5.2.5-9.amzn2023.0.2.x86_64.rpm 976 kB/s | 215 kB 00:00
(2/7): findutils-4.8.0-2.amzn2023.0.2.x86_64.rp 2.4 MB/s | 539 kB 00:00
(3/7): procps-ng-3.3.17-1.amzn2023.0.2.x86_64.r 1.3 MB/s | 331 kB 00:00
(4/7): systemd-libs-252.16-1.amzn2023.0.2.x86_6 3.9 MB/s | 623 kB 00:00
(5/7): openssl-3.0.8-1.amzn2023.0.11.x86_64.rpm 4.3 MB/s | 1.2 MB 00:00
(6/7): tar-1.34-1.amzn2023.0.4.x86_64.rpm 3.1 MB/s | 879 kB 00:00
(7/7): gzip-1.12-1.amzn2023.0.1.x86_64.rpm 789 kB/s | 160 kB 00:00
--------------------------------------------------------------------------------
Total 3.1 MB/s | 3.8 MB 00:01
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : systemd-libs-252.16-1.amzn2023.0.2.x86_64 1/7
Installing : procps-ng-3.3.17-1.amzn2023.0.2.x86_64 2/7
Installing : gzip-1.12-1.amzn2023.0.1.x86_64 3/7
Installing : tar-2:1.34-1.amzn2023.0.4.x86_64 4/7
Installing : openssl-1:3.0.8-1.amzn2023.0.11.x86_64 5/7
Installing : xz-5.2.5-9.amzn2023.0.2.x86_64 6/7
Installing : findutils-1:4.8.0-2.amzn2023.0.2.x86_64 7/7
Running scriptlet: findutils-1:4.8.0-2.amzn2023.0.2.x86_64 7/7
Verifying : findutils-1:4.8.0-2.amzn2023.0.2.x86_64 1/7
Verifying : procps-ng-3.3.17-1.amzn2023.0.2.x86_64 2/7
Verifying : xz-5.2.5-9.amzn2023.0.2.x86_64 3/7
Verifying : systemd-libs-252.16-1.amzn2023.0.2.x86_64 4/7
Verifying : openssl-1:3.0.8-1.amzn2023.0.11.x86_64 5/7
Verifying : tar-2:1.34-1.amzn2023.0.4.x86_64 6/7
Verifying : gzip-1.12-1.amzn2023.0.1.x86_64 7/7
Installed:
findutils-1:4.8.0-2.amzn2023.0.2.x86_64
gzip-1.12-1.amzn2023.0.1.x86_64
openssl-1:3.0.8-1.amzn2023.0.11.x86_64
procps-ng-3.3.17-1.amzn2023.0.2.x86_64
systemd-libs-252.16-1.amzn2023.0.2.x86_64
tar-2:1.34-1.amzn2023.0.4.x86_64
xz-5.2.5-9.amzn2023.0.2.x86_64
Complete!
9 files removed
---> Removed intermediate container 2252b2405152
---> 7693b4370aef
Step 11/25 : COPY config/check_repository.sh /
---> 3b30bf862918
Step 12/25 : COPY config/filebeat_module.sh /
---> 228ec894a25d
Step 13/25 : COPY config/permanent_data.env config/permanent_data.sh /
---> 59ec38bd9443
Step 14/25 : RUN chmod 775 /check_repository.sh
---> Running in 64cbadb98a8e
---> Removed intermediate container 64cbadb98a8e
---> 26d112d54d3b
Step 15/25 : RUN source /check_repository.sh
---> Running in 5153ea4ccb9d
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH]
enabled=1
name=EL-$releasever - Wazuh
baseurl=https://packages-dev.wazuh.com/pre-release/yum/
protect=1
---> Removed intermediate container 5153ea4ccb9d
---> a395219f3f26
Step 16/25 : RUN yum install wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && yum clean all && chmod 775 /filebeat_module.sh && source /filebeat_module.sh && rm /filebeat_module.sh && curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz -o /tmp/s6-overlay-amd64.tar.gz && tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && tar xzf /tmp/s6-overlay-amd64.tar.gz -C /usr ./bin && rm /tmp/s6-overlay-amd64.tar.gz
---> Running in 01bb31c15380
Amazon Linux 2023 repository 7.2 MB/s | 25 MB 00:03
EL-2023.3.20240304 - Wazuh 5.2 MB/s | 24 MB 00:04
Last metadata expiration check: 0:00:08 ago on Wed Mar 13 15:01:42 2024.
Dependencies resolved.
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
wazuh-manager x86_64 4.8.0-1 wazuh 291 M
Installing dependencies:
libsemanage x86_64 3.4-5.amzn2023.0.2 amazonlinux 121 k
shadow-utils x86_64 2:4.9-12.amzn2023.0.4 amazonlinux 1.1 M
Transaction Summary
================================================================================
Install 3 Packages
Total download size: 292 M
Installed size: 883 M
Downloading Packages:
(1/3): libsemanage-3.4-5.amzn2023.0.2.x86_64.rp 779 kB/s | 121 kB 00:00
(2/3): shadow-utils-4.9-12.amzn2023.0.4.x86_64. 3.3 MB/s | 1.1 MB 00:00
(3/3): wazuh-manager-4.8.0-1.x86_64.rpm 9.9 MB/s | 291 MB 00:29
--------------------------------------------------------------------------------
Total 9.7 MB/s | 292 MB 00:30
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : libsemanage-3.4-5.amzn2023.0.2.x86_64 1/3
Installing : shadow-utils-2:4.9-12.amzn2023.0.4.x86_64 2/3
Running scriptlet: wazuh-manager-4.8.0-1.x86_64 3/3
Installing : wazuh-manager-4.8.0-1.x86_64 3/3
Running scriptlet: wazuh-manager-4.8.0-1.x86_64 3/3
Verifying : shadow-utils-2:4.9-12.amzn2023.0.4.x86_64 1/3
Verifying : libsemanage-3.4-5.amzn2023.0.2.x86_64 2/3
Verifying : wazuh-manager-4.8.0-1.x86_64 3/3
Installed:
libsemanage-3.4-5.amzn2023.0.2.x86_64
shadow-utils-2:4.9-12.amzn2023.0.4.x86_64
wazuh-manager-4.8.0-1.x86_64
Complete!
16 files removed
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 20.7M 100 20.7M 0 0 8618k 0 0:00:02 0:00:02 --:--:-- 8618k
Amazon Linux 2023 repository 6.6 MB/s | 25 MB 00:03
EL-2023.3.20240304 - Wazuh 5.0 MB/s | 24 MB 00:04
Last metadata expiration check: 0:00:07 ago on Wed Mar 13 15:02:54 2024.
Dependencies resolved.
================================================================================
Package Architecture Version Repository Size
================================================================================
Installing:
filebeat x86_64 7.10.2-1 @commandline 21 M
Transaction Summary
================================================================================
Install 1 Package
Total size: 21 M
Installed size: 70 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : filebeat-7.10.2-1.x86_64 1/1
Running scriptlet: filebeat-7.10.2-1.x86_64 1/1
Verifying : filebeat-7.10.2-1.x86_64 1/1
Installed:
filebeat-7.10.2-1.x86_64
Complete!
wazuh/
wazuh/_meta/
wazuh/_meta/docs.asciidoc
wazuh/_meta/fields.yml
wazuh/_meta/config.yml
wazuh/alerts/
wazuh/alerts/config/
wazuh/alerts/config/alerts.yml
wazuh/alerts/manifest.yml
wazuh/alerts/ingest/
wazuh/alerts/ingest/pipeline.json
wazuh/module.yml
wazuh/archives/
wazuh/archives/config/
wazuh/archives/config/archives.yml
wazuh/archives/manifest.yml
wazuh/archives/ingest/
wazuh/archives/ingest/pipeline.json
---> Removed intermediate container 01bb31c15380
---> 446cd2272666
Step 17/25 : COPY config/etc/ /etc/
---> aa07c1d11e2f
Step 18/25 : COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py
---> c1f6895263e0
Step 19/25 : COPY config/filebeat.yml /etc/filebeat/
---> 85316e3e518a
Step 20/25 : RUN chmod go-w /etc/filebeat/filebeat.yml
---> Running in 995b311ed402
---> Removed intermediate container 995b311ed402
---> a0c5f9a5b437
Step 21/25 : ADD https://raw.githubusercontent.com/wazuh/wazuh/$FILEBEAT_TEMPLATE_BRANCH/extensions/elasticsearch/7.x/wazuh-template.json /etc/filebeat
---> 4407d8c4a9b6
Step 22/25 : RUN chmod go-w /etc/filebeat/wazuh-template.json
---> Running in 9f66624f5b78
---> Removed intermediate container 9f66624f5b78
---> 4e67077fd52d
Step 23/25 : RUN mkdir -p /var/ossec/var/multigroups && chown root:wazuh /var/ossec/var/multigroups && chmod 770 /var/ossec/var/multigroups && mkdir -p /var/ossec/agentless && chown root:wazuh /var/ossec/agentless && chmod 770 /var/ossec/agentless && mkdir -p /var/ossec/active-response/bin && chown root:wazuh /var/ossec/active-response/bin && chmod 770 /var/ossec/active-response/bin && chmod 755 /permanent_data.sh && sync && /permanent_data.sh && sync && rm /permanent_data.sh
---> Running in 92caa004ba83
---> Removed intermediate container 92caa004ba83
---> ce30d319258b
Step 24/25 : EXPOSE 55000/tcp 1514/tcp 1515/tcp 514/udp 1516/tcp
---> Running in b12e556dac35
---> Removed intermediate container b12e556dac35
---> aad00e30f4a1
Step 25/25 : ENTRYPOINT [ "/init" ]
---> Running in 94a05df4e748
---> Removed intermediate container 94a05df4e748
---> eab9af778fbb
Successfully built eab9af778fbb
Successfully tagged wazuh/wazuh-manager:4.8.0
Building wazuh.indexer
Step 1/32 : FROM amazonlinux:2023.3.20240304.0 AS builder
---> d54cb79e59a5
Step 2/32 : ARG WAZUH_VERSION
---> Running in ec6ae5c4f1d2
---> Removed intermediate container ec6ae5c4f1d2
---> ec90b700ce29
Step 3/32 : ARG WAZUH_TAG_REVISION
---> Running in d9a2b0873fe3
---> Removed intermediate container d9a2b0873fe3
---> 6459c014d01a
Step 4/32 : RUN yum install curl-minimal openssl xz tar findutils shadow-utils -y
---> Running in 6a64e26518a4
Amazon Linux 2023 repository 7.6 MB/s | 25 MB 00:03
Last metadata expiration check: 0:00:06 ago on Wed Mar 13 15:03:20 2024.
Package curl-minimal-8.5.0-1.amzn2023.0.2.x86_64 is already installed.
Dependencies resolved.
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
findutils x86_64 1:4.8.0-2.amzn2023.0.2 amazonlinux 539 k
openssl x86_64 1:3.0.8-1.amzn2023.0.11 amazonlinux 1.2 M
shadow-utils x86_64 2:4.9-12.amzn2023.0.4 amazonlinux 1.1 M
tar x86_64 2:1.34-1.amzn2023.0.4 amazonlinux 879 k
xz x86_64 5.2.5-9.amzn2023.0.2 amazonlinux 215 k
Installing dependencies:
libsemanage x86_64 3.4-5.amzn2023.0.2 amazonlinux 121 k
Transaction Summary
================================================================================
Install 6 Packages
Total download size: 4.0 M
Installed size: 11 M
Downloading Packages:
(1/6): libsemanage-3.4-5.amzn2023.0.2.x86_64.rp 764 kB/s | 121 kB 00:00
(2/6): findutils-4.8.0-2.amzn2023.0.2.x86_64.rp 2.4 MB/s | 539 kB 00:00
(3/6): xz-5.2.5-9.amzn2023.0.2.x86_64.rpm 2.7 MB/s | 215 kB 00:00
(4/6): shadow-utils-4.9-12.amzn2023.0.4.x86_64. 3.2 MB/s | 1.1 MB 00:00
(5/6): tar-1.34-1.amzn2023.0.4.x86_64.rpm 4.5 MB/s | 879 kB 00:00
(6/6): openssl-3.0.8-1.amzn2023.0.11.x86_64.rpm 4.3 MB/s | 1.2 MB 00:00
--------------------------------------------------------------------------------
Total 3.4 MB/s | 4.0 MB 00:01
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : libsemanage-3.4-5.amzn2023.0.2.x86_64 1/6
Installing : shadow-utils-2:4.9-12.amzn2023.0.4.x86_64 2/6
Installing : tar-2:1.34-1.amzn2023.0.4.x86_64 3/6
Installing : openssl-1:3.0.8-1.amzn2023.0.11.x86_64 4/6
Installing : xz-5.2.5-9.amzn2023.0.2.x86_64 5/6
Installing : findutils-1:4.8.0-2.amzn2023.0.2.x86_64 6/6
Running scriptlet: findutils-1:4.8.0-2.amzn2023.0.2.x86_64 6/6
Verifying : findutils-1:4.8.0-2.amzn2023.0.2.x86_64 1/6
Verifying : shadow-utils-2:4.9-12.amzn2023.0.4.x86_64 2/6
Verifying : libsemanage-3.4-5.amzn2023.0.2.x86_64 3/6
Verifying : xz-5.2.5-9.amzn2023.0.2.x86_64 4/6
Verifying : openssl-1:3.0.8-1.amzn2023.0.11.x86_64 5/6
Verifying : tar-2:1.34-1.amzn2023.0.4.x86_64 6/6
Installed:
findutils-1:4.8.0-2.amzn2023.0.2.x86_64
libsemanage-3.4-5.amzn2023.0.2.x86_64
openssl-1:3.0.8-1.amzn2023.0.11.x86_64
shadow-utils-2:4.9-12.amzn2023.0.4.x86_64
tar-2:1.34-1.amzn2023.0.4.x86_64
xz-5.2.5-9.amzn2023.0.2.x86_64
Complete!
---> Removed intermediate container 6a64e26518a4
---> 5b3e9271ba77
Step 5/32 : COPY config/opensearch.yml /
---> 66d04da8a2d8
Step 6/32 : COPY config/config.sh .
---> 7f89b72b7e27
Step 7/32 : COPY config/config.yml /
---> 3c50ffe2020a
Step 8/32 : COPY config/action_groups.yml /
---> a1f94b812abf
Step 9/32 : COPY config/internal_users.yml /
---> c7d10c9bf9c2
Step 10/32 : COPY config/roles_mapping.yml /
---> 878337d9149f
Step 11/32 : COPY config/roles.yml /
---> 5de5ddf8a601
Step 12/32 : RUN bash config.sh
---> Running in 1bfe3f5fab56
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 723M 100 723M 0 0 10.0M 0 0:01:12 0:01:12 --:--:-- 9051k
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 36313 100 36313 0 0 128k 0 --:--:-- --:--:-- --:--:-- 128k
Cert tool exists in Packages-dev bucket
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 42851 100 42851 0 0 144k 0 --:--:-- --:--:-- --:--:-- 144k
Password tool exists in Packages-dev bucket
13/03/2024 15:05:13 INFO: Generating the root certificate.
13/03/2024 15:05:13 INFO: Generating Admin certificates.
13/03/2024 15:05:14 INFO: Admin certificates created.
13/03/2024 15:05:14 INFO: Generating Wazuh indexer certificates.
13/03/2024 15:05:14 INFO: Wazuh indexer certificates created.
---> Removed intermediate container 1bfe3f5fab56
---> 750ca0e2494d
Step 13/32 : FROM amazonlinux:2023.3.20240304.0
---> d54cb79e59a5
Step 14/32 : ENV USER="wazuh-indexer" GROUP="wazuh-indexer" NAME="wazuh-indexer" INSTALL_DIR="/usr/share/wazuh-indexer"
---> Running in 67fa968d44f0
---> Removed intermediate container 67fa968d44f0
---> d81bcd36b9ca
Step 15/32 : RUN yum install curl-minimal shadow-utils findutils hostname -y
---> Running in 8e039ed39798
Amazon Linux 2023 repository 6.0 MB/s | 25 MB 00:04
Last metadata expiration check: 0:00:06 ago on Wed Mar 13 15:05:30 2024.
Package curl-minimal-8.5.0-1.amzn2023.0.2.x86_64 is already installed.
Dependencies resolved.
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
findutils x86_64 1:4.8.0-2.amzn2023.0.2 amazonlinux 539 k
hostname x86_64 3.23-4.amzn2023.0.3 amazonlinux 28 k
shadow-utils x86_64 2:4.9-12.amzn2023.0.4 amazonlinux 1.1 M
Installing dependencies:
libsemanage x86_64 3.4-5.amzn2023.0.2 amazonlinux 121 k
Transaction Summary
================================================================================
Install 4 Packages
Total download size: 1.8 M
Installed size: 5.7 M
Downloading Packages:
(1/4): libsemanage-3.4-5.amzn2023.0.2.x86_64.rp 703 kB/s | 121 kB 00:00
(2/4): findutils-4.8.0-2.amzn2023.0.2.x86_64.rp 2.1 MB/s | 539 kB 00:00
(3/4): hostname-3.23-4.amzn2023.0.3.x86_64.rpm 341 kB/s | 28 kB 00:00
(4/4): shadow-utils-4.9-12.amzn2023.0.4.x86_64. 3.0 MB/s | 1.1 MB 00:00
--------------------------------------------------------------------------------
Total 1.7 MB/s | 1.8 MB 00:01
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : libsemanage-3.4-5.amzn2023.0.2.x86_64 1/4
Installing : shadow-utils-2:4.9-12.amzn2023.0.4.x86_64 2/4
Installing : hostname-3.23-4.amzn2023.0.3.x86_64 3/4
Running scriptlet: hostname-3.23-4.amzn2023.0.3.x86_64 3/4
Installing : findutils-1:4.8.0-2.amzn2023.0.2.x86_64 4/4
Running scriptlet: findutils-1:4.8.0-2.amzn2023.0.2.x86_64 4/4
Verifying : findutils-1:4.8.0-2.amzn2023.0.2.x86_64 1/4
Verifying : shadow-utils-2:4.9-12.amzn2023.0.4.x86_64 2/4
Verifying : libsemanage-3.4-5.amzn2023.0.2.x86_64 3/4
Verifying : hostname-3.23-4.amzn2023.0.3.x86_64 4/4
Installed:
findutils-1:4.8.0-2.amzn2023.0.2.x86_64
hostname-3.23-4.amzn2023.0.3.x86_64
libsemanage-3.4-5.amzn2023.0.2.x86_64
shadow-utils-2:4.9-12.amzn2023.0.4.x86_64
Complete!
---> Removed intermediate container 8e039ed39798
---> a96f4c943375
Step 16/32 : RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
---> Running in 72e098add48a
---> Removed intermediate container 72e098add48a
---> 36bab89f94a6
Step 17/32 : RUN useradd --system --uid 1000 --no-create-home --home-dir $INSTALL_DIR --gid $GROUP --shell /sbin/nologin --comment "$USER user" $USER
---> Running in 31852d22e4ef
useradd warning: wazuh-indexer's uid 1000 is greater than SYS_UID_MAX 999
---> Removed intermediate container 31852d22e4ef
---> 389039e0b850
Step 18/32 : WORKDIR $INSTALL_DIR
---> Running in d7c2d592bdef
---> Removed intermediate container d7c2d592bdef
---> 3cd397eabda1
Step 19/32 : COPY config/entrypoint.sh /
---> 2207790fa072
Step 20/32 : COPY config/securityadmin.sh /
---> 07495da6738b
Step 21/32 : RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh
---> Running in 0239b67783af
---> Removed intermediate container 0239b67783af
---> a8994da2d755
Step 22/32 : RUN chown 1000:1000 /*.sh
---> Running in 599c6538db30
---> Removed intermediate container 599c6538db30
---> 90d0111e8c09
Step 23/32 : COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer
---> 4dff394b62ab
Step 24/32 : COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd
---> a5a6f34315a8
Step 25/32 : COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d
---> af3da7e543e5
Step 26/32 : COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d
---> ecb3d3b2317c
Step 27/32 : RUN chown -R 1000:1000 /usr/share/wazuh-indexer
---> Running in 18ff5d820b4c
---> Removed intermediate container 18ff5d820b4c
---> d6f6812b5931
Step 28/32 : RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && chmod 700 /usr/share/wazuh-indexer && chmod 600 /usr/share/wazuh-indexer/jvm.options && chmod 600 /usr/share/wazuh-indexer/opensearch.yml
---> Running in 20d700125e22
---> Removed intermediate container 20d700125e22
---> 2b6613445f29
Step 29/32 : USER wazuh-indexer
---> Running in da9beb60896c
---> Removed intermediate container da9beb60896c
---> 1b16fbf6c2f7
Step 30/32 : EXPOSE 9200
---> Running in 5470bc5ad58e
---> Removed intermediate container 5470bc5ad58e
---> 7650be99102b
Step 31/32 : ENTRYPOINT ["/entrypoint.sh"]
---> Running in 49a6b73a8974
---> Removed intermediate container 49a6b73a8974
---> 180db3a69618
Step 32/32 : CMD ["opensearchwrapper"]
---> Running in 6144c802390b
---> Removed intermediate container 6144c802390b
---> 2e19579b35e5
Successfully built 2e19579b35e5
Successfully tagged wazuh/wazuh-indexer:4.8.0
Building wazuh.dashboard
Step 1/39 : FROM amazonlinux:2023.3.20240304.0 AS builder
---> d54cb79e59a5
Step 2/39 : ARG WAZUH_VERSION
---> Running in 4d9f36beb6db
---> Removed intermediate container 4d9f36beb6db
---> ea5e6765bff6
Step 3/39 : ARG WAZUH_TAG_REVISION
---> Running in 0a332b64ea5c
---> Removed intermediate container 0a332b64ea5c
---> ab9215a436f1
Step 4/39 : ARG INSTALL_DIR=/usr/share/wazuh-dashboard
---> Running in d3aee44304f9
---> Removed intermediate container d3aee44304f9
---> 10542a84b60b
Step 5/39 : ARG WAZUH_UI_REVISION
---> Running in c5ad7ff240c8
---> Removed intermediate container c5ad7ff240c8
---> 4903493e3141
Step 6/39 : RUN yum install curl-minimal libcap xz tar openssl -y
---> Running in 3062848ca2ca
Amazon Linux 2023 repository 8.1 MB/s | 25 MB 00:03
Last metadata expiration check: 0:00:06 ago on Wed Mar 13 15:05:59 2024.
Package curl-minimal-8.5.0-1.amzn2023.0.2.x86_64 is already installed.
Package libcap-2.48-2.amzn2023.0.3.x86_64 is already installed.
Dependencies resolved.
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
openssl x86_64 1:3.0.8-1.amzn2023.0.11 amazonlinux 1.2 M
tar x86_64 2:1.34-1.amzn2023.0.4 amazonlinux 879 k
xz x86_64 5.2.5-9.amzn2023.0.2 amazonlinux 215 k
Transaction Summary
================================================================================
Install 3 Packages
Total download size: 2.2 M
Installed size: 5.5 M
Downloading Packages:
(1/3): xz-5.2.5-9.amzn2023.0.2.x86_64.rpm 1.6 MB/s | 215 kB 00:00
(2/3): tar-1.34-1.amzn2023.0.4.x86_64.rpm 2.6 MB/s | 879 kB 00:00
(3/3): openssl-3.0.8-1.amzn2023.0.11.x86_64.rpm 3.4 MB/s | 1.2 MB 00:00
--------------------------------------------------------------------------------
Total 2.3 MB/s | 2.2 MB 00:00
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : tar-2:1.34-1.amzn2023.0.4.x86_64 1/3
Installing : openssl-1:3.0.8-1.amzn2023.0.11.x86_64 2/3
Installing : xz-5.2.5-9.amzn2023.0.2.x86_64 3/3
Running scriptlet: xz-5.2.5-9.amzn2023.0.2.x86_64 3/3
Verifying : xz-5.2.5-9.amzn2023.0.2.x86_64 1/3
Verifying : openssl-1:3.0.8-1.amzn2023.0.11.x86_64 2/3
Verifying : tar-2:1.34-1.amzn2023.0.4.x86_64 3/3
Installed:
openssl-1:3.0.8-1.amzn2023.0.11.x86_64 tar-2:1.34-1.amzn2023.0.4.x86_64
xz-5.2.5-9.amzn2023.0.2.x86_64
Complete!
---> Removed intermediate container 3062848ca2ca
---> 3133adf83801
Step 7/39 : RUN mkdir -p $INSTALL_DIR
---> Running in 093c224f8aec
---> Removed intermediate container 093c224f8aec
---> 75524e77f1aa
Step 8/39 : COPY config/dl_base.sh .
---> 6406c101ca40
Step 9/39 : RUN bash dl_base.sh
---> Running in 35912cdb4441
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 153M 100 153M 0 0 10.9M 0 0:00:14 0:00:14 --:--:-- 11.6M
---> Removed intermediate container 35912cdb4441
---> a3d4709f9337
Step 10/39 : COPY config/config.sh .
---> e09d73975563
Step 11/39 : COPY config/config.yml /
---> 93e9ebbc5eac
Step 12/39 : RUN bash config.sh
---> Running in 51ef188ad212
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 36313 100 36313 0 0 113k 0 --:--:-- --:--:-- --:--:-- 114k
Cert tool exists in Packages-dev bucket
13/03/2024 15:06:53 INFO: Generating the root certificate.
13/03/2024 15:06:53 INFO: Generating Admin certificates.
13/03/2024 15:06:53 INFO: Admin certificates created.
13/03/2024 15:06:53 INFO: Generating Wazuh dashboard certificates.
13/03/2024 15:06:54 INFO: Wazuh dashboard certificates created.
---> Removed intermediate container 51ef188ad212
---> 865774b52a6c
Step 13/39 : COPY config/install_wazuh_app.sh /
---> 36e3ae39f952
Step 14/39 : RUN chmod 775 /install_wazuh_app.sh
---> Running in 0a408128394c
---> Removed intermediate container 0a408128394c
---> 7c1d2081c02e
Step 15/39 : RUN bash /install_wazuh_app.sh
---> Running in 9de9765754c6
Attempting to transfer from https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-4.8.0-1.zip
Transferring 34136679 bytes....................
Transfer complete
Retrieving metadata from plugin archive
Extracting plugin archive
Extraction complete
Plugin installation complete
Attempting to transfer from https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCheckUpdates-4.8.0-1.zip
Transferring 1877165 bytes....................
Transfer complete
Retrieving metadata from plugin archive
Extracting plugin archive
Extraction complete
Plugin installation complete
Attempting to transfer from https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCore-4.8.0-1.zip
Transferring 3208626 bytes....................
Transfer complete
Retrieving metadata from plugin archive
Extracting plugin archive
Extraction complete
Plugin installation complete
---> Removed intermediate container 9de9765754c6
---> e8a319753ed6
Step 16/39 : COPY config/opensearch_dashboards.yml $INSTALL_DIR/config/
---> 902778d8f61f
Step 17/39 : COPY config/wazuh.yml $INSTALL_DIR/data/wazuh/config/
---> 4433f52e3865
Step 18/39 : RUN chmod 664 $INSTALL_DIR/config/opensearch_dashboards.yml
---> Running in b385022dfd0c
---> Removed intermediate container b385022dfd0c
---> 168d84600a5b
Step 19/39 : RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh
---> Running in 1f667015e821
---> Removed intermediate container 1f667015e821
---> 553529dffa04
Step 20/39 : RUN mkdir -p $INSTALL_DIR/data/wazuh/config && chmod -R 775 $INSTALL_DIR/data/wazuh/config
---> Running in c5d5742dd82d
---> Removed intermediate container c5d5742dd82d
---> 865f147066f9
Step 21/39 : RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazuh/logs
---> Running in c18885b623ba
---> Removed intermediate container c18885b623ba
---> 8eb5d317b202
Step 22/39 : FROM amazonlinux:2023.3.20240304.0
---> d54cb79e59a5
Step 23/39 : ENV USER="wazuh-dashboard" GROUP="wazuh-dashboard" NAME="wazuh-dashboard" INSTALL_DIR="/usr/share/wazuh-dashboard"
---> Running in 2ed63b4faf2c
---> Removed intermediate container 2ed63b4faf2c
---> 64daff836cc4
Step 24/39 : ENV PATTERN="" CHECKS_PATTERN="" CHECKS_TEMPLATE="" CHECKS_API="" CHECKS_SETUP="" EXTENSIONS_PCI="" EXTENSIONS_GDPR="" EXTENSIONS_HIPAA="" EXTENSIONS_NIST="" EXTENSIONS_TSC="" EXTENSIONS_AUDIT="" EXTENSIONS_OSCAP="" EXTENSIONS_CISCAT="" EXTENSIONS_AWS="" EXTENSIONS_GCP="" EXTENSIONS_GITHUB="" EXTENSIONS_OFFICE="" EXTENSIONS_VIRUSTOTAL="" EXTENSIONS_OSQUERY="" EXTENSIONS_DOCKER="" APP_TIMEOUT="" API_SELECTOR="" IP_SELECTOR="" IP_IGNORE="" WAZUH_MONITORING_ENABLED="" WAZUH_MONITORING_FREQUENCY="" WAZUH_MONITORING_SHARDS="" WAZUH_MONITORING_REPLICAS=""
---> Running in a10e2d5f5ac8
---> Removed intermediate container a10e2d5f5ac8
---> 38a3c5c1c433
Step 25/39 : RUN yum install shadow-utils -y
---> Running in e25e3270cb15
Amazon Linux 2023 repository 3.8 MB/s | 25 MB 00:06
Last metadata expiration check: 0:00:06 ago on Wed Mar 13 15:07:16 2024.
Dependencies resolved.
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
shadow-utils x86_64 2:4.9-12.amzn2023.0.4 amazonlinux 1.1 M
Installing dependencies:
libsemanage x86_64 3.4-5.amzn2023.0.2 amazonlinux 121 k
Transaction Summary
================================================================================
Install 2 Packages
Total download size: 1.2 M
Installed size: 4.0 M
Downloading Packages:
(1/2): libsemanage-3.4-5.amzn2023.0.2.x86_64.rp 99 kB/s | 121 kB 00:01
(2/2): shadow-utils-4.9-12.amzn2023.0.4.x86_64. 762 kB/s | 1.1 MB 00:01
--------------------------------------------------------------------------------
Total 463 kB/s | 1.2 MB 00:02
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : libsemanage-3.4-5.amzn2023.0.2.x86_64 1/2
Installing : shadow-utils-2:4.9-12.amzn2023.0.4.x86_64 2/2
Running scriptlet: shadow-utils-2:4.9-12.amzn2023.0.4.x86_64 2/2
Verifying : shadow-utils-2:4.9-12.amzn2023.0.4.x86_64 1/2
Verifying : libsemanage-3.4-5.amzn2023.0.2.x86_64 2/2
Installed:
libsemanage-3.4-5.amzn2023.0.2.x86_64
shadow-utils-2:4.9-12.amzn2023.0.4.x86_64
Complete!
---> Removed intermediate container e25e3270cb15
---> e9066bbf1bcc
Step 26/39 : RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
---> Running in 9953b7b7dbc6
---> Removed intermediate container 9953b7b7dbc6
---> d345e1907f3d
Step 27/39 : RUN useradd --system --uid 1000 --no-create-home --home-dir $INSTALL_DIR --gid $GROUP --shell /sbin/nologin --comment "$USER user" $USER
---> Running in 914f448b0b5a
useradd warning: wazuh-dashboard's uid 1000 is greater than SYS_UID_MAX 999
---> Removed intermediate container 914f448b0b5a
---> 67ed38db421d
Step 28/39 : COPY config/entrypoint.sh /
---> 6081d03ea785
Step 29/39 : COPY config/wazuh_app_config.sh /
---> 187ed79276cb
Step 30/39 : RUN chmod 700 /entrypoint.sh
---> Running in 6efec56ad592
---> Removed intermediate container 6efec56ad592
---> 14599895ac53
Step 31/39 : RUN chmod 700 /wazuh_app_config.sh
---> Running in 712d2a1f20f5
---> Removed intermediate container 712d2a1f20f5
---> 5807ee983f44
Step 32/39 : RUN chown 1000:1000 /*.sh
---> Running in a07c9626db6a
---> Removed intermediate container a07c9626db6a
---> 0ed6a09e3fb7
Step 33/39 : COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
---> 8d4db245b57c
Step 34/39 : RUN mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
---> Running in dbff2b68b85d
---> Removed intermediate container dbff2b68b85d
---> 02bbad08ed41
Step 35/39 : RUN chown 1000:1000 /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
---> Running in 3a853d3b789c
---> Removed intermediate container 3a853d3b789c
---> 305a246239b7
Step 36/39 : WORKDIR $INSTALL_DIR
---> Running in 65392d4b7868
---> Removed intermediate container 65392d4b7868
---> 8159cd529de3
Step 37/39 : USER wazuh-dashboard
---> Running in 20350050515e
---> Removed intermediate container 20350050515e
---> 68b83c308389
Step 38/39 : EXPOSE 443
---> Running in 0b4a3653d4ea
---> Removed intermediate container 0b4a3653d4ea
---> 62fbe97abc62
Step 39/39 : ENTRYPOINT [ "/entrypoint.sh" ]
---> Running in c4897ee85774
---> Removed intermediate container c4897ee85774
---> 12dc721f8554
Successfully built 12dc721f8554
Successfully tagged wazuh/wazuh-dashboard:4.8.0 |
Docker Compose deploy:$ cd single-node/
$ docker-compose up -d
Creating network "single-node_default" with the default driver
Creating volume "single-node_wazuh_api_configuration" with default driver
Creating volume "single-node_wazuh_etc" with default driver
Creating volume "single-node_wazuh_logs" with default driver
Creating volume "single-node_wazuh_queue" with default driver
Creating volume "single-node_wazuh_var_multigroups" with default driver
Creating volume "single-node_wazuh_integrations" with default driver
Creating volume "single-node_wazuh_active_response" with default driver
Creating volume "single-node_wazuh_agentless" with default driver
Creating volume "single-node_wazuh_wodles" with default driver
Creating volume "single-node_filebeat_etc" with default driver
Creating volume "single-node_filebeat_var" with default driver
Creating volume "single-node_wazuh-indexer-data" with default driver
Creating volume "single-node_wazuh-dashboard-config" with default driver
Creating volume "single-node_wazuh-dashboard-custom" with default driver
Creating single-node_wazuh.manager_1 ... done
Creating single-node_wazuh.indexer_1 ... done
Creating single-node_wazuh.dashboard_1 ... done
$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
d27d30a4dd36 wazuh/wazuh-dashboard:4.8.0 "/entrypoint.sh" About a minute ago Up About a minute 443/tcp, 0.0.0.0:443->5601/tcp, :::443->5601/tcp single-node_wazuh.dashboard_1
97c89265ab47 wazuh/wazuh-indexer:4.8.0 "/entrypoint.sh open…" About a minute ago Up About a minute 0.0.0.0:9200->9200/tcp, :::9200->9200/tcp single-node_wazuh.indexer_1
31eb69c0a924 wazuh/wazuh-manager:4.8.0 "/init" About a minute ago Up About a minute 0.0.0.0:1514-1515->1514-1515/tcp, :::1514-1515->1514-1515/tcp, 0.0.0.0:514->514/udp, :::514->514/udp, 0.0.0.0:55000->55000/tcp, :::55000->55000/tcp, 1516/tcp single-node_wazuh.manager_1Wazuh manager logs:$ docker logs single-node_wazuh.manager_1
[s6-init] making user provided files available at /var/run/s6/etc...exited 0.
[s6-init] ensuring user provided files have correct perms...exited 0.
[fix-attrs.d] applying ownership & permissions fixes...
[fix-attrs.d] done.
[cont-init.d] executing container initialization scripts...
[cont-init.d] 0-wazuh-init: executing...
/var/ossec/data_tmp/permanent/var/ossec/api/configuration/
Installing /var/ossec/api/configuration
/var/ossec/data_tmp/permanent/var/ossec/etc/
Installing /var/ossec/etc
/var/ossec/data_tmp/permanent/var/ossec/logs/
Installing /var/ossec/logs
/var/ossec/data_tmp/permanent/var/ossec/queue/
Installing /var/ossec/queue
/var/ossec/data_tmp/permanent/var/ossec/agentless/
The path /var/ossec/agentless is empty, skiped
/var/ossec/data_tmp/permanent/var/ossec/var/multigroups/
The path /var/ossec/var/multigroups is empty, skiped
/var/ossec/data_tmp/permanent/var/ossec/integrations/
The path /var/ossec/integrations is empty, skiped
/var/ossec/data_tmp/permanent/var/ossec/active-response/bin/
The path /var/ossec/active-response/bin is empty, skiped
/var/ossec/data_tmp/permanent/var/ossec/wodles/
Installing /var/ossec/wodles
/var/ossec/data_tmp/permanent/etc/filebeat/
Installing /etc/filebeat
Updating /var/ossec/etc/internal_options.conf
Updating /var/ossec/integrations/slack
Updating /var/ossec/integrations/slack.py
Updating /var/ossec/integrations/virustotal
Updating /var/ossec/integrations/virustotal.py
Updating /var/ossec/integrations/shuffle
Updating /var/ossec/integrations/shuffle.py
Updating /var/ossec/integrations/pagerduty
Updating /var/ossec/integrations/pagerduty.py
Updating /var/ossec/integrations/maltiverse
Updating /var/ossec/integrations/maltiverse.py
Updating /var/ossec/active-response/bin/default-firewall-drop
Updating /var/ossec/active-response/bin/disable-account
Updating /var/ossec/active-response/bin/firewalld-drop
Updating /var/ossec/active-response/bin/firewall-drop
Updating /var/ossec/active-response/bin/host-deny
Updating /var/ossec/active-response/bin/ip-customblock
Updating /var/ossec/active-response/bin/ipfw
Updating /var/ossec/active-response/bin/kaspersky.py
Updating /var/ossec/active-response/bin/kaspersky
Updating /var/ossec/active-response/bin/npf
Updating /var/ossec/active-response/bin/wazuh-slack
Updating /var/ossec/active-response/bin/pf
Updating /var/ossec/active-response/bin/restart-wazuh
Updating /var/ossec/active-response/bin/restart.sh
Updating /var/ossec/active-response/bin/route-null
Updating /var/ossec/agentless/sshlogin.exp
Updating /var/ossec/agentless/ssh_pixconfig_diff
Updating /var/ossec/agentless/ssh_asa-fwsmconfig_diff
Updating /var/ossec/agentless/ssh_integrity_check_bsd
Updating /var/ossec/agentless/main.exp
Updating /var/ossec/agentless/su.exp
Updating /var/ossec/agentless/ssh_integrity_check_linux
Updating /var/ossec/agentless/register_host.sh
Updating /var/ossec/agentless/ssh_generic_diff
Updating /var/ossec/agentless/ssh_foundry_diff
Updating /var/ossec/agentless/ssh_nopass.exp
Updating /var/ossec/agentless/ssh.exp
Updating /var/ossec/wodles/utils.py
Updating /var/ossec/wodles/aws/aws-s3
Updating /var/ossec/wodles/aws/aws-s3.py
Updating /var/ossec/wodles/aws/__init__.py
Updating /var/ossec/wodles/aws/aws_tools.py
Updating /var/ossec/wodles/aws/wazuh_integration.py
Updating /var/ossec/wodles/aws/buckets_s3/__init__.py
Updating /var/ossec/wodles/aws/buckets_s3/aws_bucket.py
Updating /var/ossec/wodles/aws/buckets_s3/cloudtrail.py
Updating /var/ossec/wodles/aws/buckets_s3/config.py
Updating /var/ossec/wodles/aws/buckets_s3/guardduty.py
Updating /var/ossec/wodles/aws/buckets_s3/load_balancers.py
Updating /var/ossec/wodles/aws/buckets_s3/server_access.py
Updating /var/ossec/wodles/aws/buckets_s3/umbrella.py
Updating /var/ossec/wodles/aws/buckets_s3/vpcflow.py
Updating /var/ossec/wodles/aws/buckets_s3/waf.py
Updating /var/ossec/wodles/aws/services/__init__.py
Updating /var/ossec/wodles/aws/services/aws_service.py
Updating /var/ossec/wodles/aws/services/cloudwatchlogs.py
Updating /var/ossec/wodles/aws/services/inspector.py
Updating /var/ossec/wodles/aws/subscribers/__init__.py
Updating /var/ossec/wodles/aws/subscribers/s3_log_handler.py
Updating /var/ossec/wodles/aws/subscribers/sqs_message_processor.py
Updating /var/ossec/wodles/aws/subscribers/sqs_queue.py
Updating /var/ossec/wodles/azure/azure-logs
Updating /var/ossec/wodles/azure/azure-logs.py
Updating /var/ossec/wodles/azure/orm.py
Updating /var/ossec/wodles/docker/DockerListener
Updating /var/ossec/wodles/docker/DockerListener.py
Updating /var/ossec/wodles/gcloud/gcloud
Updating /var/ossec/wodles/gcloud/gcloud.py
Updating /var/ossec/wodles/gcloud/integration.py
Updating /var/ossec/wodles/gcloud/tools.py
Updating /var/ossec/wodles/gcloud/exceptions.py
find: '/proc/391/task/391/fd/5': No such file or directory
find: '/proc/391/task/391/fdinfo/5': No such file or directory
find: '/proc/391/fd/6': No such file or directory
find: '/proc/391/fdinfo/6': No such file or directory
find: '/proc/392/task/392/fd/5': No such file or directory
find: '/proc/392/task/392/fdinfo/5': No such file or directory
find: '/proc/392/fd/6': No such file or directory
find: '/proc/392/fdinfo/6': No such file or directory
find: '/proc/393/task/393/fd/5': No such file or directory
find: '/proc/393/task/393/fdinfo/5': No such file or directory
find: '/proc/393/fd/6': No such file or directory
find: '/proc/393/fdinfo/6': No such file or directory
Identified Wazuh configuration files to mount...
'/wazuh-config-mount/etc/ossec.conf' -> '/var/ossec/etc/ossec.conf'
[cont-init.d] 0-wazuh-init: exited 0.
[cont-init.d] 1-config-filebeat: executing...
Customize Elasticsearch ouput IP
Configuring username.
Configuring password.
Configuring SSL verification mode.
Configuring Certificate Authorities.
Configuring SSL Certificate.
Configuring SSL Key.
[cont-init.d] 1-config-filebeat: exited 0.
[cont-init.d] 2-manager: executing...
Configuring password.
2024/03/13 15:08:31 wazuh-modulesd:router: INFO: Loaded router module.
2024/03/13 15:08:31 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
Starting Wazuh v4.8.0...
Started wazuh-apid...
Started wazuh-csyslogd...
Started wazuh-dbd...
2024/03/13 15:08:34 wazuh-integratord: INFO: Remote integrations not configured. Clean exit.
Started wazuh-integratord...
Started wazuh-agentlessd...
Started wazuh-authd...
Started wazuh-db...
Started wazuh-execd...
Started wazuh-analysisd...
Started wazuh-syscheckd...
Started wazuh-remoted...
Started wazuh-logcollector...
Started wazuh-monitord...
2024/03/13 15:08:42 wazuh-modulesd:router: INFO: Loaded router module.
2024/03/13 15:08:42 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
Started wazuh-modulesd...
Completed.
[cont-init.d] 2-manager: exited 0.
[cont-init.d] done.
[services.d] starting services
[services.d] done.
starting Filebeat
2024/03/13 15:08:42 wazuh-modulesd:ciscat: INFO: Module disabled. Exiting...
2024/03/13 15:08:42 sca: INFO: Starting Security Configuration Assessment scan.
2024/03/13 15:08:42 wazuh-modulesd:task-manager: INFO: (8200): Module Task Manager started.
2024/03/13 15:08:42 sca: INFO: Skipping policy '/var/ossec/ruleset/sca/cis_amazon_linux_1.yml': 'Check Amazon Linux version.'
2024/03/13 15:08:42 sca: INFO: Security Configuration Assessment scan finished. Duration: 0 seconds.
2024/03/13 15:08:42 wazuh-modulesd:syscollector: INFO: Module started.
2024/03/13 15:08:42 wazuh-modulesd:syscollector: INFO: Starting evaluation.
2024/03/13 15:08:43 wazuh-modulesd:syscollector: INFO: Evaluation finished.
2024/03/13 15:08:43 wazuh-modulesd:vulnerability-scanner: INFO: Starting database file decompression.
2024/03/13 15:08:43 indexer-connector: WARNING: Error initializing IndexerConnector for index 'wazuh-states-vulnerabilities': Failed to initialize template for index 'wazuh-states-vulnerabilities'. Error: Failed to initialize template for index 'wazuh-states-vulnerabilities'. Error: Couldn't connect to server. Retrying in 2 seconds. Maximum wait time: 60 seconds.
2024/03/13 15:08:46 indexer-connector: WARNING: Error initializing IndexerConnector for index 'wazuh-states-vulnerabilities': Failed to initialize template for index 'wazuh-states-vulnerabilities'. Error: Failed to initialize template for index 'wazuh-states-vulnerabilities'. HTTP error: HTTP response code said error (Status code: 503).. Retrying in 4 seconds. Maximum wait time: 60 seconds.
2024-03-13T15:08:46.450Z INFO instance/beat.go:645 Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2024-03-13T15:08:46.454Z INFO instance/beat.go:653 Beat ID: 98b115ab-1769-432b-b826-0dc934f92796
2024-03-13T15:08:46.455Z INFO [seccomp] seccomp/seccomp.go:124 Syscall filter successfully installed
2024-03-13T15:08:46.461Z INFO [beat] instance/beat.go:981 Beat info {"system_info": {"beat": {"path": {"config": "/etc/filebeat", "data": "/var/lib/filebeat", "home": "/usr/share/filebeat", "logs": "/var/log/filebeat"}, "type": "filebeat", "uuid": "98b115ab-1769-432b-b826-0dc934f92796"}}}
2024-03-13T15:08:46.461Z INFO [beat] instance/beat.go:990 Build info {"system_info": {"build": {"commit": "aacf9ecd9c494aa0908f61fbca82c906b16562a8", "libbeat": "7.10.2", "time": "2021-01-12T22:10:33.000Z", "version": "7.10.2"}}}
2024-03-13T15:08:46.461Z INFO [beat] instance/beat.go:993 Go runtime info {"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":4,"version":"go1.14.12"}}}
2024-03-13T15:08:46.462Z INFO [beat] instance/beat.go:997 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2024-03-13T08:25:08Z","containerized":true,"name":"wazuh.manager","ip":["127.0.0.1/8","172.22.0.3/16"],"kernel_version":"5.15.0-92-generic","mac":["02:42:ac:16:00:03"],"os":{"family":"redhat","platform":"amzn","name":"Amazon Linux","version":"2023","major":2023,"minor":3,"patch":20240304},"timezone":"UTC","timezone_offset_sec":0}}}
2024-03-13T15:08:46.462Z INFO [beat] instance/beat.go:1026 Process info {"system_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"effective":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"bounding":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"ambient":null}, "cwd": "/run/s6/services/filebeat", "exe": "/usr/share/filebeat/bin/filebeat", "name": "filebeat", "pid": 1170, "ppid": 1155, "seccomp": {"mode":"filter","no_new_privs":true}, "start_time": "2024-03-13T15:08:45.590Z"}}}
2024-03-13T15:08:46.463Z INFO instance/beat.go:299 Setup Beat: filebeat; Version: 7.10.2
2024-03-13T15:08:46.465Z INFO eslegclient/connection.go:99 elasticsearch url: https://wazuh.indexer:9200
2024-03-13T15:08:46.468Z INFO [publisher] pipeline/module.go:113 Beat name: wazuh.manager
2024-03-13T15:08:46.471Z INFO beater/filebeat.go:117 Enabled modules/filesets: wazuh (alerts), ()
2024-03-13T15:08:46.471Z INFO instance/beat.go:455 filebeat start running.
2024-03-13T15:08:46.475Z INFO memlog/store.go:119 Loading data file of '/var/lib/filebeat/registry/filebeat' succeeded. Active transaction id=0
2024-03-13T15:08:46.475Z INFO memlog/store.go:124 Finished loading transaction log file for '/var/lib/filebeat/registry/filebeat'. Active transaction id=0
2024-03-13T15:08:46.476Z INFO [registrar] registrar/registrar.go:109 States Loaded from registrar: 0
2024-03-13T15:08:46.476Z INFO [crawler] beater/crawler.go:71 Loading Inputs: 1
2024-03-13T15:08:46.477Z INFO log/input.go:157 Configured paths: [/var/ossec/logs/alerts/alerts.json]
2024-03-13T15:08:46.477Z INFO [crawler] beater/crawler.go:141 Starting input (ID: 9132358592892857476)
2024-03-13T15:08:46.477Z INFO [crawler] beater/crawler.go:108 Loading and starting Inputs completed. Enabled inputs: 1
2024-03-13T15:08:46.479Z INFO log/harvester.go:302 Harvester started for file: /var/ossec/logs/alerts/alerts.json
2024/03/13 15:08:50 indexer-connector: INFO: IndexerConnector initialized.
2024-03-13T15:08:54.488Z INFO [publisher] pipeline/retry.go:219 retryer: send unwait signal to consumer
2024-03-13T15:08:54.488Z INFO [publisher] pipeline/retry.go:223 done
2024-03-13T15:08:54.489Z INFO [publisher_pipeline_output] pipeline/output.go:143 Connecting to backoff(elasticsearch(https://wazuh.indexer:9200))
2024-03-13T15:08:54.539Z INFO [esclientleg] eslegclient/connection.go:314 Attempting to connect to Elasticsearch version 7.10.2
2024-03-13T15:08:54.543Z INFO [esclientleg] eslegclient/connection.go:314 Attempting to connect to Elasticsearch version 7.10.2
2024-03-13T15:08:54.548Z INFO template/load.go:183 Existing template will be overwritten, as overwrite is enabled.
2024-03-13T15:08:54.551Z INFO template/load.go:117 Try loading template wazuh to Elasticsearch
2024-03-13T15:08:54.692Z INFO template/load.go:109 template with name 'wazuh' loaded.
2024-03-13T15:08:54.692Z INFO [index-management] idxmgmt/std.go:298 Loaded index template.
2024-03-13T15:08:54.803Z INFO fileset/pipelines.go:143 Elasticsearch pipeline with ID 'filebeat-7.10.2-wazuh-alerts-pipeline' loaded
2024-03-13T15:08:54.806Z INFO [publisher_pipeline_output] pipeline/output.go:151 Connection to backoff(elasticsearch(https://wazuh.indexer:9200)) established
2024/03/13 15:08:58 rootcheck: INFO: Ending rootcheck scan.
2024/03/13 15:09:07 wazuh-modulesd:vulnerability-scanner: INFO: Database decompression finished.
2024/03/13 15:09:08 wazuh-modulesd:content-updater: INFO: Starting scheduled action for 'vulnerability_feed_manager'
2024/03/13 15:09:08 wazuh-modulesd:content-updater: INFO: Action for 'vulnerability_feed_manager' started
2024/03/13 15:09:08 wazuh-modulesd:vulnerability-scanner: INFO: Vulnerability scanner module started
2024/03/13 15:09:15 wazuh-modulesd:content-updater: INFO: Data published
2024/03/13 15:09:15 wazuh-modulesd:vulnerability-scanner: INFO: Processing message
2024/03/13 15:09:15 wazuh-modulesd:content-updater: INFO: Action for 'vulnerability_feed_manager' finished
2024/03/13 15:09:15 wazuh-modulesd:vulnerability-scanner: INFO: Processing file: queue/vd_updater/tmp/contents/245855-api_file.json
2024/03/13 15:09:27 wazuh-modulesd:content-updater: INFO: Starting on-demand action for 'vulnerability_feed_manager'
2024/03/13 15:09:27 wazuh-modulesd:content-updater: INFO: Action for 'vulnerability_feed_manager' started
2024/03/13 15:09:27 wazuh-modulesd:content-updater: INFO: Action for 'vulnerability_feed_manager' finishedWazuh dashboard deploy:$ docker logs single-node_wazuh.dashboard_1
Created OpenSearch Dashboards keystore in /usr/share/wazuh-dashboard/config/opensearch_dashboards.keystore
Wazuh APP already configured
{"type":"log","@timestamp":"2024-03-13T15:08:29Z","tags":["info","plugins-service"],"pid":55,"message":"Plugin \"dataSourceManagement\" has been disabled since the following direct or transitive dependencies are missing or disabled: [dataSource]"}
{"type":"log","@timestamp":"2024-03-13T15:08:29Z","tags":["info","plugins-service"],"pid":55,"message":"Plugin \"dataSource\" is disabled."}
{"type":"log","@timestamp":"2024-03-13T15:08:29Z","tags":["info","plugins-service"],"pid":55,"message":"Plugin \"visTypeXy\" is disabled."}
{"type":"log","@timestamp":"2024-03-13T15:08:29Z","tags":["warning","config","deprecation"],"pid":55,"message":"\"opensearch.requestHeadersWhitelist\" is deprecated and has been replaced by \"opensearch.requestHeadersAllowlist\""}
{"type":"log","@timestamp":"2024-03-13T15:08:29Z","tags":["info","plugins-system"],"pid":55,"message":"Setting up [48] plugins: [usageCollection,opensearchDashboardsUsageCollection,opensearchDashboardsLegacy,mapsLegacy,share,opensearchUiShared,legacyExport,embeddable,expressions,data,home,apmOss,savedObjects,dashboard,visualizations,visTypeVega,visTypeTimeline,visTypeTable,visTypeMarkdown,visBuilder,visAugmenter,alertingDashboards,tileMap,regionMap,customImportMapDashboards,inputControlVis,visualize,ganttChartDashboards,reportsDashboards,indexManagementDashboards,management,indexPatternManagement,advancedSettings,console,notificationsDashboards,dataExplorer,charts,visTypeVislib,visTypeTimeseries,visTypeTagcloud,visTypeMetric,discover,savedObjectsManagement,securityDashboards,wazuhCore,wazuhCheckUpdates,wazuh,bfetch]"}
{"type":"log","@timestamp":"2024-03-13T15:08:30Z","tags":["info","savedobjects-service"],"pid":55,"message":"Waiting until all OpenSearch nodes are compatible with OpenSearch Dashboards before starting saved objects migrations..."}
{"type":"log","@timestamp":"2024-03-13T15:08:30Z","tags":["error","opensearch","data"],"pid":55,"message":"[ConnectionError]: connect ECONNREFUSED 172.22.0.2:9200"}
{"type":"log","@timestamp":"2024-03-13T15:08:30Z","tags":["error","savedobjects-service"],"pid":55,"message":"Unable to retrieve version information from OpenSearch nodes."}
{"type":"log","@timestamp":"2024-03-13T15:08:32Z","tags":["error","opensearch","data"],"pid":55,"message":"[ConnectionError]: connect ECONNREFUSED 172.22.0.2:9200"}
{"type":"log","@timestamp":"2024-03-13T15:08:35Z","tags":["error","opensearch","data"],"pid":55,"message":"[ConnectionError]: connect ECONNREFUSED 172.22.0.2:9200"}
{"type":"log","@timestamp":"2024-03-13T15:08:37Z","tags":["error","opensearch","data"],"pid":55,"message":"[ConnectionError]: connect ECONNREFUSED 172.22.0.2:9200"}
{"type":"log","@timestamp":"2024-03-13T15:08:40Z","tags":["error","opensearch","data"],"pid":55,"message":"[ConnectionError]: connect ECONNREFUSED 172.22.0.2:9200"}
{"type":"log","@timestamp":"2024-03-13T15:08:42Z","tags":["error","opensearch","data"],"pid":55,"message":"[ConnectionError]: connect ECONNREFUSED 172.22.0.2:9200"}
{"type":"log","@timestamp":"2024-03-13T15:08:46Z","tags":["error","opensearch","data"],"pid":55,"message":"[ResponseError]: Response Error"}
{"type":"log","@timestamp":"2024-03-13T15:08:48Z","tags":["info","savedobjects-service"],"pid":55,"message":"Starting saved objects migrations"}
{"type":"log","@timestamp":"2024-03-13T15:08:48Z","tags":["info","savedobjects-service"],"pid":55,"message":"Creating index .kibana_1."}
{"type":"log","@timestamp":"2024-03-13T15:08:48Z","tags":["info","savedobjects-service"],"pid":55,"message":"Pointing alias .kibana to .kibana_1."}
{"type":"log","@timestamp":"2024-03-13T15:08:48Z","tags":["info","savedobjects-service"],"pid":55,"message":"Finished in 355ms."}
{"type":"log","@timestamp":"2024-03-13T15:08:48Z","tags":["info","plugins-system"],"pid":55,"message":"Starting [48] plugins: [usageCollection,opensearchDashboardsUsageCollection,opensearchDashboardsLegacy,mapsLegacy,share,opensearchUiShared,legacyExport,embeddable,expressions,data,home,apmOss,savedObjects,dashboard,visualizations,visTypeVega,visTypeTimeline,visTypeTable,visTypeMarkdown,visBuilder,visAugmenter,alertingDashboards,tileMap,regionMap,customImportMapDashboards,inputControlVis,visualize,ganttChartDashboards,reportsDashboards,indexManagementDashboards,management,indexPatternManagement,advancedSettings,console,notificationsDashboards,dataExplorer,charts,visTypeVislib,visTypeTimeseries,visTypeTagcloud,visTypeMetric,discover,savedObjectsManagement,securityDashboards,wazuhCore,wazuhCheckUpdates,wazuh,bfetch]"}
{"type":"log","@timestamp":"2024-03-13T15:08:48Z","tags":["error","opensearch","data"],"pid":55,"message":"[ResponseError]: Response Error"}
{"type":"log","@timestamp":"2024-03-13T15:08:48Z","tags":["error","opensearch","data"],"pid":55,"message":"[ResponseError]: Response Error"}
{"type":"log","@timestamp":"2024-03-13T15:08:49Z","tags":["listening","info"],"pid":55,"message":"Server running at https://0.0.0.0:5601"}
{"type":"log","@timestamp":"2024-03-13T15:08:49Z","tags":["info","http","server","OpenSearchDashboards"],"pid":55,"message":"http server running at https://0.0.0.0:5601"}Wazuh indexer logs:$ docker logs single-node_wazuh.indexer_1
WARNING: A terminally deprecated method in java.lang.System has been called
WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
WARNING: System::setSecurityManager will be removed in a future release
WARNING: A terminally deprecated method in java.lang.System has been called
WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
WARNING: System::setSecurityManager will be removed in a future release
[2024-03-13T15:08:28,510][INFO ][o.o.n.Node ] [wazuh.indexer] version[2.10.0], pid[1], build[rpm/eee49cb340edc6c4d489bcd9324dda571fc8dc03/2023-09-20T23:54:29.889267151Z], OS[Linux/5.15.0-92-generic/amd64], JVM[Eclipse Adoptium/OpenJDK 64-Bit Server VM/17.0.8/17.0.8+7]
[2024-03-13T15:08:28,513][INFO ][o.o.n.Node ] [wazuh.indexer] JVM home [/usr/share/wazuh-indexer/jdk], using bundled JDK/JRE [true]
[2024-03-13T15:08:28,514][INFO ][o.o.n.Node ] [wazuh.indexer] JVM arguments [-Xshare:auto, -Dopensearch.networkaddress.cache.ttl=60, -Dopensearch.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -XX:+ShowCodeDetailsInExceptionMessages, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.locale.providers=SPI,COMPAT, -XX:+UseG1GC, -XX:G1ReservePercent=25, -XX:InitiatingHeapOccupancyPercent=30, -Djava.io.tmpdir=/tmp/opensearch-15974004542580842527, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=/var/lib/wazuh-indexer, -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Dclk.tck=100, -Djdk.attach.allowAttachSelf=true, -Djava.security.policy=file:///usr/share/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy, --add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED, -Xms1g, -Xmx1g, -XX:MaxDirectMemorySize=536870912, -Dopensearch.path.home=/usr/share/wazuh-indexer, -Dopensearch.path.conf=/usr/share/wazuh-indexer, -Dopensearch.distribution.type=rpm, -Dopensearch.bundled_jdk=true]
[2024-03-13T15:08:29,646][INFO ][o.o.s.s.t.SSLConfig ] [wazuh.indexer] SSL dual mode is disabled
[2024-03-13T15:08:29,646][INFO ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] OpenSearch Config path is /usr/share/wazuh-indexer
[2024-03-13T15:08:29,982][INFO ][o.o.s.s.DefaultSecurityKeyStore] [wazuh.indexer] JVM supports TLSv1.3
[2024-03-13T15:08:29,986][INFO ][o.o.s.s.DefaultSecurityKeyStore] [wazuh.indexer] Config directory is /usr/share/wazuh-indexer/, from there the key- and truststore files are resolved relatively
[2024-03-13T15:08:30,691][INFO ][o.o.s.s.DefaultSecurityKeyStore] [wazuh.indexer] TLS Transport Client Provider : JDK
[2024-03-13T15:08:30,693][INFO ][o.o.s.s.DefaultSecurityKeyStore] [wazuh.indexer] TLS Transport Server Provider : JDK
[2024-03-13T15:08:30,693][INFO ][o.o.s.s.DefaultSecurityKeyStore] [wazuh.indexer] TLS HTTP Provider : JDK
[2024-03-13T15:08:30,694][INFO ][o.o.s.s.DefaultSecurityKeyStore] [wazuh.indexer] Enabled TLS protocols for transport layer : [TLSv1.3, TLSv1.2]
[2024-03-13T15:08:30,694][INFO ][o.o.s.s.DefaultSecurityKeyStore] [wazuh.indexer] Enabled TLS protocols for HTTP layer : [TLSv1.3, TLSv1.2]
[2024-03-13T15:08:30,718][INFO ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] Clustername: opensearch
[2024-03-13T15:08:30,809][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] Directory /usr/share/wazuh-indexer/.cache has insecure file permissions (should be 0700)
[2024-03-13T15:08:30,810][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] Directory /usr/share/wazuh-indexer/.cache/JNA has insecure file permissions (should be 0700)
[2024-03-13T15:08:30,810][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] Directory /usr/share/wazuh-indexer/.cache/JNA/temp has insecure file permissions (should be 0700)
[2024-03-13T15:08:30,811][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] Directory /usr/share/wazuh-indexer/logs has insecure file permissions (should be 0700)
[2024-03-13T15:08:30,811][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/opensearch.yml has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,812][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/performance-analyzer-rca/bin/performance-analyzer-agent has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,812][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/performance-analyzer-rca/bin/performance-analyzer-rca has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,813][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/lib/jspawnhelper has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,813][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/serialver has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,814][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jdeprscan has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,814][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jmod has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,814][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jrunscript has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,815][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/java has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,815][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jfr has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,816][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jstack has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,817][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jinfo has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,817][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/javadoc has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,817][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jlink has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,818][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jimage has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,818][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/javap has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,818][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jar has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,819][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jhsdb has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,819][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jshell has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,819][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jcmd has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,820][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jstatd has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,820][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/javac has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,821][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jps has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,821][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jdb has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,821][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jdeps has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,822][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jconsole has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,822][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jstat has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,822][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jarsigner has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,822][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jmap has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,823][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/rmiregistry has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,823][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/jpackage has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,823][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/jdk/bin/keytool has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,824][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/opensearch-security/internal_users.yml has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,824][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-certs-tool.sh has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,824][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/bin/opensearch-plugin has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,824][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/bin/opensearch-env has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,825][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/bin/opensearch-performance-analyzer/performance-analyzer-agent has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,825][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/bin/opensearch-performance-analyzer/performance-analyzer-agent-cli has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,825][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/bin/opensearch-env-from-file has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,825][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/bin/opensearch-upgrade has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,826][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/bin/opensearch-shard has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,826][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/bin/opensearch-cli has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,826][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/bin/opensearch-keystore has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,826][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/bin/opensearch has insecure file permissions (should be 0600)
[2024-03-13T15:08:30,827][WARN ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] File /usr/share/wazuh-indexer/bin/opensearch-node has insecure file permissions (should be 0600)
[2024-03-13T15:08:34,905][INFO ][o.o.p.c.c.PluginSettings ] [wazuh.indexer] Trying to create directory /dev/shm/performanceanalyzer/.
[2024-03-13T15:08:34,906][INFO ][o.o.p.c.c.PluginSettings ] [wazuh.indexer] Config: metricsLocation: /dev/shm/performanceanalyzer/, metricsDeletionInterval: 1, httpsEnabled: false, cleanup-metrics-db-files: true, batch-metrics-retention-period-minutes: 7, rpc-port: 9650, webservice-port 9600
[2024-03-13T15:08:35,446][INFO ][o.o.i.r.ReindexPlugin ] [wazuh.indexer] ReindexPlugin reloadSPI called
[2024-03-13T15:08:35,449][INFO ][o.o.i.r.ReindexPlugin ] [wazuh.indexer] Unable to find any implementation for RemoteReindexExtension
[2024-03-13T15:08:35,507][INFO ][o.o.j.JobSchedulerPlugin ] [wazuh.indexer] Loaded scheduler extension: opendistro_anomaly_detector, index: .opendistro-anomaly-detector-jobs
[2024-03-13T15:08:35,526][INFO ][o.o.j.JobSchedulerPlugin ] [wazuh.indexer] Loaded scheduler extension: reports-scheduler, index: .opendistro-reports-definitions
[2024-03-13T15:08:35,527][INFO ][o.o.j.JobSchedulerPlugin ] [wazuh.indexer] Loaded scheduler extension: opendistro-index-management, index: .opendistro-ism-config
[2024-03-13T15:08:35,529][INFO ][o.o.j.JobSchedulerPlugin ] [wazuh.indexer] Loaded scheduler extension: scheduler_geospatial_ip2geo_datasource, index: .scheduler-geospatial-ip2geo-datasource
[2024-03-13T15:08:35,534][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [aggs-matrix-stats]
[2024-03-13T15:08:35,534][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [analysis-common]
[2024-03-13T15:08:35,534][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [geo]
[2024-03-13T15:08:35,535][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [ingest-common]
[2024-03-13T15:08:35,535][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [ingest-geoip]
[2024-03-13T15:08:35,535][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [ingest-user-agent]
[2024-03-13T15:08:35,535][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [lang-expression]
[2024-03-13T15:08:35,535][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [lang-mustache]
[2024-03-13T15:08:35,535][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [lang-painless]
[2024-03-13T15:08:35,536][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [mapper-extras]
[2024-03-13T15:08:35,536][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [opensearch-dashboards]
[2024-03-13T15:08:35,536][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [parent-join]
[2024-03-13T15:08:35,536][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [percolator]
[2024-03-13T15:08:35,536][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [rank-eval]
[2024-03-13T15:08:35,537][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [reindex]
[2024-03-13T15:08:35,537][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [repository-url]
[2024-03-13T15:08:35,537][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [search-pipeline-common]
[2024-03-13T15:08:35,537][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [systemd]
[2024-03-13T15:08:35,537][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded module [transport-netty4]
[2024-03-13T15:08:35,538][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-alerting]
[2024-03-13T15:08:35,538][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-anomaly-detection]
[2024-03-13T15:08:35,538][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-asynchronous-search]
[2024-03-13T15:08:35,539][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-cross-cluster-replication]
[2024-03-13T15:08:35,539][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-custom-codecs]
[2024-03-13T15:08:35,539][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-geospatial]
[2024-03-13T15:08:35,539][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-index-management]
[2024-03-13T15:08:35,539][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-job-scheduler]
[2024-03-13T15:08:35,539][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-knn]
[2024-03-13T15:08:35,540][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-ml]
[2024-03-13T15:08:35,540][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-neural-search]
[2024-03-13T15:08:35,540][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-notifications]
[2024-03-13T15:08:35,540][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-notifications-core]
[2024-03-13T15:08:35,540][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-observability]
[2024-03-13T15:08:35,541][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-performance-analyzer]
[2024-03-13T15:08:35,541][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-reports-scheduler]
[2024-03-13T15:08:35,541][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-security]
[2024-03-13T15:08:35,541][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-security-analytics]
[2024-03-13T15:08:35,541][INFO ][o.o.p.PluginsService ] [wazuh.indexer] loaded plugin [opensearch-sql]
[2024-03-13T15:08:35,578][INFO ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] Disabled https compression by default to mitigate BREACH attacks. You can enable it by setting 'http.compression: true' in opensearch.yml
[2024-03-13T15:08:35,582][INFO ][o.o.e.ExtensionsManager ] [wazuh.indexer] ExtensionsManager initialized
[2024-03-13T15:08:35,725][INFO ][o.o.e.NodeEnvironment ] [wazuh.indexer] using [1] data paths, mounts [[/var/lib/wazuh-indexer (/dev/sda5)]], net usable_space [30.2gb], net total_space [99.9gb], types [ext4]
[2024-03-13T15:08:35,725][INFO ][o.o.e.NodeEnvironment ] [wazuh.indexer] heap size [1gb], compressed ordinary object pointers [true]
[2024-03-13T15:08:35,752][INFO ][o.o.n.Node ] [wazuh.indexer] node name [wazuh.indexer], node ID [g6QhEWYGTWWQ-1Urcv76uA], cluster name [opensearch], roles [ingest, remote_cluster_client, data, cluster_manager]
[2024-03-13T15:08:39,551][INFO ][o.o.n.p.NeuralSearch ] [wazuh.indexer] Registering hybrid query phase searcher with feature flag [plugins.neural_search.hybrid_search_disabled]
[2024-03-13T15:08:39,943][WARN ][o.o.s.c.Salt ] [wazuh.indexer] If you plan to use field masking pls configure compliance salt e1ukloTsQlOgPquJ to be a random string of 16 chars length identical on all nodes
[2024-03-13T15:08:39,977][ERROR][o.o.s.a.s.SinkProvider ] [wazuh.indexer] Default endpoint could not be created, auditlog will not work properly.
[2024-03-13T15:08:39,978][WARN ][o.o.s.a.r.AuditMessageRouter] [wazuh.indexer] No default storage available, audit log may not work properly. Please check configuration.
[2024-03-13T15:08:39,979][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Message routing enabled: false
[2024-03-13T15:08:40,013][INFO ][o.o.s.f.SecurityFilter ] [wazuh.indexer] <NONE> indices are made immutable.
[2024-03-13T15:08:40,316][INFO ][o.o.a.b.ADCircuitBreakerService] [wazuh.indexer] Registered memory breaker.
[2024-03-13T15:08:40,682][INFO ][o.o.m.b.MLCircuitBreakerService] [wazuh.indexer] Registered ML memory breaker.
[2024-03-13T15:08:40,684][INFO ][o.o.m.b.MLCircuitBreakerService] [wazuh.indexer] Registered ML disk breaker.
[2024-03-13T15:08:40,684][INFO ][o.o.m.b.MLCircuitBreakerService] [wazuh.indexer] Registered ML native memory breaker.
[2024-03-13T15:08:40,805][INFO ][o.r.Reflections ] [wazuh.indexer] Reflections took 47 ms to scan 1 urls, producing 17 keys and 43 values
[2024-03-13T15:08:40,878][WARN ][o.o.s.p.SQLPlugin ] [wazuh.indexer] Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information
[2024-03-13T15:08:41,449][INFO ][o.o.t.NettyAllocator ] [wazuh.indexer] creating NettyAllocator with the following configs: [name=unpooled, suggested_max_allocation_size=256kb, factors={opensearch.unsafe.use_unpooled_allocator=null, g1gc_enabled=true, g1gc_region_size=1mb, heap_size=1gb}]
[2024-03-13T15:08:41,566][INFO ][o.o.d.DiscoveryModule ] [wazuh.indexer] using discovery type [single-node] and seed hosts providers [settings]
[2024-03-13T15:08:42,058][WARN ][o.o.g.DanglingIndicesState] [wazuh.indexer] gateway.auto_import_dangling_indices is disabled, dangling indices will not be automatically detected or imported and must be managed manually
[2024-03-13T15:08:42,647][INFO ][o.o.p.h.c.PerformanceAnalyzerConfigAction] [wazuh.indexer] PerformanceAnalyzer Enabled: false
[2024-03-13T15:08:42,692][INFO ][o.o.n.Node ] [wazuh.indexer] initialized
[2024-03-13T15:08:42,693][INFO ][o.o.n.Node ] [wazuh.indexer] starting ...
[2024-03-13T15:08:42,742][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [windows_logtype.json] log type
[2024-03-13T15:08:42,743][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [vpcflow_logtype.json] log type
[2024-03-13T15:08:42,744][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [test_windows_logtype.json] log type
[2024-03-13T15:08:42,745][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [s3_logtype.json] log type
[2024-03-13T15:08:42,745][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [others_web_logtype.json] log type
[2024-03-13T15:08:42,746][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [others_proxy_logtype.json] log type
[2024-03-13T15:08:42,747][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [others_macos_logtype.json] log type
[2024-03-13T15:08:42,748][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [others_compliance_logtype.json] log type
[2024-03-13T15:08:42,748][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [others_cloud_logtype.json] log type
[2024-03-13T15:08:42,748][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [others_apt_logtype.json] log type
[2024-03-13T15:08:42,749][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [others_application_logtype.json] log type
[2024-03-13T15:08:42,749][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [okta_logtype.json] log type
[2024-03-13T15:08:42,750][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [network_logtype.json] log type
[2024-03-13T15:08:42,750][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [netflow_logtype.json] log type
[2024-03-13T15:08:42,751][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [m365_logtype.json] log type
[2024-03-13T15:08:42,751][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [linux_logtype.json] log type
[2024-03-13T15:08:42,752][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [gworkspace_logtype.json] log type
[2024-03-13T15:08:42,752][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [github_logtype.json] log type
[2024-03-13T15:08:42,752][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [dns_logtype.json] log type
[2024-03-13T15:08:42,753][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [cloudtrail_logtype.json] log type
[2024-03-13T15:08:42,755][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [azure_logtype.json] log type
[2024-03-13T15:08:42,756][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [apache_access_logtype.json] log type
[2024-03-13T15:08:42,757][INFO ][o.o.s.l.BuiltinLogTypeLoader] [wazuh.indexer] Loaded [ad_ldap_logtype.json] log type
[2024-03-13T15:08:42,908][INFO ][o.o.t.TransportService ] [wazuh.indexer] publish_address {172.22.0.2:9300}, bound_addresses {0.0.0.0:9300}
[2024-03-13T15:08:42,911][INFO ][o.o.t.TransportService ] [wazuh.indexer] Remote clusters initialized successfully.
[2024-03-13T15:08:43,132][WARN ][o.o.b.BootstrapChecks ] [wazuh.indexer] max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[2024-03-13T15:08:43,151][INFO ][o.o.c.c.Coordinator ] [wazuh.indexer] setting initial configuration to VotingConfiguration{g6QhEWYGTWWQ-1Urcv76uA}
[2024-03-13T15:08:43,407][INFO ][o.o.c.s.MasterService ] [wazuh.indexer] elected-as-cluster-manager ([1] nodes joined)[{wazuh.indexer}{g6QhEWYGTWWQ-1Urcv76uA}{nmn2_8dNTza7aurc3PBOrw}{172.22.0.2}{172.22.0.2:9300}{dimr}{shard_indexing_pressure_enabled=true} elect leader, _BECOME_CLUSTER_MANAGER_TASK_, _FINISH_ELECTION_], term: 1, version: 1, delta: cluster-manager node changed {previous [], current [{wazuh.indexer}{g6QhEWYGTWWQ-1Urcv76uA}{nmn2_8dNTza7aurc3PBOrw}{172.22.0.2}{172.22.0.2:9300}{dimr}{shard_indexing_pressure_enabled=true}]}
[2024-03-13T15:08:43,462][INFO ][o.o.c.c.CoordinationState] [wazuh.indexer] cluster UUID set to [W5BsNsSOT5uIGvHMTCVN5g]
[2024-03-13T15:08:43,500][INFO ][o.o.c.s.ClusterApplierService] [wazuh.indexer] cluster-manager node changed {previous [], current [{wazuh.indexer}{g6QhEWYGTWWQ-1Urcv76uA}{nmn2_8dNTza7aurc3PBOrw}{172.22.0.2}{172.22.0.2:9300}{dimr}{shard_indexing_pressure_enabled=true}]}, term: 1, version: 1, reason: Publication{term=1, version=1}
[2024-03-13T15:08:43,515][INFO ][o.o.a.c.ADClusterEventListener] [wazuh.indexer] Cluster is not recovered yet.
[2024-03-13T15:08:43,523][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:43,545][INFO ][o.o.i.i.ManagedIndexCoordinator] [wazuh.indexer] Cache cluster manager node onClusterManager time: 1710342523545
[2024-03-13T15:08:43,556][WARN ][o.o.p.c.s.h.ConfigOverridesClusterSettingHandler] [wazuh.indexer] Config override setting update called with empty string. Ignoring.
[2024-03-13T15:08:43,570][INFO ][o.o.d.PeerFinder ] [wazuh.indexer] setting findPeersInterval to [1s] as node commission status = [true] for local node [{wazuh.indexer}{g6QhEWYGTWWQ-1Urcv76uA}{nmn2_8dNTza7aurc3PBOrw}{172.22.0.2}{172.22.0.2:9300}{dimr}{shard_indexing_pressure_enabled=true}]
[2024-03-13T15:08:43,575][INFO ][o.o.h.AbstractHttpServerTransport] [wazuh.indexer] publish_address {172.22.0.2:9200}, bound_addresses {0.0.0.0:9200}
[2024-03-13T15:08:43,576][INFO ][o.o.n.Node ] [wazuh.indexer] started
[2024-03-13T15:08:43,579][INFO ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] Node started
[2024-03-13T15:08:43,579][INFO ][o.o.s.c.ConfigurationRepository] [wazuh.indexer] Will attempt to create index .opendistro_security and default configs if they are absent
[2024-03-13T15:08:43,581][INFO ][o.o.s.c.ConfigurationRepository] [wazuh.indexer] Background init thread started. Install default config?: true
[2024-03-13T15:08:43,582][INFO ][o.o.s.OpenSearchSecurityPlugin] [wazuh.indexer] 0 OpenSearch Security modules loaded so far: []
[2024-03-13T15:08:43,585][INFO ][o.o.s.c.ConfigurationRepository] [wazuh.indexer] Wait for cluster to be available ...
[2024-03-13T15:08:43,613][INFO ][o.o.a.c.HashRing ] [wazuh.indexer] Node added: [g6QhEWYGTWWQ-1Urcv76uA]
[2024-03-13T15:08:43,615][INFO ][o.o.a.c.HashRing ] [wazuh.indexer] Add data node to AD version hash ring: g6QhEWYGTWWQ-1Urcv76uA
[2024-03-13T15:08:43,618][INFO ][o.o.a.c.HashRing ] [wazuh.indexer] All nodes with known AD version: {g6QhEWYGTWWQ-1Urcv76uA=ADNodeInfo{version=2.10.0, isEligibleDataNode=true}}
[2024-03-13T15:08:43,619][INFO ][o.o.a.c.HashRing ] [wazuh.indexer] Rebuild AD hash ring for realtime AD with cooldown, nodeChangeEvents size 0
[2024-03-13T15:08:43,619][INFO ][o.o.a.c.HashRing ] [wazuh.indexer] Build AD version hash ring successfully
[2024-03-13T15:08:43,620][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:43,622][INFO ][o.o.a.c.ADDataMigrator ] [wazuh.indexer] Start migrating AD data
[2024-03-13T15:08:43,622][INFO ][o.o.a.c.ADDataMigrator ] [wazuh.indexer] AD job index doesn't exist, no need to migrate
[2024-03-13T15:08:43,622][INFO ][o.o.a.c.ADClusterEventListener] [wazuh.indexer] Init AD version hash ring successfully
[2024-03-13T15:08:43,645][INFO ][o.o.g.GatewayService ] [wazuh.indexer] recovered [0] indices into cluster_state
[2024-03-13T15:08:43,681][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opensearch-observability/aa2YjEOQS9eadeTESttVcg]
[2024-03-13T15:08:43,870][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [.opensearch-observability] creating index, cause [api], templates [], shards [1]/[0]
[2024-03-13T15:08:43,917][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opensearch-observability/aa2YjEOQS9eadeTESttVcg]
[2024-03-13T15:08:43,981][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:44,024][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opensearch-sap-log-types-config/mOHtYkA9RJSHWxDKOKqZeQ]
[2024-03-13T15:08:44,065][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [.opensearch-sap-log-types-config] creating index, cause [auto(sap-logtype api)], templates [], shards [1]/[1]
[2024-03-13T15:08:44,067][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] updating number_of_replicas to [0] for indices [.opensearch-sap-log-types-config]
[2024-03-13T15:08:44,142][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opensearch-sap-log-types-config/mOHtYkA9RJSHWxDKOKqZeQ]
[2024-03-13T15:08:44,200][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:44,315][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:44,329][INFO ][o.o.o.i.ObservabilityIndex] [wazuh.indexer] observability:Index .opensearch-observability creation Acknowledged
[2024-03-13T15:08:44,330][INFO ][o.o.o.i.ObservabilityIntegrationsIndex] [wazuh.indexer] observability:createMappingTemplate ss4o_metrics_template API called
[2024-03-13T15:08:44,331][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.opensearch-sap-log-types-config][0]]]).
[2024-03-13T15:08:44,377][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:44,379][INFO ][o.o.s.l.LogTypeService ] [wazuh.indexer] Loading builtin types!
[2024-03-13T15:08:44,382][INFO ][o.o.s.l.LogTypeService ] [wazuh.indexer] Indexing [418] fieldMappingDocs from logTypes: 23
[2024-03-13T15:08:44,444][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[validate-template-aylq62mbr2qr6s6l0kpkdw/el2xRsYRQzS7CI7kcTF4gw]
[2024-03-13T15:08:44,503][INFO ][o.o.c.m.MetadataIndexTemplateService] [wazuh.indexer] adding index template [ss4o_metrics_template] for index patterns [ss4o_metrics-*-*]
[2024-03-13T15:08:44,519][INFO ][o.o.s.l.LogTypeService ] [wazuh.indexer] Indexing [418] fieldMappingDocs
[2024-03-13T15:08:44,558][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:44,574][INFO ][o.o.o.i.ObservabilityIntegrationsIndex] [wazuh.indexer] observability:Mapping Template ss4o_metrics_template creation Acknowledged
[2024-03-13T15:08:44,578][INFO ][o.o.s.l.LogTypeService ] [wazuh.indexer] Loading builtin types!
[2024-03-13T15:08:44,583][INFO ][o.o.o.i.ObservabilityIntegrationsIndex] [wazuh.indexer] observability:createMappingTemplate ss4o_traces_template API called
[2024-03-13T15:08:44,586][INFO ][o.o.s.l.LogTypeService ] [wazuh.indexer] Indexing [418] fieldMappingDocs from logTypes: 23
[2024-03-13T15:08:44,607][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[validate-template-rxdmvtfvrfea6p6b0qem1a/-lioAOQmSjieUbxn1jcHrA]
[2024-03-13T15:08:44,608][INFO ][o.o.s.l.LogTypeService ] [wazuh.indexer] Loading builtin types!
[2024-03-13T15:08:44,608][INFO ][o.o.s.l.LogTypeService ] [wazuh.indexer] Indexing [418] fieldMappingDocs from logTypes: 23
[2024-03-13T15:08:44,620][INFO ][o.o.c.m.MetadataIndexTemplateService] [wazuh.indexer] adding index template [ss4o_traces_template] for index patterns [ss4o_traces-*-*]
[2024-03-13T15:08:44,633][INFO ][o.o.s.l.LogTypeService ] [wazuh.indexer] Indexing [418] fieldMappingDocs
[2024-03-13T15:08:44,627][INFO ][o.o.s.l.LogTypeService ] [wazuh.indexer] Indexing [418] fieldMappingDocs
[2024-03-13T15:08:44,745][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:44,748][INFO ][o.o.o.i.ObservabilityIntegrationsIndex] [wazuh.indexer] observability:Mapping Template ss4o_traces_template creation Acknowledged
[2024-03-13T15:08:44,750][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/9lwVTITHQUOJIxCmiRp4cA]
[2024-03-13T15:08:44,754][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [.opendistro_security] creating index, cause [api], templates [], shards [1]/[1]
[2024-03-13T15:08:44,765][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] updating number_of_replicas to [0] for indices [.opendistro_security]
[2024-03-13T15:08:44,816][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/9lwVTITHQUOJIxCmiRp4cA]
[2024-03-13T15:08:44,830][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:44,836][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opensearch-sap-log-types-config/mOHtYkA9RJSHWxDKOKqZeQ]
[2024-03-13T15:08:44,844][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opensearch-sap-log-types-config/mOHtYkA9RJSHWxDKOKqZeQ] update_mapping [_doc]
[2024-03-13T15:08:44,926][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:44,955][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opensearch-sap-log-types-config/mOHtYkA9RJSHWxDKOKqZeQ]
[2024-03-13T15:08:45,019][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.opendistro_security][0]]]).
[2024-03-13T15:08:45,068][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:45,077][INFO ][o.o.s.c.ConfigurationRepository] [wazuh.indexer] Index .opendistro_security created?: true
[2024-03-13T15:08:45,077][INFO ][o.o.s.c.ConfigurationRepository] [wazuh.indexer] Node started, try to initialize it. Wait for at least yellow cluster state....
[2024-03-13T15:08:45,078][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opensearch-sap-log-types-config/mOHtYkA9RJSHWxDKOKqZeQ]
[2024-03-13T15:08:45,091][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Will update 'config' with /usr/share/wazuh-indexer/opensearch-security/config.yml and populate it with empty doc if file missing and populateEmptyIfFileMissing=false
[2024-03-13T15:08:45,095][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opensearch-sap-log-types-config/mOHtYkA9RJSHWxDKOKqZeQ] update_mapping [_doc]
[2024-03-13T15:08:45,167][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:45,170][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/9lwVTITHQUOJIxCmiRp4cA]
[2024-03-13T15:08:45,174][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/9lwVTITHQUOJIxCmiRp4cA] create_mapping
[2024-03-13T15:08:45,176][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opensearch-sap-log-types-config/mOHtYkA9RJSHWxDKOKqZeQ]
[2024-03-13T15:08:45,233][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:45,500][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Doc with id 'config' and version 2 is updated in .opendistro_security index.
[2024-03-13T15:08:45,500][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Will update 'roles' with /usr/share/wazuh-indexer/opensearch-security/roles.yml and populate it with empty doc if file missing and populateEmptyIfFileMissing=false
[2024-03-13T15:08:45,526][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/9lwVTITHQUOJIxCmiRp4cA]
[2024-03-13T15:08:45,530][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/9lwVTITHQUOJIxCmiRp4cA] update_mapping [_doc]
[2024-03-13T15:08:45,568][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:45,689][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Doc with id 'roles' and version 2 is updated in .opendistro_security index.
[2024-03-13T15:08:45,689][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Will update 'rolesmapping' with /usr/share/wazuh-indexer/opensearch-security/roles_mapping.yml and populate it with empty doc if file missing and populateEmptyIfFileMissing=false
[2024-03-13T15:08:45,749][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/9lwVTITHQUOJIxCmiRp4cA]
[2024-03-13T15:08:45,758][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/9lwVTITHQUOJIxCmiRp4cA] update_mapping [_doc]
[2024-03-13T15:08:45,865][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:45,946][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Doc with id 'rolesmapping' and version 2 is updated in .opendistro_security index.
[2024-03-13T15:08:45,948][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Will update 'internalusers' with /usr/share/wazuh-indexer/opensearch-security/internal_users.yml and populate it with empty doc if file missing and populateEmptyIfFileMissing=false
[2024-03-13T15:08:45,965][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/9lwVTITHQUOJIxCmiRp4cA]
[2024-03-13T15:08:45,974][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/9lwVTITHQUOJIxCmiRp4cA] update_mapping [_doc]
[2024-03-13T15:08:46,043][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:46,242][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Doc with id 'internalusers' and version 2 is updated in .opendistro_security index.
[2024-03-13T15:08:46,243][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Will update 'actiongroups' with /usr/share/wazuh-indexer/opensearch-security/action_groups.yml and populate it with empty doc if file missing and populateEmptyIfFileMissing=false
[2024-03-13T15:08:46,252][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/9lwVTITHQUOJIxCmiRp4cA]
[2024-03-13T15:08:46,270][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/9lwVTITHQUOJIxCmiRp4cA] update_mapping [_doc]
[2024-03-13T15:08:46,306][ERROR][o.o.s.a.BackendRegistry ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2024-03-13T15:08:46,328][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:46,360][ERROR][o.o.s.a.BackendRegistry ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2024-03-13T15:08:46,385][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Doc with id 'actiongroups' and version 2 is updated in .opendistro_security index.
[2024-03-13T15:08:46,386][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Will update 'tenants' with /usr/share/wazuh-indexer/opensearch-security/tenants.yml and populate it with empty doc if file missing and populateEmptyIfFileMissing=false
[2024-03-13T15:08:46,401][ERROR][o.o.s.a.BackendRegistry ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2024-03-13T15:08:46,401][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/9lwVTITHQUOJIxCmiRp4cA]
[2024-03-13T15:08:46,422][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/9lwVTITHQUOJIxCmiRp4cA] update_mapping [_doc]
[2024-03-13T15:08:46,429][ERROR][o.o.s.a.BackendRegistry ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2024-03-13T15:08:46,453][ERROR][o.o.s.a.BackendRegistry ] [wazuh.indexer] Not yet initialized (you may need to run securityadmin)
[2024-03-13T15:08:46,481][INFO ][o.o.s.l.LogTypeService ] [wazuh.indexer] Loaded [418] field mapping docs successfully!
[2024-03-13T15:08:46,495][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:46,540][INFO ][o.o.s.l.LogTypeService ] [wazuh.indexer] Indexing [22] customLogTypes
[2024-03-13T15:08:46,572][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Doc with id 'tenants' and version 2 is updated in .opendistro_security index.
[2024-03-13T15:08:46,581][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Will update 'nodesdn' with /usr/share/wazuh-indexer/opensearch-security/nodes_dn.yml and populate it with empty doc if file missing and populateEmptyIfFileMissing=true
[2024-03-13T15:08:46,588][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/9lwVTITHQUOJIxCmiRp4cA]
[2024-03-13T15:08:46,596][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/9lwVTITHQUOJIxCmiRp4cA] update_mapping [_doc]
[2024-03-13T15:08:46,599][INFO ][o.o.s.l.LogTypeService ] [wazuh.indexer] Loaded [418] field mapping docs successfully!
[2024-03-13T15:08:46,635][INFO ][o.o.s.l.LogTypeService ] [wazuh.indexer] Indexing [22] customLogTypes
[2024-03-13T15:08:46,687][INFO ][o.o.s.l.LogTypeService ] [wazuh.indexer] Loaded [418] field mapping docs successfully!
[2024-03-13T15:08:46,805][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:46,881][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Doc with id 'nodesdn' and version 2 is updated in .opendistro_security index.
[2024-03-13T15:08:46,881][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Will update 'whitelist' with /usr/share/wazuh-indexer/opensearch-security/whitelist.yml and populate it with empty doc if file missing and populateEmptyIfFileMissing=true
[2024-03-13T15:08:46,898][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/9lwVTITHQUOJIxCmiRp4cA]
[2024-03-13T15:08:46,901][INFO ][o.o.s.l.LogTypeService ] [wazuh.indexer] Loaded [22] customLogType docs successfully!
[2024-03-13T15:08:46,912][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/9lwVTITHQUOJIxCmiRp4cA] update_mapping [_doc]
[2024-03-13T15:08:46,913][INFO ][o.o.s.SecurityAnalyticsPlugin] [wazuh.indexer] LogType config index successfully created and builtin log types loaded
[2024-03-13T15:08:46,915][INFO ][o.o.s.l.LogTypeService ] [wazuh.indexer] Loaded [22] customLogType docs successfully!
[2024-03-13T15:08:47,004][INFO ][o.o.s.i.DetectorIndexManagementService] [wazuh.indexer] No Old Finding Indices to delete
[2024-03-13T15:08:47,022][INFO ][o.o.s.i.DetectorIndexManagementService] [wazuh.indexer] No Old Alert Indices to delete
[2024-03-13T15:08:47,144][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:47,181][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Doc with id 'whitelist' and version 2 is updated in .opendistro_security index.
[2024-03-13T15:08:47,181][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Will update 'allowlist' with /usr/share/wazuh-indexer/opensearch-security/allowlist.yml and populate it with empty doc if file missing and populateEmptyIfFileMissing=true
[2024-03-13T15:08:47,190][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/9lwVTITHQUOJIxCmiRp4cA]
[2024-03-13T15:08:47,196][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/9lwVTITHQUOJIxCmiRp4cA] update_mapping [_doc]
[2024-03-13T15:08:47,222][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:47,237][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Doc with id 'allowlist' and version 2 is updated in .opendistro_security index.
[2024-03-13T15:08:47,238][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Will update 'audit' with /usr/share/wazuh-indexer/opensearch-security/audit.yml and populate it with empty doc if file missing and populateEmptyIfFileMissing=false
[2024-03-13T15:08:47,302][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.opendistro_security/9lwVTITHQUOJIxCmiRp4cA]
[2024-03-13T15:08:47,310][INFO ][o.o.c.m.MetadataMappingService] [wazuh.indexer] [.opendistro_security/9lwVTITHQUOJIxCmiRp4cA] update_mapping [_doc]
[2024-03-13T15:08:47,358][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:47,403][INFO ][o.o.s.s.ConfigHelper ] [wazuh.indexer] Doc with id 'audit' and version 2 is updated in .opendistro_security index.
[2024-03-13T15:08:47,578][INFO ][stdout ] [wazuh.indexer] [FINE] No subscribers registered for event class org.opensearch.security.securityconf.DynamicConfigFactory$NodesDnModelImpl
[2024-03-13T15:08:47,580][INFO ][stdout ] [wazuh.indexer] [FINE] No subscribers registered for event class org.greenrobot.eventbus.NoSubscriberEvent
[2024-03-13T15:08:47,581][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Auditing on REST API is enabled.
[2024-03-13T15:08:47,581][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] [AUTHENTICATED, GRANTED_PRIVILEGES] are excluded from REST API auditing.
[2024-03-13T15:08:47,582][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Auditing on Transport API is enabled.
[2024-03-13T15:08:47,582][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] [AUTHENTICATED, GRANTED_PRIVILEGES] are excluded from Transport API auditing.
[2024-03-13T15:08:47,582][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Auditing of request body is enabled.
[2024-03-13T15:08:47,582][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Bulk requests resolution is disabled during request auditing.
[2024-03-13T15:08:47,583][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Index resolution is enabled during request auditing.
[2024-03-13T15:08:47,583][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Sensitive headers auditing is enabled.
[2024-03-13T15:08:47,583][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Auditing requests from kibanaserver users is disabled.
[2024-03-13T15:08:47,584][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Auditing of external configuration is disabled.
[2024-03-13T15:08:47,585][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Auditing of internal configuration is enabled.
[2024-03-13T15:08:47,585][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Auditing only metadata information for read request is enabled.
[2024-03-13T15:08:47,586][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Auditing will watch {} for read requests.
[2024-03-13T15:08:47,586][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Auditing read operation requests from kibanaserver users is disabled.
[2024-03-13T15:08:47,586][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Auditing only metadata information for write request is enabled.
[2024-03-13T15:08:47,587][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Auditing diffs for write requests is disabled.
[2024-03-13T15:08:47,592][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Auditing write operation requests from kibanaserver users is disabled.
[2024-03-13T15:08:47,593][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Auditing will watch <NONE> for write requests.
[2024-03-13T15:08:47,594][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] .opendistro_security is used as internal security index.
[2024-03-13T15:08:47,594][INFO ][o.o.s.a.i.AuditLogImpl ] [wazuh.indexer] Internal index used for posting audit logs is null
[2024-03-13T15:08:47,595][INFO ][o.o.s.c.ConfigurationRepository] [wazuh.indexer] Hot-reloading of audit configuration is enabled
[2024-03-13T15:08:47,595][INFO ][o.o.s.c.ConfigurationRepository] [wazuh.indexer] Node 'wazuh.indexer' initialized
[2024-03-13T15:08:48,361][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.kibana_1/IVupt5W2QWeGk_BMA7YRDA]
[2024-03-13T15:08:48,397][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [.kibana_1] creating index, cause [api], templates [], shards [1]/[1]
[2024-03-13T15:08:48,399][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] updating number_of_replicas to [0] for indices [.kibana_1]
[2024-03-13T15:08:48,452][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.kibana_1/IVupt5W2QWeGk_BMA7YRDA]
[2024-03-13T15:08:48,480][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:48,530][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.kibana_1][0]]]).
[2024-03-13T15:08:48,561][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:48,633][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:48,896][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[mwaihUbISSaVQe7DoI-1fw/nHKj49-YRd6jrco5UUzn1g]
[2024-03-13T15:08:48,931][INFO ][o.o.c.m.MetadataIndexTemplateService] [wazuh.indexer] adding template [wazuh-agent] for index patterns [wazuh-monitoring-*]
[2024-03-13T15:08:48,994][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:49,001][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[Ea0UWxRkSj6qpvwul3eQ3g/ul1EafAESfmuHyjyCwU_ig]
[2024-03-13T15:08:49,011][INFO ][o.o.c.m.MetadataIndexTemplateService] [wazuh.indexer] adding template [wazuh-statistics] for index patterns [wazuh-statistics-*]
[2024-03-13T15:08:49,045][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:50,613][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[validate-template-0uc8a_zvsxc90sacieepkg/5bn-pQSxR9WGYB06uw5-rg]
[2024-03-13T15:08:50,623][INFO ][o.o.c.m.MetadataIndexTemplateService] [wazuh.indexer] adding index template [wazuh-states-vulnerabilities_template] for index patterns [wazuh-states-vulnerabilities]
[2024-03-13T15:08:50,661][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:50,674][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-states-vulnerabilities/DzHFfhLEQp-NP0sZRvl67Q]
[2024-03-13T15:08:50,683][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [wazuh-states-vulnerabilities] creating index, cause [api], templates [wazuh-states-vulnerabilities_template], shards [1]/[0]
[2024-03-13T15:08:50,727][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-states-vulnerabilities/DzHFfhLEQp-NP0sZRvl67Q]
[2024-03-13T15:08:50,740][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:50,744][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-monitoring-2024.11w/KegX9UQ3Q3GksEvvcCASnA]
[2024-03-13T15:08:50,757][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [wazuh-monitoring-2024.11w] creating index, cause [api], templates [wazuh-agent], shards [1]/[0]
[2024-03-13T15:08:50,796][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-monitoring-2024.11w/KegX9UQ3Q3GksEvvcCASnA]
[2024-03-13T15:08:50,848][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:50,912][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:50,918][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[wazuh-monitoring-2024.11w][0]]]).
[2024-03-13T15:08:50,946][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:50,957][INFO ][o.o.c.m.MetadataUpdateSettingsService] [wazuh.indexer] updating number_of_replicas to [0] for indices [wazuh-monitoring-2024.11w]
[2024-03-13T15:08:53,570][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.plugins-ml-config/zJCN_E9cQNmDguZo5tuA0A]
[2024-03-13T15:08:53,579][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [.plugins-ml-config] creating index, cause [api], templates [], shards [1]/[1]
[2024-03-13T15:08:53,581][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] updating number_of_replicas to [0] for indices [.plugins-ml-config]
[2024-03-13T15:08:53,619][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[.plugins-ml-config/zJCN_E9cQNmDguZo5tuA0A]
[2024-03-13T15:08:53,636][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:53,681][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.plugins-ml-config][0]]]).
[2024-03-13T15:08:53,714][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:53,715][INFO ][o.o.m.i.MLIndicesHandler ] [wazuh.indexer] create index:.plugins-ml-config
[2024-03-13T15:08:53,749][INFO ][o.o.m.c.MLSyncUpCron ] [wazuh.indexer] ML configuration initialized successfully
[2024-03-13T15:08:54,593][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[Xf54ICMRRaSPtyy7vfFl6A/vY2hwpgjSc-CT59R7_PFGA]
[2024-03-13T15:08:54,632][INFO ][o.o.c.m.MetadataIndexTemplateService] [wazuh.indexer] adding template [wazuh] for index patterns [wazuh-alerts-4.x-*, wazuh-archives-4.x-*]
[2024-03-13T15:08:54,686][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:54,801][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:54,844][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2024.03.13/DtoD90w4RWOFezXcqGAQzA]
[2024-03-13T15:08:54,863][INFO ][o.o.c.m.MetadataCreateIndexService] [wazuh.indexer] [wazuh-alerts-4.x-2024.03.13] creating index, cause [auto(bulk api)], templates [wazuh], shards [3]/[0]
[2024-03-13T15:08:54,927][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[wazuh-alerts-4.x-2024.03.13/DtoD90w4RWOFezXcqGAQzA]
[2024-03-13T15:08:54,973][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:55,042][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:08:55,044][INFO ][o.o.c.r.a.AllocationService] [wazuh.indexer] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[wazuh-alerts-4.x-2024.03.13][2], [wazuh-alerts-4.x-2024.03.13][1]]]).
[2024-03-13T15:08:55,075][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for destination migration
[2024-03-13T15:09:43,547][INFO ][o.o.i.i.ManagedIndexCoordinator] [wazuh.indexer] Performing move cluster state metadata.
[2024-03-13T15:09:43,549][INFO ][o.o.i.i.MetadataService ] [wazuh.indexer] ISM config index not exist, so we cancel the metadata migration job.
[2024-03-13T15:09:43,550][INFO ][o.o.i.i.ManagedIndexCoordinator] [wazuh.indexer] Performing ISM template migration.
[2024-03-13T15:09:43,551][INFO ][o.o.i.i.m.ISMTemplateService] [wazuh.indexer] Doing ISM template migration 1 time.
[2024-03-13T15:09:43,551][INFO ][o.o.i.i.m.ISMTemplateService] [wazuh.indexer] Use 2024-03-13T14:08:43.545Z as migrating ISM template last_updated_time
[2024-03-13T15:09:43,558][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[simulate_template_index_swaqxbx-qog0a1pvnbustq/XkQEjH_XR4eeqT8dViauFQ]
[2024-03-13T15:09:43,565][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[simulate_template_index_swaqxbx-qog0a1pvnbustq/XkQEjH_XR4eeqT8dViauFQ]
[2024-03-13T15:09:43,585][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[simulate_template_index_tcnzvfb2t0e0vokrfmvj3w/QcGNPNolRkK-wbs6nx6kGA]
[2024-03-13T15:09:43,592][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[simulate_template_index_tcnzvfb2t0e0vokrfmvj3w/QcGNPNolRkK-wbs6nx6kGA]
[2024-03-13T15:09:43,601][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[simulate_template_index_-0s2rt9mq8iqe1yge2crnq/ZDGNDbSDSOic7HuH2Kv35A]
[2024-03-13T15:09:43,607][INFO ][o.o.p.PluginsService ] [wazuh.indexer] PluginService:onIndexModule index:[simulate_template_index_-0s2rt9mq8iqe1yge2crnq/ZDGNDbSDSOic7HuH2Kv35A]
[2024-03-13T15:09:43,615][INFO ][o.o.i.i.m.ISMTemplateService] [wazuh.indexer] ISM templates: {=[ISMTemplate(indexPatterns=[ss4o_metrics-*-*], priority=1, lastUpdatedTime=2024-03-13T14:08:43.545Z), ISMTemplate(indexPatterns=[ss4o_traces-*-*], priority=1, lastUpdatedTime=2024-03-13T14:08:43.545Z), ISMTemplate(indexPatterns=[wazuh-states-vulnerabilities], priority=1, lastUpdatedTime=2024-03-13T14:08:43.545Z)]}
[2024-03-13T15:09:43,618][INFO ][o.o.i.i.m.ISMTemplateService] [wazuh.indexer] Policies to update: []
[2024-03-13T15:09:43,632][INFO ][o.o.i.i.m.ISMTemplateService] [wazuh.indexer] Failure experienced when migrating ISM Template and update ISM policies: {}
[2024-03-13T15:09:43,679][INFO ][o.o.c.s.ClusterSettings ] [wazuh.indexer] updating [plugins.index_state_management.template_migration.control] from [0] to [-1]
[2024-03-13T15:09:43,681][INFO ][o.o.a.u.d.DestinationMigrationCoordinator] [wazuh.indexer] Detected cluster change event for deScreenshots:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
Some vulnerabilities related to the AL 2023 base image used for the
4.8.0-beta4Docker images were found.Here is the list:
We need to fix those vulnerabilities.
Solution
After a vulnerability scan of the latest AL 2023 Docker image, it was found that the image is clean
Tasks
amazonlinux:2023.3.20240219.0toamazonlinux:2023.3.20240304.0.The text was updated successfully, but these errors were encountered: