[BUG] Indexer crashes after a restart command due to plugin load failure #505
Comments
AlexRuiz7
added
reporter/community
|
Hello @aghosh0605 Looking at the logs, this looks more like a configuration issue. It seems there is a typo in any of the settings preventing the service from starting. Have you performed any configuration changes lately? Have you upgraded Review your Regards, |
Hey, thanks for your support! Mostly till we remember we hadn't done any changes after setup as it was running fine! org.opensearch.bootstrap.OpenSearchnode.master: true
node.data: true
node.ingest: true
cluster.name: wazuh-indexer-cluster
cluster.routing.allocation.disk.threshold_enabled: false
node.max_local_storage_nodes: "3"
path.data: /var/lib/wazuh-indexer
path.logs: /var/log/wazuh-indexer
plugins.security.ssl.http.pemcert_filepath: /etc/wazuh-indexer/certs/node-1.pem
plugins.security.ssl.http.pemkey_filepath: /etc/wazuh-indexer/certs/node-1-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: /etc/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: /etc/wazuh-indexer/certs/node-1.pem
plugins.security.ssl.transport.pemkey_filepath: /etc/wazuh-indexer/certs/node-1-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.http.enabled: true
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.transport.resolve_hostname: false
plugins.security.ssl.http.enabled_ciphers:
- "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
- "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
- "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
- "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
plugins.security.ssl.http.enabled_protocols:
- "TLSv1.2"
plugins.security.authcz.admin_dn:
- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.restapi.roles_enabled:
- "all_access"
- "security_rest_api_access"
plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"]
### Option to allow Filebeat-oss 7.10.2 to work ###
compatibility.override_main_response_version: true
node.name: node-1
network.host: 0.0.0.0
cluster.initial_master_nodes: node-1
plugins.security.nodes_dn:
- CN=node-1,OU=Wazuh,O=Wazuh,L=California,C=US |
org.opensearch.bootstrap.OpenSearchnode.master: trueThat's the unrecognized setting. I don't recognize Wazuh 4.7.1 is based on OpenSearch 2.8.0. I've been reviewing the configuration and some fields are deprecated. These configurations are not included on our builds. Although they are deprecated, they should work. The problem is on the first line, as
Update: |
Hey! Thanks for the help. I don't know how it came but you are correct. |
Describe the bug
Errors are showing up while loading the plugins after the indexer is restarted
To Reproduce
Steps to reproduce the behaviour:
systemctl restart wazuh-indexerExpected behaviour
The indexer crashes after using a simple restart command due to a plugin load failure. This issue occurred unexpectedly after a long period without changes or updates, and specific reproducible steps are currently not clear to me.
Plugins
Screenshots
Logs of the error are attached below.
Host/Environment (please complete the following information):
The text was updated successfully, but these errors were encountered: