Duplicated Wazuh server node names #2607

barikinil · 2023-11-16T09:55:34Z

barikinil
Nov 16, 2023

Hi.
I have an issue with installing all-in-one at ubuntu 22.04 installation. I have several attemped to install with several component, several methods but installation did not complete. I have to say this documentation is great but there is a little chaos in it.

tried methods:
from terminal, 4.6 version

indexer,
server,
dashbord,
agent,
all-in-one
4.5 version of wazuh server,
downloading deb file installing with ubuntu software,

but every time i had different error.

Last error is below. according to doc: https://documentation.wazuh.com/current/quickstart.html

command:

~$ curl -sO https://packages.wazuh.com/4.6/wazuh-install.sh && sudo bash ./wazuh-install.sh -a -o

result:

'
16/11/2023 12:23:00 INFO: Starting Wazuh installation assistant. Wazuh version: 4.6.0
16/11/2023 12:23:00 INFO: Verbose logging redirected to /var/log/wazuh-install.log
16/11/2023 12:23:09 INFO: --- Removing existing Wazuh installation ---
16/11/2023 12:23:09 INFO: Removing Wazuh manager.
16/11/2023 12:23:29 INFO: Wazuh manager removed.
16/11/2023 12:23:29 INFO: Removing Wazuh indexer.
16/11/2023 12:23:37 INFO: Wazuh indexer removed.
16/11/2023 12:23:37 INFO: Removing Wazuh dashboard.
16/11/2023 12:23:59 INFO: Wazuh dashboard removed.
16/11/2023 12:24:00 INFO: Installation cleaned.
./wazuh-install.sh: 987. satır: [: : tamsayı ifadesi bekleniyordu
16/11/2023 12:24:07 INFO: Wazuh web interface port will be 443.
16/11/2023 12:24:17 INFO: Wazuh repository added.
16/11/2023 12:24:17 INFO: --- Configuration files ---
16/11/2023 12:24:17 INFO: Generating configuration files.
16/11/2023 12:24:17 ERROR: Duplicated Wazuh server node names.
`
removing installations was installed with deb file at ubuntu software. I couldnt install any from command line.

Could you help me please.
Thank you.

rauldpm · 2023-11-16T13:27:47Z

rauldpm
Nov 16, 2023
Collaborator

Hello @barikinil

What operating system and version are you using and what language is it configured in?

The following output catches my attention:

./wazuh-install.sh: 987. satır: [: : tamsayı ifadesi bekleniyordu

That line corresponds to:

if [ "${cores}" -lt 2 ] || [ "${ram_gb}" -lt 3700 ]; then

From what I see, that language is Turkish, correct? The English translation would be:

tamsayı ifadesi bekleniyordu = integer expression expected

This leads me to think that obtaining these values is done differently than other distributions. Can you run the following commands and show them to me?

grep -c processor /proc/cpuinfo
free -m | awk '/^Mem:/{print $2}'

On other occasions here and here, we have seen that in certain languages, the operating system modifies the output of the free command, changing the : to . or directly does not appear, it is possible that the output is different in the configured language and does not correctly gets the values

There is a request issue for multi-language support in the WIA: #1247

On the other hand, can you transfer the discussion to the wazuh-packages repository? If you can't, tell me and I will transfer it directly, that repository is where the WIA code is stored, this way we can better reflect the problem, thank you.

11 replies

barikinil Nov 17, 2023
Author

Languge problem is partially solved by setting LANG="en_US.UTF-8" before installation. there is another error (complete language changing is not possible for me) on my system but this is not affecting the installation.

./wazuh-install.sh: 987. satır: [: : tamsayı ifadesi bekleniyordu : integer expression expected

16/11/2023 12:24:17 ERROR: Duplicated Wazuh server node names.

Yes, I uninstall it. Did you clean the previous installation? To ensure this, please run bash wazuh-install.sh -u
Firewall port was closed, it is true. but i tried installation with open ports, nothing changed.
- Ports: 1514,1515,1516, 443, 9200, 55000
  - Additionaly, I was expecting a server ip, something like that, to open port with for more secure connection. I mean, i was expecting, port would only be allowed to spesific ip for more secure way. İs there is any ip that i can add with to rule.
After lang changed, i tried installation again and took this error, and warnings. Installer, tried to start wazuh-indexer 4 times, but didnt make it.
warning:

WARNING: A terminally deprecated method in java.lang.System has been called

this solved here. can be ignored.

Error:

Caused by: java.lang.ExceptionInInitializerError: Exception java.lang.UnsatisfiedLinkError: /tmp/opensearch-17638710133668975609/jna4746470388946097819.tmp: /tmp/opensearch-17638710133668975609/jna4746470388946097819.tmp: failed to map segment from shared object [in thread "main"]

this error seems like important. i dont know.

only one rows of 4 times repeated error log below:

Nov 17 06:49:13 barikinil-Insp systemd[1]: Starting Wazuh-indexer...
Nov 17 06:50:03 barikinil-Insp systemd-entrypoint[41303]: WARNING: A terminally deprecated method in java.lang.System has been called
Nov 17 06:50:03 barikinil-Insp systemd-entrypoint[41303]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.8.0.jar)
Nov 17 06:50:04 barikinil-Insp systemd-entrypoint[41303]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Nov 17 06:50:04 barikinil-Insp systemd-entrypoint[41303]: WARNING: System::setSecurityManager will be removed in a future release
Nov 17 06:50:14 barikinil-Insp systemd-entrypoint[41303]: WARNING: A terminally deprecated method in java.lang.System has been called
Nov 17 06:50:14 barikinil-Insp systemd-entrypoint[41303]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.8.0.jar)
Nov 17 06:50:14 barikinil-Insp systemd-entrypoint[41303]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Nov 17 06:50:14 barikinil-Insp systemd-entrypoint[41303]: WARNING: System::setSecurityManager will be removed in a future release
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]: fatal error in thread [main], exiting
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]: java.lang.NoClassDefFoundError: Could not initialize class com.sun.jna.Native
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.systemd.Libsystemd.lambda$static$0(Libsystemd.java:47)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at java.base/java.security.AccessController.doPrivileged(AccessController.java:318)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.systemd.Libsystemd.<clinit>(Libsystemd.java:46)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.systemd.SystemdPlugin.sd_notify(SystemdPlugin.java:126)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.systemd.SystemdPlugin.onNodeStarted(SystemdPlugin.java:137)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.node.Node.start(Node.java:1347)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.bootstrap.Bootstrap.start(Bootstrap.java:339)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:413)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:180)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.bootstrap.OpenSearch.execute(OpenSearch.java:171)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:104)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.cli.Command.main(Command.java:101)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:137)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:103)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]: Caused by: java.lang.ExceptionInInitializerError: Exception java.lang.UnsatisfiedLinkError: /tmp/opensearch-17638710133668975609/jna4746470388946097819.tmp: /tmp/opensearch-17638710133668975609/jna4746470388946097819.tmp: failed to map segment from shared object [in thread "main"]
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at java.base/jdk.internal.loader.NativeLibraries.load(Native Method)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at java.base/jdk.internal.loader.NativeLibraries$NativeLibraryImpl.open(NativeLibraries.java:388)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at java.base/jdk.internal.loader.NativeLibraries.loadLibrary(NativeLibraries.java:232)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at java.base/jdk.internal.loader.NativeLibraries.loadLibrary(NativeLibraries.java:174)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at java.base/java.lang.ClassLoader.loadLibrary(ClassLoader.java:2389)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at java.base/java.lang.Runtime.load0(Runtime.java:755)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at java.base/java.lang.System.load(System.java:1953)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at com.sun.jna.Native.loadNativeDispatchLibraryFromClasspath(Native.java:1018)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at com.sun.jna.Native.loadNativeDispatchLibrary(Native.java:988)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at com.sun.jna.Native.<clinit>(Native.java:195)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at java.base/java.lang.Class.forName0(Native Method)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at java.base/java.lang.Class.forName(Class.java:375)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.bootstrap.Natives.<clinit>(Natives.java:60)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:123)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:191)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:404)
Nov 17 06:50:59 barikinil-Insp systemd-entrypoint[41303]:         ... 7 more
Nov 17 06:51:00 barikinil-Insp systemd[1]: wazuh-indexer.service: Main process exited, code=exited, status=1/FAILURE
Nov 17 06:51:00 barikinil-Insp systemd[1]: wazuh-indexer.service: Failed with result 'exit-code'.
Nov 17 06:51:00 barikinil-Insp systemd[1]: Failed to start Wazuh-indexer.
Nov 17 06:51:00 barikinil-Insp systemd[1]: wazuh-indexer.service: Consumed 51.820s CPU time.
17/11/2023 06:51:01 INFO: --- Removing existing Wazuh installation ---

rauldpm Nov 17, 2023
Collaborator

It looks like you're getting an error due to permissions for the /tmp directory.

Caused by: java.lang.ExceptionInInitializerError: Exception java.lang.UnsatisfiedLinkError: /tmp/opensearch-17638710133668975609/jna4746470388946097819.tmp: /tmp/opensearch-17638710133668975609/jna4746470388946097819.tmp: failed to map segment from shared object [in thread "main"]

Installation of wazuh-indexer fails if the noexec flag is set on the /tmp directory #1539

The solution proposed by the user is to change the directory to: -Djava.io.tmpdir=/var/log/wazuh-indexer

barikinil Nov 17, 2023
Author

Yes my /tmp is noexec, too. but i am using -a (all-in-one) installation. and if wazuh-indexer cant start, installer cancel and autoremove installation files and folders. how can i change if there is not a /etc/wazuh-indexer/jvm.options option to -Djava.io.tmpdir=/var/log/wazuh-indexer.

What do you suggest.?

I may try to install one by one. but i guess, installer will cancel too, even if i install one by one

rauldpm Nov 17, 2023
Collaborator

Due to this flag, the installation of the Wazuh indexer will fail either through Step-by-Step or using the WIA tool, so right now, to carry out the installation it is necessary to disable the flag until we change the default path for temporary directories.

rauldpm Nov 17, 2023
Collaborator

Once you have finished the installation, you can modify the directory used in the /etc/wazuh-indexer/jvm.options file to use another directory and re-enable the noexec flag, but keep in mind that this has not been tested and could cause and unexpected behavior.

The original value and where the change must be done is:

To something as:

-Djava.io.tmpdir=/path/to/dir

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Duplicated Wazuh server node names #2607

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 1 comment 11 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

Duplicated Wazuh server node names #2607

barikinil Nov 16, 2023

Replies: 1 comment · 11 replies

rauldpm Nov 16, 2023 Collaborator

barikinil Nov 17, 2023 Author

rauldpm Nov 17, 2023 Collaborator

barikinil Nov 17, 2023 Author

rauldpm Nov 17, 2023 Collaborator

rauldpm Nov 17, 2023 Collaborator

barikinil
Nov 16, 2023

Replies: 1 comment 11 replies

rauldpm
Nov 16, 2023
Collaborator

barikinil Nov 17, 2023
Author

rauldpm Nov 17, 2023
Collaborator

barikinil Nov 17, 2023
Author

rauldpm Nov 17, 2023
Collaborator

rauldpm Nov 17, 2023
Collaborator