Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump Wazuh indexer to OpenSearch 2.10.0 #2520

Closed
13 tasks done
rauldpm opened this issue Oct 11, 2023 · 9 comments · Fixed by #2562
Closed
13 tasks done

Bump Wazuh indexer to OpenSearch 2.10.0 #2520

rauldpm opened this issue Oct 11, 2023 · 9 comments · Fixed by #2562
Assignees
@rauldpm
Labels
level/task Subtask issue type/change Change requested type/enhancement Enhancement issue

Comments

@rauldpm
Copy link
Member

rauldpm commented Oct 11, 2023 •
edited
Loading

Description

It is necessary to adapt the Wazuh indexer to version 2.10.0 of OpenSearch
Request: https://github.com/wazuh/internal-devel-requests/issues/301

Tasks

Stages

Validation

  • The package presents normal operation and without errors

Working branch
@rauldpm rauldpm added level/task Subtask issue type/enhancement Enhancement issue type/change Change requested labels Oct 11, 2023
@rauldpm rauldpm self-assigned this Oct 11, 2023
@wazuhci wazuhci moved this to Triage in Release 4.8.0 Oct 11, 2023
@wazuhci wazuhci moved this from Triage to In progress in Release 4.8.0 Oct 11, 2023
@rauldpm
Copy link
Member Author

rauldpm commented Oct 11, 2023 •
edited
Loading

Update report - Bump and building packages - Base and RPM

Base

RPM

  • Package creation fails due to changes in dependency versions
Files not found 
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-job-scheduler/opensearch-job-scheduler-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-job-scheduler/opensearch-job-scheduler-spi-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-job-scheduler/guava-31.0.1-jre.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/tokenizers-0.19.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/opensearch-ml-algorithms-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/opensearch-ml-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/api-0.19.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/j2objc-annotations-1.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/gson-2.9.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/opensearch-rest-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/onnxruntime-engine-0.19.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/pytorch-model-zoo-0.19.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/error_prone_annotations-2.7.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/checker-qual-3.12.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/commons-compress-1.21.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/jackson-databind-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/jackson-annotations-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/httpcore-nio-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/pytorch-engine-0.19.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/onnxruntime_gpu-1.13.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/opensearch-ml-common-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-ml/guava-31.0.1-jre.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/woodstox-core-6.4.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/jjwt-impl-0.10.8.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/parent-join-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/netty-transport-native-unix-common-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/mapper-extras-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/error_prone_annotations-2.3.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/commons-lang-2.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/json-smart-2.4.10.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/j2objc-annotations-1.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/netty-buffer-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/transport-netty4-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/zxcvbn-1.7.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/jakarta.xml.bind-api-2.3.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/netty-resolver-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/opensearch-rest-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/commons-codec-1.14.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/java-saml-core-2.5.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/lang-mustache-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/json-path-2.4.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/netty-common-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/bcpkix-jdk15on-1.70.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/commons-lang3-3.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/eventbus-3.2.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/guava-30.0-jre.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/netty-handler-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/jjwt-api-0.10.8.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/jackson-databind-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/aggs-matrix-stats-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/jackson-annotations-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/cxf-core-3.5.5.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/xmlsec-2.2.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/httpclient-cache-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/zstd-jni-1.5.2-1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/zjsonpatch-0.4.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/httpcore-nio-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/cxf-rt-rs-security-jose-3.5.5.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/java-saml-2.5.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/cryptacular-1.2.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/netty-transport-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/asm-9.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/opensearch-security-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/cxf-rt-security-3.5.5.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/netty-codec-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/rank-eval-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/slf4j-api-1.7.30.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/commons-cli-1.3.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/opensearch-rest-high-level-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/cxf-rt-rs-json-basic-3.5.5.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/netty-codec-http-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/jjwt-jackson-0.10.8.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/kafka-clients-3.4.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/json-flattener-0.5.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/checker-qual-3.5.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/commons-collections-3.2.2.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/log4j-slf4j-impl-2.17.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/metrics-core-3.1.2.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/httpcore-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/snappy-java-1.1.8.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/jaxb-runtime-2.3.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/txw2-2.3.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/jakarta.annotation-api-1.3.5.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/istack-commons-runtime-3.0.12.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security/bcprov-jdk15on-1.67.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-index-management/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-index-management/opensearch-index-management-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-index-management/opensearch-index-management-spi-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-index-management/httpcore-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-index-management/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-neural-search/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-neural-search/opensearch-neural-search-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-neural-search/opensearch-ml-client-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications/opensearch-notifications-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications/kotlin-stdlib-common-1.6.10.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-asynchronous-search/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-asynchronous-search/opensearch-asynchronous-search-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/error_prone_annotations-2.3.4.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/j2objc-annotations-1.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/kotlin-stdlib-jdk8-1.6.10.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/opensearch-rest-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/kotlin-stdlib-jdk7-1.6.10.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/kotlin-stdlib-1.6.10.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/guava-30.0-jre.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/httpcore-nio-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/alerting-core-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/checker-qual-3.5.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/percolator-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/httpcore-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/opensearch-alerting-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-alerting/kotlin-stdlib-common-1.6.10.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/datasources-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/opensearch-sql-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/okhttp-4.9.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/parent-join-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/core-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/j2objc-annotations-1.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/opensearch-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/bcprov-ext-jdk15on-1.70.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/opensearch-rest-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/error_prone_annotations-2.7.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/checker-qual-3.12.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/sql-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/opensearch-ssl-config-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/kotlin-stdlib-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/jackson-databind-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/legacy-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/jackson-annotations-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/okio-jvm-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/aws-encryption-sdk-java-2.4.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/geo-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/httpcore-nio-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/opensearch-ml-client-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/reindex-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/protocol-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/prometheus-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/ppl-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/common-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/kotlin-stdlib-jdk7-1.4.30.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-sql/guava-31.0.1-jre.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-geospatial/geo-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-geospatial/opensearch-geospatial-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-geospatial/commons-lang3-3.12.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-geospatial/h3-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-reports-scheduler/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-reports-scheduler/kotlin-stdlib-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-reports-scheduler/kotlin-stdlib-common-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-reports-scheduler/opensearch-reports-scheduler-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-reports-scheduler/kotlin-test-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-cross-cluster-replication/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-cross-cluster-replication/opensearch-cross-cluster-replication-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-cross-cluster-replication/kotlin-stdlib-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-cross-cluster-replication/kotlin-stdlib-common-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-cross-cluster-replication/kotlin-stdlib-jdk8-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-cross-cluster-replication/kotlin-stdlib-jdk7-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-knn/opensearch-knn-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-knn/guava-30.0-jre.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/opensearch-anomaly-detection-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/randomcutforest-parkservices-3.0-rc3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/opensearch-rest-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/randomcutforest-serialization-3.0-rc3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/httpcore-nio-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/commons-lang3-3.12.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/httpcore-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/randomcutforest-core-3.0-rc3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-anomaly-detection/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications-core/kotlin-stdlib-1.6.10.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications-core/jackson-databind-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications-core/jackson-annotations-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications-core/opensearch-notifications-core-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications-core/opensearch-notifications-core-spi-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications-core/httpcore-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications-core/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-notifications-core/kotlin-stdlib-common-1.6.10.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security-analytics/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security-analytics/opensearch-rest-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security-analytics/opensearch-security-analytics-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security-analytics/httpcore-nio-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security-analytics/commons-lang3-3.12.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security-analytics/httpcore-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-security-analytics/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-observability/common-utils-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-observability/kotlin-stdlib-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-observability/kotlin-stdlib-common-1.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-observability/opensearch-observability-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/jackson-module-paranamer-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/opensearch-performance-analyzer-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-transport-native-unix-common-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/performance-analyzer-commons-1.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/j2objc-annotations-1.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-buffer-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-resolver-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-handler-proxy-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-common-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-handler-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-codec-socks-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/jackson-databind-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/jackson-annotations-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-codec-http2-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/bcprov-jdk15on-1.70.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-transport-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-codec-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/netty-codec-http-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/plugins/opensearch-performance-analyzer/guava-31.1-jre.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-common/opensearch-grok-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-common/joni-2.1.44.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-common/opensearch-dissect-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-common/ingest-common-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/repository-url/repository-url-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/percolator/percolator-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/search-pipeline-common/search-pipeline-common-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/opensearch-dashboards/opensearch-rest-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/opensearch-dashboards/opensearch-ssl-config-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/opensearch-dashboards/opensearch-dashboards-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/opensearch-dashboards/httpcore-nio-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/opensearch-dashboards/reindex-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/opensearch-dashboards/httpcore-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/opensearch-dashboards/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/lang-painless/lang-painless-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/lang-painless/opensearch-scripting-painless-spi-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/analysis-common/analysis-common-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/rank-eval/rank-eval-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/aggs-matrix-stats/aggs-matrix-stats-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/geo/geo-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/mapper-extras/mapper-extras-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-user-agent/ingest-user-agent-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/systemd/systemd-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/netty-transport-native-unix-common-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/netty-buffer-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/transport-netty4-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/netty-resolver-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/netty-common-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/netty-handler-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/netty-transport-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/netty-codec-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/transport-netty4/netty-codec-http-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/parent-join/parent-join-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/lang-mustache/lang-mustache-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-geoip/maxmind-db-2.1.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-geoip/jackson-databind-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-geoip/ingest-geoip-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-geoip/jackson-annotations-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/ingest-geoip/geoip2-3.0.2.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/reindex/opensearch-rest-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/reindex/opensearch-ssl-config-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/reindex/httpcore-nio-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/reindex/reindex-client-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/reindex/httpcore-4.4.15.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/reindex/httpclient-4.5.13.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/lang-expression/lang-expression-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/modules/lang-expression/lucene-expressions-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/tools/upgrade-cli/opensearch-upgrade-cli-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/tools/upgrade-cli/jackson-core-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/tools/upgrade-cli/jackson-databind-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/tools/upgrade-cli/jackson-annotations-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/tools/plugin-cli/opensearch-plugin-cli-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/tools/keystore-cli/keystore-cli-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/log4j-core-2.17.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-misc-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-launchers-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-cli-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-core-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/jackson-core-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-spatial-extras-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-memory-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/hppc-0.8.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/log4j-api-2.17.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-secure-sm-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-x-content-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-backward-codecs-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-core-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/java-version-checker-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/jackson-dataformat-yaml-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-plugin-classloader-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-spatial3d-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-common-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/jackson-dataformat-cbor-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-suggest-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/opensearch-geo-2.8.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-grouping-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-sandbox-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-queryparser-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-highlighter-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-join-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/jackson-dataformat-smile-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/snakeyaml-2.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-analysis-common-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/log4j-jul-2.17.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/lib/lucene-queries-9.6.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/log4j-core-2.17.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-transport-native-unix-common-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/commons-lang3-3.9.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/jackson-core-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/performance-analyzer-commons-1.0.0-SNAPSHOT.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/j2objc-annotations-1.3.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-buffer-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-resolver-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/log4j-api-2.17.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/perfmark-api-0.25.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-handler-proxy-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-common-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/performance-analyzer-rca-2.8.0.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/bcpkix-jdk15on-1.70.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-handler-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-codec-socks-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/jackson-databind-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/jackson-annotations-2.15.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/proto-google-common-protos-2.9.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-codec-http2-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/bcprov-jdk15on-1.70.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/grpc-context-1.52.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/error_prone_annotations-2.14.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/grpc-api-1.52.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/javax.annotation-api-1.3.2.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-transport-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-codec-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/bcutil-jdk15on-1.70.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/grpc-protobuf-1.52.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/netty-codec-http-4.1.91.Final.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/grpc-netty-1.52.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/grpc-protobuf-lite-1.52.1.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/gson-2.9.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/checker-qual-3.29.0.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/animal-sniffer-annotations-1.21.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/guava-31.1-jre.jar
    File not found: /build/rpmbuild/BUILDROOT/wazuh-indexer-4.8.0-wp2520.x86_64/usr/share/wazuh-indexer/performance-analyzer-rca/lib/grpc-core-1.52.1.jar
  • Modified the spec file in order to avoid listing each file and use *
%attr(640, %{USER}, %{GROUP}) %{INSTALL_DIR}/modules/reindex/*.jar

@rauldpm rauldpm mentioned this issue Oct 11, 2023
Closed
2 tasks
@rauldpm
Copy link
Member Author

rauldpm commented Oct 11, 2023 •
edited
Loading

Analysis report - RPM

mkdir: cannot create directory ‘>> /dev/null 2>&1’: No such file or directory
Install 🟢 
[root@centos7 vagrant]# yum localinstall wazuh-indexer-4.8.0-wp2520.x86_64.rpm 
Loaded plugins: fastestmirror
Examining wazuh-indexer-4.8.0-wp2520.x86_64.rpm: wazuh-indexer-4.8.0-wp2520.x86_64
Marking wazuh-indexer-4.8.0-wp2520.x86_64.rpm to be installed
Resolving Dependencies
--> Running transaction check
---> Package wazuh-indexer.x86_64 0:4.8.0-wp2520 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

=============================================================================================================================================================================================================================================
 Package                                               Arch                                           Version                                               Repository                                                                  Size
=============================================================================================================================================================================================================================================
Installing:
 wazuh-indexer                                         x86_64                                         4.8.0-wp2520                                          /wazuh-indexer-4.8.0-wp2520.x86_64                                         1.0 G

Transaction Summary
=============================================================================================================================================================================================================================================
Install  1 Package

Total size: 1.0 G
Installed size: 1.0 G
Is this ok [y/d/N]: y
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : wazuh-indexer-4.8.0-wp2520.x86_64                                                                                                                                                                                         1/1 
Created opensearch keystore in /etc/wazuh-indexer/opensearch.keystore
  Verifying  : wazuh-indexer-4.8.0-wp2520.x86_64                                                                                                                                                                                         1/1 

Installed:
  wazuh-indexer.x86_64 0:4.8.0-wp2520                                                                                                                                                                                                        

Complete!
Certificate creation 🟡 and certificates copy 🟢 
[root@centos7 vagrant]# nano config.yml 
[root@centos7 vagrant]# bash ./wazuh-certs-tool.sh -A
mkdir: cannot create directory ‘>> /dev/null 2>&1’: No such file or directory
11/10/2023 20:38:34 INFO: Admin certificates created.
11/10/2023 20:38:34 INFO: Wazuh indexer certificates created.
[root@centos7 vagrant]# cat config.yml 
nodes:
  # Wazuh indexer nodes
  indexer:
    - name: indexer-1
      ip: "192.168.56.4"
[root@centos7 vagrant]# ls
config.yml  wazuh-certificates  wazuh-certs-tool.sh  wazuh-indexer-4.8.0-wp2520.x86_64.rpm
[root@centos7 vagrant]# ls wazuh-certificates/
admin-key.pem  admin.pem  indexer-1-key.pem  indexer-1.pem  root-ca.key  root-ca.pem
[root@centos7 vagrant]# tar -cvf ./wazuh-certificates.tar -C ./wazuh-certificates/ .
./
./root-ca.key
./root-ca.pem
./admin-key.pem
./admin.pem
./indexer-1-key.pem
./indexer-1.pem

[root@centos7 vagrant]# NODE_NAME=node-1
[root@centos7 vagrant]# NODE_NAME=indexer-1
[root@centos7 vagrant]# mkdir /etc/wazuh-indexer/certs
[root@centos7 vagrant]# tar -xf ./wazuh-certificates.tar -C /etc/wazuh-indexer/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
[root@centos7 vagrant]# mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
[root@centos7 vagrant]# mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
[root@centos7 vagrant]# chmod 500 /etc/wazuh-indexer/certs
[root@centos7 vagrant]# chmod 400 /etc/wazuh-indexer/certs/*
[root@centos7 vagrant]# chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs
[root@centos7 vagrant]# NODE_NAME=indexer-1
[root@centos7 vagrant]# mkdir /etc/wazuh-indexer/certs
[root@centos7 vagrant]# tar -xf ./wazuh-certificates.tar -C /etc/wazuh-indexer/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
[root@centos7 vagrant]# mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
[root@centos7 vagrant]# mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
[root@centos7 vagrant]# chmod 500 /etc/wazuh-indexer/certs
[root@centos7 vagrant]# chmod 400 /etc/wazuh-indexer/certs/*
[root@centos7 vagrant]# chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs
Start service 🟢 
[root@centos7 vagrant]# systemctl daemon-reload
[root@centos7 vagrant]# systemctl enable wazuh-indexer
Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-indexer.service to /usr/lib/systemd/system/wazuh-indexer.service.
[root@centos7 vagrant]# systemctl start wazuh-indexer
[root@centos7 vagrant]# systemctl status wazuh-indexer
● wazuh-indexer.service - Wazuh-indexer
   Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2023-10-11 20:50:31 UTC; 7s ago
     Docs: https://documentation.wazuh.com
 Main PID: 22409 (java)
   CGroup: /system.slice/wazuh-indexer.service
           └─22409 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8...

Oct 11 20:50:25 centos7 systemd[1]: Starting Wazuh-indexer...
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: System::setSecurityManager will be removed in a future release
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: System::setSecurityManager will be removed in a future release
Oct 11 20:50:31 centos7 systemd[1]: Started Wazuh-indexer.
Initialize cluster 🟢 
[root@centos7 vagrant]# /usr/share/wazuh-indexer/bin/indexer-security-init.sh
**************************************************************************
** This tool will be deprecated in the next major release of OpenSearch **
** https://github.com/opensearch-project/security/issues/1755           **
**************************************************************************
Security Admin v7
Will connect to 127.0.0.1:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.10.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
Populate config from /etc/wazuh-indexer/opensearch-security/
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml 
   SUCC: Configuration for 'config' created or updated
Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml 
   SUCC: Configuration for 'roles' created or updated
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml 
   SUCC: Configuration for 'rolesmapping' created or updated
Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml 
   SUCC: Configuration for 'internalusers' created or updated
Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml 
   SUCC: Configuration for 'actiongroups' created or updated
Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml 
   SUCC: Configuration for 'tenants' created or updated
Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml 
   SUCC: Configuration for 'nodesdn' created or updated
Will update '/whitelist' with /etc/wazuh-indexer/opensearch-security/whitelist.yml 
   SUCC: Configuration for 'whitelist' created or updated
Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml 
   SUCC: Configuration for 'audit' created or updated
Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml 
   SUCC: Configuration for 'allowlist' created or updated
SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"]) due to: null
Done with success
Check cluster health 🟢 
[root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200
{
  "name" : "node-1",
  "cluster_name" : "wazuh-cluster",
  "cluster_uuid" : "olvQC435S2aCcHYDPmbbbQ",
  "version" : {
    "number" : "7.10.2",
    "build_type" : "rpm",
    "build_hash" : "eee49cb340edc6c4d489bcd9324dda571fc8dc03",
    "build_date" : "2023-09-20T23:54:29.889267151Z",
    "build_snapshot" : false,
    "lucene_version" : "9.7.0",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}

[root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cat/nodes?v
ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
10.0.2.15           45          94   2    0.14    0.08     0.06 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1

[root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cat/shards
.opensearch-observability        0 p STARTED  0   208b 10.0.2.15 node-1
.plugins-ml-config               0 p STARTED  1  3.8kb 10.0.2.15 node-1
.opensearch-sap-log-types-config 0 p STARTED           10.0.2.15 node-1
.opendistro_security             0 p STARTED 10 64.3kb 10.0.2.15 node-1

[root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cluster/health?pretty
{
  "cluster_name" : "wazuh-cluster",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "discovered_master" : true,
  "discovered_cluster_manager" : true,
  "active_primary_shards" : 4,
  "active_shards" : 4,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}

Logs

journal 🟢 
-- Logs begin at Wed 2023-10-11 17:25:02 UTC, end at Wed 2023-10-11 21:01:01 UTC. --
Oct 11 20:50:31 centos7 systemd[1]: Started Wazuh-indexer.
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: System::setSecurityManager will be removed in a future release
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: System::setSecurityManager will be removed in a future release
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Oct 11 20:50:26 centos7 systemd-entrypoint[22409]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 11 20:50:25 centos7 systemd[1]: Starting Wazuh-indexer...
/var/log/wazuh-indexer 🟡
  • wazuh-cluster_deprecations.json 
    {"type": "deprecation", "timestamp": "2023-10-11T20:50:28,117Z", "level": "DEPRECATION", "component": "o.o.d.c.s.Settings", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "[node.max_local_storage_nodes] setting was deprecated in OpenSearch and will be removed in a future release! See the breaking changes documentation for the next major version." }

    {"type": "deprecation", "timestamp": "2023-10-11T20:50:29,030Z", "level": "DEPRECATION", "component": "o.o.d.c.s.Settings", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "[index.store.hybrid.mmap.extensions] setting was deprecated in OpenSearch and will be removed in a future release! See the breaking changes documentation for the next major version." }

    {"type": "deprecation", "timestamp": "2023-10-11T20:50:29,032Z", "level": "DEPRECATION", "component": "o.o.d.c.s.Settings", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "[cluster.initial_master_nodes] setting was deprecated in OpenSearch and will be removed in a future release! See the breaking changes documentation for the next major version." }

    {"type": "deprecation", "timestamp": "2023-10-11T20:50:30,685Z", "level": "DEPRECATION", "component": "o.o.d.a.m.TransportMainAction", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "overriding main response version number will be removed in a future version" }

    {"type": "deprecation", "timestamp": "2023-10-11T20:50:31,150Z", "level": "DEPRECATION", "component": "o.o.d.c.m.MetadataCreateIndexService", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "index name [.opensearch-observability] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices", "cluster.uuid": "olvQC435S2aCcHYDPmbbbQ", "node.id": "AP8Lch6dQLiTv-xA-wRP1Q"  }

    {"type": "deprecation", "timestamp": "2023-10-11T20:51:07,139Z", "level": "DEPRECATION", "component": "o.o.d.c.m.IndexNameExpressionResolver", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "this request accesses system indices: [.opendistro_security], but in a future major version, direct access to system indices will be prevented by default", "cluster.uuid": "olvQC435S2aCcHYDPmbbbQ", "node.id": "AP8Lch6dQLiTv-xA-wRP1Q"  }
  • wazuh-cluster_server.json 
    {"type": "server", "timestamp": "2023-10-11T20:50:29,517Z", "level": "WARN", "component": "o.o.s.c.Salt", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "If you plan to use field masking pls configure compliance salt e1ukloTsQlOgPquJ to be a random string of 16 chars length identical on all nodes" }

    {"type": "server", "timestamp": "2023-10-11T20:50:29,533Z", "level": "ERROR", "component": "o.o.s.a.s.SinkProvider", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Default endpoint could not be created, auditlog will not work properly." }
{"type": "server", "timestamp": "2023-10-11T20:50:29,534Z", "level": "WARN", "component": "o.o.s.a.r.AuditMessageRouter", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "No default storage available, audit log may not work properly. Please check configuration." }

    {"type": "server", "timestamp": "2023-10-11T20:50:29,988Z", "level": "WARN", "component": "o.o.s.p.SQLPlugin", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information" }

    Reported at Wazuh indexer warning message about dangling indices #2519

    {"type": "server", "timestamp": "2023-10-11T20:50:30,573Z", "level": "WARN", "component": "o.o.g.DanglingIndicesState", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "gateway.auto_import_dangling_indices is disabled, dangling indices will not be automatically detected or imported and must be managed manually" }

    {"type": "server", "timestamp": "2023-10-11T20:50:31,093Z", "level": "ERROR", "component": "o.o.s.t.SecurityRequestHandler", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "OpenSearchException[Transport client authentication no longer supported.]" }

    {"type": "server", "timestamp": "2023-10-11T20:50:31,096Z", "level": "WARN", "component": "o.o.d.HandshakingTransportAddressConnector", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "handshake failed for [connectToRemoteMasterNode[[::1]:9300]]", 
"stacktrace": ["org.opensearch.transport.RemoteTransportException: [node-1][[::1]:9300][internal:transport/handshake]",
"Caused by: org.opensearch.OpenSearchException: Transport client authentication no longer supported.",
"at org.opensearch.security.ssl.util.ExceptionUtils.createTransportClientNoLongerSupportedException(ExceptionUtils.java:68) ~[?:?]",
"at org.opensearch.security.transport.SecurityRequestHandler.messageReceivedDecorate(SecurityRequestHandler.java:292) ~[?:?]",
"at org.opensearch.security.ssl.transport.SecuritySSLRequestHandler.messageReceived(SecuritySSLRequestHandler.java:163) ~[?:?]",
"at org.opensearch.security.OpenSearchSecurityPlugin$7$1.messageReceived(OpenSearchSecurityPlugin.java:763) ~[?:?]",
"at org.opensearch.indexmanagement.rollup.interceptor.RollupInterceptor$interceptHandler$1.messageReceived(RollupInterceptor.kt:113) ~[?:?]",
"at org.opensearch.performanceanalyzer.transport.PerformanceAnalyzerTransportRequestHandler.messageReceived(PerformanceAnalyzerTransportRequestHandler.java:43) ~[?:?]",
"at org.opensearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:106) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundHandler.handleRequest(InboundHandler.java:250) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundHandler.messageReceived(InboundHandler.java:133) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundHandler.inboundMessage(InboundHandler.java:115) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.TcpTransport.inboundMessage(TcpTransport.java:767) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundPipeline.forwardFragments(InboundPipeline.java:175) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundPipeline.doHandleBytes(InboundPipeline.java:150) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundPipeline.handleBytes(InboundPipeline.java:115) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:95) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
"at io.netty.handler.logging.LoggingHandler.channelRead(LoggingHandler.java:280) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
"at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:103) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
"at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1466) ~[?:?]",
"at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1329) ~[?:?]",
"at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1378) ~[?:?]",
"at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:529) ~[?:?]",
"at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:468) ~[?:?]",
"at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
"at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
"at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) ~[?:?]",
"at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) ~[?:?]",
"at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788) ~[?:?]",
"at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:689) ~[?:?]",
"at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:652) ~[?:?]",
"at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) ~[?:?]",
"at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) ~[?:?]",
"at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) ~[?:?]",
"at java.lang.Thread.run(Thread.java:833) [?:?]"] }
{"type": "server", "timestamp": "2023-10-11T20:50:31,104Z", "level": "WARN", "component": "o.o.d.HandshakingTransportAddressConnector", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "handshake failed for [connectToRemoteMasterNode[127.0.0.1:9300]]", 
"stacktrace": ["org.opensearch.transport.RemoteTransportException: [node-1][127.0.0.1:9300][internal:transport/handshake]",
"Caused by: org.opensearch.OpenSearchException: Transport client authentication no longer supported.",
"at org.opensearch.security.ssl.util.ExceptionUtils.createTransportClientNoLongerSupportedException(ExceptionUtils.java:68) ~[?:?]",
"at org.opensearch.security.transport.SecurityRequestHandler.messageReceivedDecorate(SecurityRequestHandler.java:292) ~[?:?]",
"at org.opensearch.security.ssl.transport.SecuritySSLRequestHandler.messageReceived(SecuritySSLRequestHandler.java:163) ~[?:?]",
"at org.opensearch.security.OpenSearchSecurityPlugin$7$1.messageReceived(OpenSearchSecurityPlugin.java:763) ~[?:?]",
"at org.opensearch.indexmanagement.rollup.interceptor.RollupInterceptor$interceptHandler$1.messageReceived(RollupInterceptor.kt:113) ~[?:?]",
"at org.opensearch.performanceanalyzer.transport.PerformanceAnalyzerTransportRequestHandler.messageReceived(PerformanceAnalyzerTransportRequestHandler.java:43) ~[?:?]",
"at org.opensearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:106) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundHandler.handleRequest(InboundHandler.java:250) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundHandler.messageReceived(InboundHandler.java:133) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundHandler.inboundMessage(InboundHandler.java:115) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.TcpTransport.inboundMessage(TcpTransport.java:767) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundPipeline.forwardFragments(InboundPipeline.java:175) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundPipeline.doHandleBytes(InboundPipeline.java:150) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundPipeline.handleBytes(InboundPipeline.java:115) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:95) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
"at io.netty.handler.logging.LoggingHandler.channelRead(LoggingHandler.java:280) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
"at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:103) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
"at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1466) ~[?:?]",
"at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1329) ~[?:?]",
"at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1378) ~[?:?]",
"at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:529) ~[?:?]",
"at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:468) ~[?:?]",
"at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
"at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
"at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) ~[?:?]",
"at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) ~[?:?]",
"at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788) ~[?:?]",
"at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:689) ~[?:?]",
"at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:652) ~[?:?]",
"at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) ~[?:?]",
"at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) ~[?:?]",
"at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) ~[?:?]",
"at java.lang.Thread.run(Thread.java:833) [?:?]"] }
    • No reports have been found with this warning even in the OpenSearch repository, the message appears among other messages, but it is not the main reported problem. As the message said, it is being ignored.
    {"type": "server", "timestamp": "2023-10-11T20:50:31,120Z", "level": "WARN", "component": "o.o.p.c.s.h.ConfigOverridesClusterSettingHandler", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Config override setting update called with empty string. Ignoring." }

{"type": "server", "timestamp": "2023-10-11T20:50:29,988Z", "level": "WARN", "component": "o.o.s.p.SQLPlugin", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information" }

@wazuhci wazuhci moved this from In progress to On hold in Release 4.8.0 Oct 11, 2023
@wazuhci wazuhci moved this from On hold to In progress in Release 4.8.0 Oct 16, 2023
@rauldpm
Copy link
Member Author

rauldpm commented Oct 16, 2023 •
edited
Loading

Update report - Bump and building packages - DEB

@rauldpm
Copy link
Member Author

rauldpm commented Oct 16, 2023 •
edited
Loading

Analysis report - DEB

Install 🟢 
root@ubuntu20stack:/home/vagrant# apt install ./wazuh-indexer_4.8.0-wp2520_amd64.deb 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Note, selecting 'wazuh-indexer' instead of './wazuh-indexer_4.8.0-wp2520_amd64.deb'
The following NEW packages will be installed:
  wazuh-indexer
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/754 MB of archives.
After this operation, 1,050 MB of additional disk space will be used.
Get:1 /home/vagrant/wazuh-indexer_4.8.0-wp2520_amd64.deb wazuh-indexer amd64 4.8.0-wp2520 [754 MB]
Selecting previously unselected package wazuh-indexer.
(Reading database ... 111886 files and directories currently installed.)
Preparing to unpack .../wazuh-indexer_4.8.0-wp2520_amd64.deb ...
Creating wazuh-indexer group... OK
Creating wazuh-indexer user... OK
Unpacking wazuh-indexer (4.8.0-wp2520) ...
Setting up wazuh-indexer (4.8.0-wp2520) ......................................................................................] 
Created opensearch keystore in /etc/wazuh-indexer/opensearch.keystore
Processing triggers for systemd (245.4-4ubuntu3.20) ...
Processing triggers for libc-bin (2.31-0ubuntu9.9) ..
Certificate creation 🟢 and certificates copy 🟢 
root@ubuntu20stack:/home/vagrant# bash ./wazuh-certs-tool.sh -A
16/10/2023 13:50:55 INFO: Admin certificates created.
16/10/2023 13:50:55 INFO: Wazuh indexer certificates created.
root@ubuntu20stack:/home/vagrant# tar -cvf ./wazuh-certificates.tar -C ./wazuh-certificates/ .
./
./admin.pem
./indexer-1.pem
./indexer-1-key.pem
./root-ca.pem
./admin-key.pem
./root-ca.key

root@ubuntu20stack:/home/vagrant# NODE_NAME=indexer-1
root@ubuntu20stack:/home/vagrant# mkdir /etc/wazuh-indexer/certs
root@ubuntu20stack:/home/vagrant# tar -xf ./wazuh-certificates.tar -C /etc/wazuh-indexer/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
root@ubuntu20stack:/home/vagrant# mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
root@ubuntu20stack:/home/vagrant# mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
root@ubuntu20stack:/home/vagrant# chmod 500 /etc/wazuh-indexer/certs
root@ubuntu20stack:/home/vagrant# chmod 400 /etc/wazuh-indexer/certs/*
root@ubuntu20stack:/home/vagrant# chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs
Start service 🟢 
root@ubuntu20stack:/home/vagrant# systemctl daemon-reload
root@ubuntu20stack:/home/vagrant# systemctl enable wazuh-indexer
Created symlink /etc/systemd/system/multi-user.target.wants/wazuh-indexer.service → /lib/systemd/system/wazuh-indexer.service.
root@ubuntu20stack:/home/vagrant# systemctl start wazuh-indexer
root@ubuntu20stack:/home/vagrant# systemctl status wazuh-indexer
● wazuh-indexer.service - Wazuh-indexer
     Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2023-10-16 14:26:29 UTC; 6s ago
       Docs: https://documentation.wazuh.com
   Main PID: 3300 (java)
      Tasks: 73 (limit: 9325)
     Memory: 1.3G
     CGroup: /system.slice/wazuh-indexer.service
             └─3300 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=t>

Oct 16 14:26:23 ubuntu20stack systemd[1]: Starting Wazuh-indexer...
Oct 16 14:26:24 ubuntu20stack systemd-entrypoint[3300]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 16 14:26:24 ubuntu20stack systemd-entrypoint[3300]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Oct 16 14:26:24 ubuntu20stack systemd-entrypoint[3300]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Oct 16 14:26:24 ubuntu20stack systemd-entrypoint[3300]: WARNING: System::setSecurityManager will be removed in a future release
Oct 16 14:26:25 ubuntu20stack systemd-entrypoint[3300]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 16 14:26:25 ubuntu20stack systemd-entrypoint[3300]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Oct 16 14:26:25 ubuntu20stack systemd-entrypoint[3300]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Oct 16 14:26:25 ubuntu20stack systemd-entrypoint[3300]: WARNING: System::setSecurityManager will be removed in a future release
Oct 16 14:26:29 ubuntu20stack systemd[1]: Started Wazuh-indexer.
Initialize cluster 🟢 
root@ubuntu20stack:/home/vagrant# /usr/share/wazuh-indexer/bin/indexer-security-init.sh
**************************************************************************
** This tool will be deprecated in the next major release of OpenSearch **
** https://github.com/opensearch-project/security/issues/1755           **
**************************************************************************
Security Admin v7
Will connect to 127.0.0.1:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.10.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
Populate config from /etc/wazuh-indexer/opensearch-security/
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml 
   SUCC: Configuration for 'config' created or updated
Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml 
   SUCC: Configuration for 'roles' created or updated
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml 
   SUCC: Configuration for 'rolesmapping' created or updated
Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml 
   SUCC: Configuration for 'internalusers' created or updated
Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml 
   SUCC: Configuration for 'actiongroups' created or updated
Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml 
   SUCC: Configuration for 'tenants' created or updated
Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml 
   SUCC: Configuration for 'nodesdn' created or updated
Will update '/whitelist' with /etc/wazuh-indexer/opensearch-security/whitelist.yml 
   SUCC: Configuration for 'whitelist' created or updated
Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml 
   SUCC: Configuration for 'audit' created or updated
Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml 
   SUCC: Configuration for 'allowlist' created or updated
SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"]) due to: null
Done with success
Check cluster health 🟢 
root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200
{
  "name" : "node-1",
  "cluster_name" : "wazuh-cluster",
  "cluster_uuid" : "tWpt9CrlQCWXY8VxBeIHEw",
  "version" : {
    "number" : "7.10.2",
    "build_type" : "rpm",
    "build_hash" : "eee49cb340edc6c4d489bcd9324dda571fc8dc03",
    "build_date" : "2023-09-20T23:54:29.889267151Z",
    "build_snapshot" : false,
    "lucene_version" : "9.7.0",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}

root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cat/nodes?v
ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
10.0.2.15           39          48   3    0.07    0.04     0.01 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1

root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cat/shards
.opensearch-observability        0 p STARTED  0   208b 10.0.2.15 node-1
.plugins-ml-config               0 p STARTED  1  3.8kb 10.0.2.15 node-1
.opensearch-sap-log-types-config 0 p STARTED           10.0.2.15 node-1
.opendistro_security             0 p STARTED 10 64.3kb 10.0.2.15 node-1

root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cluster/health?pretty
{
  "cluster_name" : "wazuh-cluster",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "discovered_master" : true,
  "discovered_cluster_manager" : true,
  "active_primary_shards" : 4,
  "active_shards" : 4,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}

Logs

journal 🟢 
root@ubuntu20stack:/home/vagrant# journalctl -u wazuh-indexer
-- Logs begin at Mon 2023-10-16 13:42:20 UTC, end at Mon 2023-10-16 14:27:06 UTC. --
Oct 16 14:26:23 ubuntu20stack systemd[1]: Starting Wazuh-indexer...
Oct 16 14:26:24 ubuntu20stack systemd-entrypoint[3300]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 16 14:26:24 ubuntu20stack systemd-entrypoint[3300]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Oct 16 14:26:24 ubuntu20stack systemd-entrypoint[3300]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Oct 16 14:26:24 ubuntu20stack systemd-entrypoint[3300]: WARNING: System::setSecurityManager will be removed in a future release
Oct 16 14:26:25 ubuntu20stack systemd-entrypoint[3300]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 16 14:26:25 ubuntu20stack systemd-entrypoint[3300]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.10.0.jar)
Oct 16 14:26:25 ubuntu20stack systemd-entrypoint[3300]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Oct 16 14:26:25 ubuntu20stack systemd-entrypoint[3300]: WARNING: System::setSecurityManager will be removed in a future release
Oct 16 14:26:29 ubuntu20stack systemd[1]: Started Wazuh-indexer.
/var/log/wazuh-indexer 🟡
  • wazuh-cluster_deprecations.json 
    {"type": "deprecation", "timestamp": "2023-10-16T14:26:26,749Z", "level": "DEPRECATION", "component": "o.o.d.c.s.Settings", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "[node.max_local_storage_nodes] setting was deprecated in OpenSearch and will be removed in a future release! See the breaking changes documentation for the next major version." }

    {"type": "deprecation", "timestamp": "2023-10-16T14:26:27,716Z", "level": "DEPRECATION", "component": "o.o.d.c.s.Settings", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "[index.store.hybrid.mmap.extensions] setting was deprecated in OpenSearch and will be removed in a future release! See the breaking changes documentation for the next major version." }

    {"type": "deprecation", "timestamp": "2023-10-16T14:26:27,717Z", "level": "DEPRECATION", "component": "o.o.d.c.s.Settings", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "[cluster.initial_master_nodes] setting was deprecated in OpenSearch and will be removed in a future release! See the breaking changes documentation for the next major version." }

    {"type": "deprecation", "timestamp": "2023-10-16T14:26:29,276Z", "level": "DEPRECATION", "component": "o.o.d.a.m.TransportMainAction", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "overriding main response version number will be removed in a future version" }

    {"type": "deprecation", "timestamp": "2023-10-16T14:26:29,767Z", "level": "DEPRECATION", "component": "o.o.d.c.m.MetadataCreateIndexService", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "index name [.opensearch-observability] starts with a dot '.', in the next major version, index names starting with a dot are reserved for hidden indices and system indices", "cluster.uuid": "tWpt9CrlQCWXY8VxBeIHEw", "node.id": "uBxoNDM7RXaSPSH5SrzeHg"  }

    {"type": "deprecation", "timestamp": "2023-10-16T14:26:57,215Z", "level": "DEPRECATION", "component": "o.o.d.c.m.IndexNameExpressionResolver", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "this request accesses system indices: [.opendistro_security], but in a future major version, direct access to system indices will be prevented by default", "cluster.uuid": "tWpt9CrlQCWXY8VxBeIHEw", "node.id": "uBxoNDM7RXaSPSH5SrzeHg"  }
  • wazuh-cluster_server.json 
    {"type": "server", "timestamp": "2023-10-16T14:26:28,195Z", "level": "WARN", "component": "o.o.s.c.Salt", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "If you plan to use field masking pls configure compliance salt e1ukloTsQlOgPquJ to be a random string of 16 chars length identical on all nodes" }

    {"type": "server", "timestamp": "2023-10-16T14:26:28,212Z", "level": "ERROR", "component": "o.o.s.a.s.SinkProvider", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Default endpoint could not be created, auditlog will not work properly." }

{"type": "server", "timestamp": "2023-10-16T14:26:28,213Z", "level": "WARN", "component": "o.o.s.a.r.AuditMessageRouter", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "No default storage available, audit log may not work properly. Please check configuration." }

    {"type": "server", "timestamp": "2023-10-16T14:26:28,641Z", "level": "WARN", "component": "o.o.s.p.SQLPlugin", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information" }

    {"type": "server", "timestamp": "2023-10-16T14:26:29,175Z", "level": "WARN", "component": "o.o.g.DanglingIndicesState", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "gateway.auto_import_dangling_indices is disabled, dangling indices will not be automatically detected or imported and must be managed manually" }

    {"type": "server", "timestamp": "2023-10-16T14:26:29,701Z", "level": "ERROR", "component": "o.o.s.t.SecurityRequestHandler", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "OpenSearchException[Transport client authentication no longer supported.]" }

    {"type": "server", "timestamp": "2023-10-16T14:26:29,708Z", "level": "WARN", "component": "o.o.d.HandshakingTransportAddressConnector", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "handshake failed for [connectToRemoteMasterNode[127.0.0.1:9300]]", 
"stacktrace": ["org.opensearch.transport.RemoteTransportException: [node-1][127.0.0.1:9300][internal:transport/handshake]",
"Caused by: org.opensearch.OpenSearchException: Transport client authentication no longer supported.",
"at org.opensearch.security.ssl.util.ExceptionUtils.createTransportClientNoLongerSupportedException(ExceptionUtils.java:68) ~[?:?]",
"at org.opensearch.security.transport.SecurityRequestHandler.messageReceivedDecorate(SecurityRequestHandler.java:292) ~[?:?]",
"at org.opensearch.security.ssl.transport.SecuritySSLRequestHandler.messageReceived(SecuritySSLRequestHandler.java:163) ~[?:?]",
"at org.opensearch.security.OpenSearchSecurityPlugin$7$1.messageReceived(OpenSearchSecurityPlugin.java:763) ~[?:?]",
"at org.opensearch.indexmanagement.rollup.interceptor.RollupInterceptor$interceptHandler$1.messageReceived(RollupInterceptor.kt:113) ~[?:?]",
"at org.opensearch.performanceanalyzer.transport.PerformanceAnalyzerTransportRequestHandler.messageReceived(PerformanceAnalyzerTransportRequestHandler.java:43) ~[?:?]",
"at org.opensearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:106) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundHandler.handleRequest(InboundHandler.java:250) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundHandler.messageReceived(InboundHandler.java:133) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundHandler.inboundMessage(InboundHandler.java:115) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.TcpTransport.inboundMessage(TcpTransport.java:767) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundPipeline.forwardFragments(InboundPipeline.java:175) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundPipeline.doHandleBytes(InboundPipeline.java:150) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.InboundPipeline.handleBytes(InboundPipeline.java:115) ~[opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:95) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
"at io.netty.handler.logging.LoggingHandler.channelRead(LoggingHandler.java:280) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
"at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:103) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
"at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1466) ~[?:?]",
"at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1329) ~[?:?]",
"at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1378) ~[?:?]",
"at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:529) ~[?:?]",
"at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:468) ~[?:?]",
"at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412) ~[?:?]",
"at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440) ~[?:?]",
"at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) ~[?:?]",
"at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) ~[?:?]",
"at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) ~[?:?]",
"at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788) ~[?:?]",
"at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:689) ~[?:?]",
"at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:652) ~[?:?]",
"at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) ~[?:?]",
"at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) ~[?:?]",
"at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) ~[?:?]",
"at java.lang.Thread.run(Thread.java:833) [?:?]"] }
    • No reports have been found with this warning even in the OpenSearch repository, the message appears among other messages, but it is not the main reported problem. As the message said, it is being ignored.
    {"type": "server", "timestamp": "2023-10-16T14:26:29,736Z", "level": "WARN", "component": "o.o.p.c.s.h.ConfigOverridesClusterSettingHandler", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Config override setting update called with empty string. Ignoring." }

    {"type": "server", "timestamp": "2023-10-16T14:26:30,041Z", "level": "ERROR", "component": "o.o.p.c.o.OSGlobals", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Error in static initialization of OSGlobals with exception: java.security.AccessControlException: access denied (\"java.io.FilePermission\" \"/proc/self/task\" \"read\")", "cluster.uuid": "tWpt9CrlQCWXY8VxBeIHEw", "node.id": "uBxoNDM7RXaSPSH5SrzeHg" , 
"stacktrace": ["java.security.AccessControlException: access denied (\"java.io.FilePermission\" \"/proc/self/task\" \"read\")",
"at java.security.AccessControlContext.checkPermission(AccessControlContext.java:485) ~[?:?]",
"at java.security.AccessController.checkPermission(AccessController.java:1068) ~[?:?]",
"at java.lang.SecurityManager.checkPermission(SecurityManager.java:416) ~[?:?]",
"at java.lang.SecurityManager.checkRead(SecurityManager.java:756) ~[?:?]",
"at java.io.File.normalizedList(File.java:1171) ~[?:?]",
"at java.io.File.listFiles(File.java:1269) ~[?:?]",
"at org.opensearch.performanceanalyzer.commons.os.OSGlobals.enumTids(OSGlobals.java:75) ~[performance-analyzer-commons-1.1.0.jar:?]",
"at org.opensearch.performanceanalyzer.commons.os.OSGlobals.<clinit>(OSGlobals.java:34) [performance-analyzer-commons-1.1.0.jar:?]",
"at org.opensearch.performanceanalyzer.commons.metrics_generator.linux.LinuxOSMetricsGenerator.getPid(LinuxOSMetricsGenerator.java:36) [performance-analyzer-commons-1.1.0.jar:?]",
"at org.opensearch.performanceanalyzer.commons.jvm.ThreadList.<clinit>(ThreadList.java:44) [performance-analyzer-commons-1.1.0.jar:?]",
"at org.opensearch.performanceanalyzer.commons.util.ThreadIDUtil.getNativeThreadId(ThreadIDUtil.java:22) [performance-analyzer-commons-1.1.0.jar:?]",
"at org.opensearch.performanceanalyzer.commons.util.ThreadIDUtil.getNativeCurrentThreadId(ThreadIDUtil.java:18) [performance-analyzer-commons-1.1.0.jar:?]",
"at org.opensearch.performanceanalyzer.listener.PerformanceAnalyzerSearchListener.preQueryPhase(PerformanceAnalyzerSearchListener.java:112) [opensearch-performance-analyzer-2.10.0.0.jar:2.10.0.0]",
"at org.opensearch.performanceanalyzer.listener.PerformanceAnalyzerSearchListener.onPreQueryPhase(PerformanceAnalyzerSearchListener.java:46) [opensearch-performance-analyzer-2.10.0.0.jar:2.10.0.0]",
"at org.opensearch.index.shard.SearchOperationListener$CompositeListener.onPreQueryPhase(SearchOperationListener.java:162) [opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.search.SearchService$SearchOperationListenerExecutor.<init>(SearchService.java:1746) [opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.search.SearchService$SearchOperationListenerExecutor.<init>(SearchService.java:1735) [opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.search.SearchService.executeQueryPhase(SearchService.java:596) [opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.search.SearchService$2.lambda$onResponse$0(SearchService.java:566) [opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:74) [opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.action.ActionRunnable$2.doRun(ActionRunnable.java:89) [opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52) [opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.threadpool.TaskAwareRunnable.doRun(TaskAwareRunnable.java:78) [opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52) [opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:59) [opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:908) [opensearch-2.10.0.jar:2.10.0]",
"at org.opensearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:52) [opensearch-2.10.0.jar:2.10.0]",
"at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) [?:?]",
"at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) [?:?]",
"at java.lang.Thread.run(Thread.java:833) [?:?]"] }

    {"type": "server", "timestamp": "2023-10-16T14:26:30,760Z", "level": "ERROR", "component": "o.o.s.c.ConfigurationLoaderSecurity7", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Failure no such index [.opendistro_security] retrieving configuration for [INTERNALUSERS, ACTIONGROUPS, CONFIG, ROLES, ROLESMAPPING, TENANTS, NODESDN, WHITELIST, ALLOWLIST, AUDIT] (index=.opendistro_security)", "cluster.uuid": "tWpt9CrlQCWXY8VxBeIHEw", "node.id": "uBxoNDM7RXaSPSH5SrzeHg"  }

    {"type": "server", "timestamp": "2023-10-16T14:30:50,010Z", "level": "WARN", "component": "o.o.o.i.ObservabilityIndex", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "message: index [.opensearch-observability/fJoQwA-LR7WU2n7wOnKLVg] already exists", "cluster.uuid": "tWpt9CrlQCWXY8VxBeIHEw", "node.id": "uBxoNDM7RXaSPSH5SrzeHg"  }

    root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cat/shards
.plugins-ml-config               0 p STARTED  1  3.9kb 10.0.2.15 node-1
.opensearch-observability        0 p STARTED  0   208b 10.0.2.15 node-1
.opensearch-sap-log-types-config 0 p STARTED           10.0.2.15 node-1
.opendistro_security             0 p STARTED 10 65.1kb 10.0.2.15 node-1

{"type": "server", "timestamp": "2023-10-16T14:26:28,641Z", "level": "WARN", "component": "o.o.s.p.SQLPlugin", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information" }

@rauldpm
Copy link
Member Author

rauldpm commented Oct 16, 2023 •
edited
Loading

Analysis report about the new warning related to Master key configuration

{"type": "server", "timestamp": "2023-10-16T14:26:28,641Z", "level": "WARN", "component": "o.o.s.p.SQLPlugin", "cluster.name": "wazuh-cluster", "node.name": "node-1", "message": "Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information" }
  • The warning appears each time the service is started or restarted
  • Setting the following line in the opensearch.yml file stops generating the warning message
plugins.query.datasources.encryption.masterkey: "yVlJzM8ywQ29fcpZjnGIglQO"

root@ubuntu20stack:/var/log# grep "plugins.query.datasources.encryption.masterkey" /etc/opensearch/opensearch.yml 
root@ubuntu20stack:/var/log# grep "query.datasources.encryption.masterkey" /etc/opensearch/opensearch.yml 
root@ubuntu20stack:/var/log# grep "masterkey" /etc/opensearch/opensearch.yml 
root@ubuntu20stack:/var/log# grep "masterkey" /etc/opensearch/opensearch.yml | wc -l
0
  • The 2.10.0 OpenSearch installation shows the same warning when the service is started, as this configuration is not provided by default, we should contemplate not including it by default in our package 
root@ubuntu20stack:/home/vagrant# grep "Master key" /var/log/opensearch/opensearch_server.json 
{"type": "server", "timestamp": "2023-10-16T17:11:43,617Z", "level": "WARN", "component": "o.o.s.p.SQLPlugin", "cluster.name": "opensearch", "node.name": "ubuntu20stack", "message": "Master key is a required config for using create and update datasource APIs. Please set plugins.query.datasources.encryption.masterkey config in opensearch.yml in all the cluster nodes. More details can be found here: https://github.com/opensearch-project/sql/blob/main/docs/user/ppl/admin/datasources.rst#master-key-config-for-encrypting-credential-information" }

@rauldpm
Copy link
Member Author

rauldpm commented Oct 16, 2023 •
edited
Loading

Analysis report - Upgrade RPM and DEB from 4.5.3

RPM 🟢
  • 4.5.3 - Install 4.5.3 
    [root@centos7 vagrant]# yum -y install wazuh-indexer -y
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: centos.mirror.ptisp.pt
* extras: centos.mirror.ptisp.pt
* updates: mirror.librelabucm.org
wazuh                                                                  | 3.4 kB  00:00:00     
wazuh/primary_db                                                       | 380 kB  00:00:00     
Resolving Dependencies
--> Running transaction check
---> Package wazuh-indexer.x86_64 0:4.5.3-1 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

==============================================================================================
Package                    Arch                Version              Repository          Size
==============================================================================================
Installing:
wazuh-indexer              x86_64              4.5.3-1              wazuh              675 M

Transaction Summary
==============================================================================================
Install  1 Package

Total download size: 675 M
Installed size: 931 M
Downloading packages:
wazuh-indexer-4.5.3-1.x86_64.rpm                                       | 675 MB  00:00:08     
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : wazuh-indexer-4.5.3-1.x86_64                                               1/1 
Created opensearch keystore in /etc/wazuh-indexer/opensearch.keystore
Verifying  : wazuh-indexer-4.5.3-1.x86_64                                               1/1 

Installed:
wazuh-indexer.x86_64 0:4.5.3-1                                                              

Complete!
  • 4.5.3 - Configure certificates 
    [root@centos7 vagrant]# NODE_NAME=indexer-1
[root@centos7 vagrant]# mkdir /etc/wazuh-indexer/certs
[root@centos7 vagrant]# tar -xf ./wazuh-certificates.tar -C /etc/wazuh-indexer/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
[root@centos7 vagrant]# mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
[root@centos7 vagrant]# mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
[root@centos7 vagrant]# chmod 500 /etc/wazuh-indexer/certs
[root@centos7 vagrant]# chmod 400 /etc/wazuh-indexer/certs/*
[root@centos7 vagrant]# chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs
  • 4.5.3 - Start service 
    [root@centos7 vagrant]# systemctl daemon-reload
[root@centos7 vagrant]# systemctl enable wazuh-indexer
Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-indexer.service to /usr/lib/systemd/system/wazuh-indexer.service.
[root@centos7 vagrant]# systemctl start wazuh-indexer
[root@centos7 vagrant]# systemctl status wazuh-indexer
● wazuh-indexer.service - Wazuh-indexer
Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: disabled)
Active: active (running) since Mon 2023-10-16 17:54:49 UTC; 4s ago
    Docs: https://documentation.wazuh.com
Main PID: 3707 (java)
CGroup: /system.slice/wazuh-indexer.service
        └─3707 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkad...

Oct 16 17:54:42 centos7 systemd[1]: Starting Wazuh-indexer...
Oct 16 17:54:43 centos7 systemd-entrypoint[3707]: WARNING: A terminally deprecated method...ed
Oct 16 17:54:43 centos7 systemd-entrypoint[3707]: WARNING: System::setSecurityManager has...r)
Oct 16 17:54:43 centos7 systemd-entrypoint[3707]: WARNING: Please consider reporting this...ch
Oct 16 17:54:43 centos7 systemd-entrypoint[3707]: WARNING: System::setSecurityManager wil...se
Oct 16 17:54:44 centos7 systemd-entrypoint[3707]: WARNING: A terminally deprecated method...ed
Oct 16 17:54:44 centos7 systemd-entrypoint[3707]: WARNING: System::setSecurityManager has...r)
Oct 16 17:54:44 centos7 systemd-entrypoint[3707]: WARNING: Please consider reporting this...ty
Oct 16 17:54:44 centos7 systemd-entrypoint[3707]: WARNING: System::setSecurityManager wil...se
Oct 16 17:54:49 centos7 systemd[1]: Started Wazuh-indexer.
Hint: Some lines were ellipsized, use -l to show in full.
  • 4.5.3 - Start cluster 
    [root@centos7 vagrant]# /usr/share/wazuh-indexer/bin/indexer-security-init.sh
**************************************************************************
** This tool will be deprecated in the next major release of OpenSearch **
** https://github.com/opensearch-project/security/issues/1755           **
**************************************************************************
Security Admin v7
Will connect to 127.0.0.1:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.6.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
Populate config from /etc/wazuh-indexer/opensearch-security/
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml 
SUCC: Configuration for 'config' created or updated
Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml 
SUCC: Configuration for 'roles' created or updated
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml 
SUCC: Configuration for 'rolesmapping' created or updated
Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml 
SUCC: Configuration for 'internalusers' created or updated
Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml 
SUCC: Configuration for 'actiongroups' created or updated
Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml 
SUCC: Configuration for 'tenants' created or updated
Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml 
SUCC: Configuration for 'nodesdn' created or updated
Will update '/whitelist' with /etc/wazuh-indexer/opensearch-security/whitelist.yml 
SUCC: Configuration for 'whitelist' created or updated
Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml 
SUCC: Configuration for 'audit' created or updated
Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml 
SUCC: Configuration for 'allowlist' created or updated
SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"]) due to: null
Done with success
  • 4.5.3 - Check cluster status 
    [root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200
{
"name" : "node-1",
"cluster_name" : "wazuh-cluster",
"cluster_uuid" : "6Z0SpBhdRpqkw8yIyFT30Q",
"version" : {
    "number" : "7.10.2",
    "build_type" : "rpm",
    "build_hash" : "7203a5af21a8a009aece1474446b437a3c674db6",
    "build_date" : "2023-02-24T18:57:04.388618985Z",
    "build_snapshot" : false,
    "lucene_version" : "9.5.0",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
},
"tagline" : "The OpenSearch Project: https://opensearch.org/"
}

    [root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cat/nodes?v
ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
10.0.2.15           33          94   3    0.06    0.12     0.07 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1

    [root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cat/shards
.opendistro_security      0 p STARTED 10 64.2kb 10.0.2.15 node-1
.opensearch-observability 0 p STARTED  0   208b 10.0.2.15 node-1

    [root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cluster/health?pretty
{
"cluster_name" : "wazuh-cluster",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"discovered_master" : true,
"discovered_cluster_manager" : true,
"active_primary_shards" : 2,
"active_shards" : 2,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
  • 4.5.3 - Stop shard allocation and services 
    [root@centos7 vagrant]# curl -X PUT "https://192.168.56.4:9200/_cluster/settings"  -u admin:admin -k -H 'Content-Type: application/json' -d'
> {
>   "persistent": {
>     "cluster.routing.allocation.enable": "primaries"
>   }
> }
> '
{"acknowledged":true,"persistent":{"cluster":{"routing":{"allocation":{"enable":"primaries"}}}},"transient":{}}

    [root@centos7 vagrant]# curl -X POST "https://192.168.56.4:9200/_flush/synced" -u admin:admin -k
{"_shards":{"total":2,"successful":2,"failed":0}}

    [root@centos7 vagrant]# systemctl stop wazuh-indexer
[root@centos7 vagrant]# systemctl status wazuh-indexer
● wazuh-indexer.service - Wazuh-indexer
Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: disabled)
Active: inactive (dead) since Mon 2023-10-16 18:00:57 UTC; 1min 4s ago
    Docs: https://documentation.wazuh.com
Process: 3707 ExecStart=/usr/share/wazuh-indexer/bin/systemd-entrypoint -p ${PID_DIR}/wazuh-indexer.pid --quiet (code=exited, status=143)
Main PID: 3707 (code=exited, status=143)

Oct 16 17:54:43 centos7 systemd-entrypoint[3707]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.6.0.jar)
Oct 16 17:54:43 centos7 systemd-entrypoint[3707]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Oct 16 17:54:43 centos7 systemd-entrypoint[3707]: WARNING: System::setSecurityManager will be removed in a future release
Oct 16 17:54:44 centos7 systemd-entrypoint[3707]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 16 17:54:44 centos7 systemd-entrypoint[3707]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.6.0.jar)
Oct 16 17:54:44 centos7 systemd-entrypoint[3707]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Oct 16 17:54:44 centos7 systemd-entrypoint[3707]: WARNING: System::setSecurityManager will be removed in a future release
Oct 16 17:54:49 centos7 systemd[1]: Started Wazuh-indexer.
Oct 16 18:00:56 centos7 systemd[1]: Stopping Wazuh-indexer...
Oct 16 18:00:57 centos7 systemd[1]: Stopped Wazuh-indexer.
  • 4.8.0 - Upgrade 
    [root@centos7 vagrant]# yum upgrade wazuh-indexer-4.8.0-wp2520.x86_64.rpm 
Loaded plugins: fastestmirror
Examining wazuh-indexer-4.8.0-wp2520.x86_64.rpm: wazuh-indexer-4.8.0-wp2520.x86_64
Marking wazuh-indexer-4.8.0-wp2520.x86_64.rpm as an update to wazuh-indexer-4.5.3-1.x86_64
Resolving Dependencies
--> Running transaction check
---> Package wazuh-indexer.x86_64 0:4.5.3-1 will be updated
---> Package wazuh-indexer.x86_64 0:4.8.0-wp2520 will be an update
--> Finished Dependency Resolution

Dependencies Resolved

==============================================================================================
Package           Arch       Version            Repository                              Size
==============================================================================================
Updating:
wazuh-indexer     x86_64     4.8.0-wp2520       /wazuh-indexer-4.8.0-wp2520.x86_64     1.0 G

Transaction Summary
==============================================================================================
Upgrade  1 Package

Total size: 1.0 G
Is this ok [y/d/N]: y
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Updating   : wazuh-indexer-4.8.0-wp2520.x86_64                                          1/2 
Cleanup    : wazuh-indexer-4.5.3-1.x86_64                                               2/2 
Verifying  : wazuh-indexer-4.8.0-wp2520.x86_64                                          1/2 
Verifying  : wazuh-indexer-4.5.3-1.x86_64                                               2/2 

Updated:
wazuh-indexer.x86_64 0:4.8.0-wp2520                                                         

Complete!
  • 4.8.0 - Start service 
    [root@centos7 vagrant]# systemctl daemon-reload
[root@centos7 vagrant]# systemctl enable wazuh-indexer
[root@centos7 vagrant]# systemctl start wazuh-indexer
[root@centos7 vagrant]# systemctl status wazuh-indexer
● wazuh-indexer.service - Wazuh-indexer
Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: disabled)
Active: active (running) since Mon 2023-10-16 18:05:06 UTC; 38s ago
    Docs: https://documentation.wazuh.com
Main PID: 4317 (java)
CGroup: /system.slice/wazuh-indexer.service
        └─4317 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkad...

Oct 16 18:04:59 centos7 systemd[1]: Starting Wazuh-indexer...
Oct 16 18:05:00 centos7 systemd-entrypoint[4317]: WARNING: A terminally deprecated method...ed
Oct 16 18:05:00 centos7 systemd-entrypoint[4317]: WARNING: System::setSecurityManager has...r)
Oct 16 18:05:00 centos7 systemd-entrypoint[4317]: WARNING: Please consider reporting this...ch
Oct 16 18:05:00 centos7 systemd-entrypoint[4317]: WARNING: System::setSecurityManager wil...se
Oct 16 18:05:01 centos7 systemd-entrypoint[4317]: WARNING: A terminally deprecated method...ed
Oct 16 18:05:01 centos7 systemd-entrypoint[4317]: WARNING: System::setSecurityManager has...r)
Oct 16 18:05:01 centos7 systemd-entrypoint[4317]: WARNING: Please consider reporting this...ty
Oct 16 18:05:01 centos7 systemd-entrypoint[4317]: WARNING: System::setSecurityManager wil...se
Oct 16 18:05:06 centos7 systemd[1]: Started Wazuh-indexer.
Hint: Some lines were ellipsized, use -l to show in full.
  • 4.8.0 - Enable shard allocation 
    [root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cat/nodes?v
ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
10.0.2.15           26          97   3    0.15    0.13     0.08 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1

    [root@centos7 vagrant]# curl -X PUT "https://192.168.56.4:9200/_cluster/settings" -u admin:admin -k -H 'Content-Type: application/json' -d'
> {
>   "persistent": {
>     "cluster.routing.allocation.enable": "all"
>   }
> }
> '
{"acknowledged":true,"persistent":{"cluster":{"routing":{"allocation":{"enable":"all"}}}},"transient":{}}
  • 4.8.0 - Check cluster status 
    [root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200
{
"name" : "node-1",
"cluster_name" : "wazuh-cluster",
"cluster_uuid" : "6Z0SpBhdRpqkw8yIyFT30Q",
"version" : {
    "number" : "7.10.2",
    "build_type" : "rpm",
    "build_hash" : "eee49cb340edc6c4d489bcd9324dda571fc8dc03",
    "build_date" : "2023-09-20T23:54:29.889267151Z",
    "build_snapshot" : false,
    "lucene_version" : "9.7.0",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
},
"tagline" : "The OpenSearch Project: https://opensearch.org/"
}

    [root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cat/nodes?v
ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
10.0.2.15           29          97   0    0.02    0.09     0.07 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1

    [root@centos7 vagrant]#  curl -k -u admin:admin https://192.168.56.4:9200/_cat/shards
.opensearch-observability        0 p STARTED  0   208b 10.0.2.15 node-1
.plugins-ml-config               0 p STARTED  1  3.8kb 10.0.2.15 node-1
.opensearch-sap-log-types-config 0 p STARTED           10.0.2.15 node-1
.opendistro_security             0 p STARTED 10 65.1kb 10.0.2.15 node-1

    [root@centos7 vagrant]# curl -k -u admin:admin https://192.168.56.4:9200/_cluster/health?pretty
{
"cluster_name" : "wazuh-cluster",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"discovered_master" : true,
"discovered_cluster_manager" : true,
"active_primary_shards" : 4,
"active_shards" : 4,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
DEB 🟢
  • 4.5.3 - Install 4.5.3 
    root@ubuntu20stack:/var/log# apt install wazuh-indexer
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following NEW packages will be installed:
  wazuh-indexer
0 upgraded, 1 newly installed, 0 to remove and 121 not upgraded.
Need to get 0 B/685 MB of archives.
After this operation, 971 MB of additional disk space will be used.
Selecting previously unselected package wazuh-indexer.
(Reading database ... 111886 files and directories currently installed.)
Preparing to unpack .../wazuh-indexer_4.5.3-1_amd64.deb ...
Creating wazuh-indexer group... OK
Creating wazuh-indexer user... OK
Unpacking wazuh-indexer (4.5.3-1) ...
Setting up wazuh-indexer (4.5.3-1) ...
Created opensearch keystore in /etc/wazuh-indexer/opensearch.keystore
Processing triggers for systemd (245.4-4ubuntu3.20) ...
Processing triggers for libc-bin (2.31-0ubuntu9.9) ...
  • 4.5.3 - Configure certificates 
    root@ubuntu20stack:/home/vagrant# NODE_NAME=indexer-1
root@ubuntu20stack:/home/vagrant# mkdir /etc/wazuh-indexer/certs
root@ubuntu20stack:/home/vagrant# tar -xf ./wazuh-certificates.tar -C /etc/wazuh-indexer/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
root@ubuntu20stack:/home/vagrant# mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
root@ubuntu20stack:/home/vagrant# mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
root@ubuntu20stack:/home/vagrant# chmod 500 /etc/wazuh-indexer/certs
root@ubuntu20stack:/home/vagrant# chmod 400 /etc/wazuh-indexer/certs/*
root@ubuntu20stack:/home/vagrant# chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs
  • 4.5.3 - Start service 
    root@ubuntu20stack:/home/vagrant# systemctl daemon-reload
root@ubuntu20stack:/home/vagrant# systemctl enable wazuh-indexer
Synchronizing state of wazuh-indexer.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable wazuh-indexer
Created symlink /etc/systemd/system/multi-user.target.wants/wazuh-indexer.service → /lib/systemd/system/wazuh-indexer.service.
root@ubuntu20stack:/home/vagrant# systemctl start wazuh-indexer
root@ubuntu20stack:/home/vagrant# systemctl status wazuh-indexer
● wazuh-indexer.service - Wazuh-indexer
    Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
    Active: active (running) since Mon 2023-10-16 17:54:50 UTC; 9s ago
    Docs: https://documentation.wazuh.com
Main PID: 3705 (java)
    Tasks: 66 (limit: 9325)
    Memory: 1.2G
    CGroup: /system.slice/wazuh-indexer.service
            └─3705 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 ->

Oct 16 17:54:44 ubuntu20stack systemd[1]: Starting Wazuh-indexer...
Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: A terminally deprecated method in java.lang.Syst>
Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: System::setSecurityManager has been called by or>
Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: Please consider reporting this to the maintainer>
Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: System::setSecurityManager will be removed in a >
Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: A terminally deprecated method in java.lang.Syst>
Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: System::setSecurityManager has been called by or>
Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: Please consider reporting this to the maintainer>
Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: System::setSecurityManager will be removed in a >
Oct 16 17:54:50 ubuntu20stack systemd[1]: Started Wazuh-indexer.
  • 4.5.3 - Start cluster 
    root@ubuntu20stack:/home/vagrant# /usr/share/wazuh-indexer/bin/indexer-security-init.sh
**************************************************************************
** This tool will be deprecated in the next major release of OpenSearch **
** https://github.com/opensearch-project/security/issues/1755           **
**************************************************************************
Security Admin v7
Will connect to 127.0.0.1:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.6.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
Populate config from /etc/wazuh-indexer/opensearch-security/
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml 
SUCC: Configuration for 'config' created or updated
Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml 
SUCC: Configuration for 'roles' created or updated
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml 
SUCC: Configuration for 'rolesmapping' created or updated
Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml 
SUCC: Configuration for 'internalusers' created or updated
Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml 
SUCC: Configuration for 'actiongroups' created or updated
Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml 
SUCC: Configuration for 'tenants' created or updated
Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml 
SUCC: Configuration for 'nodesdn' created or updated
Will update '/whitelist' with /etc/wazuh-indexer/opensearch-security/whitelist.yml 
SUCC: Configuration for 'whitelist' created or updated
Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml 
SUCC: Configuration for 'audit' created or updated
Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml 
SUCC: Configuration for 'allowlist' created or updated
SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"]) due to: null
Done with success
  • 4.5.3 - Check cluster status 
    root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200
{
"name" : "node-1",
"cluster_name" : "wazuh-cluster",
"cluster_uuid" : "cpjW8LaMRNiwhNiSGTbLkg",
"version" : {
    "number" : "7.10.2",
    "build_type" : "rpm",
    "build_hash" : "7203a5af21a8a009aece1474446b437a3c674db6",
    "build_date" : "2023-02-24T18:57:04.388618985Z",
    "build_snapshot" : false,
    "lucene_version" : "9.5.0",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
},
"tagline" : "The OpenSearch Project: https://opensearch.org/"
}

    root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cat/nodes?v
ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
10.0.2.15           34          67   2    0.37    0.39     0.22 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1

    root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cat/shards
.opendistro_security      0 p STARTED 10 64.2kb 10.0.2.15 node-1
.opensearch-observability 0 p STARTED  0   208b 10.0.2.15 node-1

    root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cluster/health?pretty
{
"cluster_name" : "wazuh-cluster",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"discovered_master" : true,
"discovered_cluster_manager" : true,
"active_primary_shards" : 2,
"active_shards" : 2,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
  • 4.5.3 - Stop shard allocation and services 
    root@ubuntu20stack:/home/vagrant# curl -X PUT "https://192.168.56.33:9200/_cluster/settings"  -u admin:admin -k -H 'Content-Type: application/json' -d'
> {
>   "persistent": {
>     "cluster.routing.allocation.enable": "primaries"
>   }
> }
> '
{"acknowledged":true,"persistent":{"cluster":{"routing":{"allocation":{"enable":"primaries"}}}},"transient":{}}

    root@ubuntu20stack:/home/vagrant# curl -X POST "https://192.168.56.33:9200/_flush/synced" -u admin:admin -k
{"_shards":{"total":2,"successful":2,"failed":0}}

    root@ubuntu20stack:/home/vagrant# systemctl stop wazuh-indexer
root@ubuntu20stack:/home/vagrant# systemctl status wazuh-indexer
● wazuh-indexer.service - Wazuh-indexer
    Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
    Active: inactive (dead) since Mon 2023-10-16 18:00:57 UTC; 33s ago
    Docs: https://documentation.wazuh.com
    Process: 3705 ExecStart=/usr/share/wazuh-indexer/bin/systemd-entrypoint -p ${PID_DIR}/wazuh-indexer.pid --quiet (code=exited, status=143)
Main PID: 3705 (code=exited, status=143)

Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: System::setSecurityManager will be removed in a future release
Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: A terminally deprecated method in java.lang.System has been called
Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.6.0.jar)
Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Oct 16 17:54:45 ubuntu20stack systemd-entrypoint[3705]: WARNING: System::setSecurityManager will be removed in a future release
Oct 16 17:54:50 ubuntu20stack systemd[1]: Started Wazuh-indexer.
Oct 16 18:00:57 ubuntu20stack systemd[1]: Stopping Wazuh-indexer...
Oct 16 18:00:57 ubuntu20stack systemd[1]: wazuh-indexer.service: Succeeded.
Oct 16 18:00:57 ubuntu20stack systemd[1]: Stopped Wazuh-indexer.
  • 4.8.0 - Upgrade 
    root@ubuntu20stack:/home/vagrant# apt-get install ./wazuh-indexer_4.8.0-wp2520_amd64.deb 
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Note, selecting 'wazuh-indexer' instead of './wazuh-indexer_4.8.0-wp2520_amd64.deb'
The following packages will be upgraded:
wazuh-indexer
1 upgraded, 0 newly installed, 0 to remove and 121 not upgraded.
Need to get 0 B/754 MB of archives.
After this operation, 78.8 MB of additional disk space will be used.
Get:1 /home/vagrant/wazuh-indexer_4.8.0-wp2520_amd64.deb wazuh-indexer amd64 4.8.0-wp2520 [754 MB]
(Reading database ... 113009 files and directories currently installed.)
Preparing to unpack .../wazuh-indexer_4.8.0-wp2520_amd64.deb ...
Unpacking wazuh-indexer (4.8.0-wp2520) over (4.5.3-1) ...
Setting up wazuh-indexer (4.8.0-wp2520) ...
Installing new version of config file /etc/wazuh-indexer/opensearch-notifications-core/notifications-core.yml ...
Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/log4j2.xml ...
Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy ...
Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/rca.conf ...
Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/rca_cluster_manager.conf ...
Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/rca_idle_cluster_manager.conf ...
Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/supervisord.conf ...
Installing new version of config file /etc/wazuh-indexer/opensearch-security/config.yml ...
Processing triggers for systemd (245.4-4ubuntu3.20) ...
Processing triggers for libc-bin (2.31-0ubuntu9.9) ...
  • 4.8.0 - Start service 
    root@ubuntu20stack:/home/vagrant# systemctl daemon-reload
root@ubuntu20stack:/home/vagrant# systemctl enable wazuh-indexer
root@ubuntu20stack:/home/vagrant# systemctl start wazuh-indexer
root@ubuntu20stack:/home/vagrant# systemctl status wazuh-indexer
● wazuh-indexer.service - Wazuh-indexer
    Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
    Active: active (running) since Mon 2023-10-16 18:05:08 UTC; 28s ago
    Docs: https://documentation.wazuh.com
Main PID: 4594 (java)
    Tasks: 79 (limit: 9325)
    Memory: 1.3G
    CGroup: /system.slice/wazuh-indexer.service
            └─4594 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 ->

Oct 16 18:05:02 ubuntu20stack systemd[1]: Starting Wazuh-indexer...
Oct 16 18:05:03 ubuntu20stack systemd-entrypoint[4594]: WARNING: A terminally deprecated method in java.lang.Syst>
Oct 16 18:05:03 ubuntu20stack systemd-entrypoint[4594]: WARNING: System::setSecurityManager has been called by or>
Oct 16 18:05:03 ubuntu20stack systemd-entrypoint[4594]: WARNING: Please consider reporting this to the maintainer>
Oct 16 18:05:03 ubuntu20stack systemd-entrypoint[4594]: WARNING: System::setSecurityManager will be removed in a >
Oct 16 18:05:03 ubuntu20stack systemd-entrypoint[4594]: WARNING: A terminally deprecated method in java.lang.Syst>
Oct 16 18:05:03 ubuntu20stack systemd-entrypoint[4594]: WARNING: System::setSecurityManager has been called by or>
Oct 16 18:05:03 ubuntu20stack systemd-entrypoint[4594]: WARNING: Please consider reporting this to the maintainer>
Oct 16 18:05:03 ubuntu20stack systemd-entrypoint[4594]: WARNING: System::setSecurityManager will be removed in a >
Oct 16 18:05:08 ubuntu20stack systemd[1]: Started Wazuh-indexer.
  • 4.8.0 - Enable shard allocation 
    root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cat/nodes?v
ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
10.0.2.15           40          68   4    0.32    0.23     0.19 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1

    root@ubuntu20stack:/home/vagrant# curl -X PUT "https://192.168.56.33:9200/_cluster/settings" -u admin:admin -k -H 'Content-Type: application/json' -d'
> {
>   "persistent": {
>     "cluster.routing.allocation.enable": "all"
>   }
> }
> '
{"acknowledged":true,"persistent":{"cluster":{"routing":{"allocation":{"enable":"all"}}}},"transient":{}}
  • 4.8.0 - Check cluster status 
    root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200
{
"name" : "node-1",
"cluster_name" : "wazuh-cluster",
"cluster_uuid" : "cpjW8LaMRNiwhNiSGTbLkg",
"version" : {
    "number" : "7.10.2",
    "build_type" : "rpm",
    "build_hash" : "eee49cb340edc6c4d489bcd9324dda571fc8dc03",
    "build_date" : "2023-09-20T23:54:29.889267151Z",
    "build_snapshot" : false,
    "lucene_version" : "9.7.0",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
},
"tagline" : "The OpenSearch Project: https://opensearch.org/"
}

    root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cat/nodes?v
ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role node.roles                                        cluster_manager name
10.0.2.15           23          68   0    0.14    0.17     0.17 dimr      cluster_manager,data,ingest,remote_cluster_client *               node-1

    root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cat/shards
.opensearch-observability        0 p STARTED  0  208b 10.0.2.15 node-1
.plugins-ml-config               0 p STARTED  1 3.8kb 10.0.2.15 node-1
.opensearch-sap-log-types-config 0 p STARTED          10.0.2.15 node-1
.opendistro_security             0 p STARTED 10  65kb 10.0.2.15 node-1

    root@ubuntu20stack:/home/vagrant# curl -k -u admin:admin https://192.168.56.33:9200/_cluster/health?pretty
{
"cluster_name" : "wazuh-cluster",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"discovered_master" : true,
"discovered_cluster_manager" : true,
"active_primary_shards" : 4,
"active_shards" : 4,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}

The DEB package shows the following message about file changes:

    Installing new version of config file /etc/wazuh-indexer/opensearch-notifications-core/notifications-core.yml ...
    Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/log4j2.xml ...
    Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/opensearch_security.policy ...
    Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/rca.conf ...
    Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/rca_cluster_manager.conf ...
    Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/rca_idle_cluster_manager.conf ...
    Installing new version of config file /etc/wazuh-indexer/opensearch-performance-analyzer/supervisord.conf ...
    Installing new version of config file /etc/wazuh-indexer/opensearch-security/config.yml ...
Changes
  • opensearch-notifications-core/notifications-core.yml 
    4.5.3: size_limit: 10000
4.8.0: size_limit: 10000000

    4.5.3: minimum_header_length: 100
4.8.0: minimum_header_length: 160

    4.5.3: allowed_config_types: ["slack","chime","webhook","email","sns","ses_account","smtp_account","email_group"]
4.8.0: allowed_config_types: ["slack","chime","microsoft_teams","webhook","email","sns","ses_account","smtp_account","email_group"]
    • Conclusion
      • OpenSearch internal change, we do not control it
  • opensearch-performance-analyzer/log4j2.xml 
    4.5.3: <RollingFile name="PerformanceAnalyzerLog" fileName="/tmp/PerformanceAnalyzer.log" filePattern="/tmp/PerformanceAnalyzer.log.%d{yyyy-MM-dd}-%i.gz" immediateFlush="true" append="true">
4.8.0: <RollingFile name="PerformanceAnalyzerLog" fileName="${sys:opensearch.path.home:-/tmp}/logs/PerformanceAnalyzer.log" filePattern="${sys:opensearch.path.home:-/tmp}/logs/PerformanceAnalyzer.log.%d{yyyy-MM-dd}-%i.gz" immediateFlush="true" append="true">

    4.5.3: <Delete basePath="/tmp">
4.8.0: Delete basePath="${sys:opensearch.path.home:-/tmp}/logs">

    4.5.3: <RollingFile name="StatsLog" fileName="/tmp/performance_analyzer_agent_stats.log" filePattern="/tmp/performance_analyzer_agent_stats.log.%d{yyyy-MM-dd}-%i.gz" immediateFlush="true" append="true">
4.8.0: <RollingFile name="StatsLog" fileName="${sys:opensearch.path.home:-/tmp}/logs/performance_analyzer_agent_stats.log" filePattern="${sys:opensearch.path.home:-/tmp}/logs/performance_analyzer_agent_stats.log.%d{yyyy-MM-dd}-%i.gz" immediateFlush="true" append="true">

    4.5.3: <Delete basePath="/tmp">
4.8.0: <Delete basePath="${sys:opensearch.path.home:-/tmp}/logs/">
    • Conclusion
      • OpenSearch internal change, we do not control it
  • opensearch-performance-analyzer/opensearch_security.policy 
    4.5.3: Not present
4.8.0: permission java.lang.RuntimePermission "getClassLoader";
    • Conclusion
      • New addition
      • OpenSearch internal change, we do not control it
  • opensearch-performance-analyzer/rca.conf 
    4.5.3: "hot-shard-rca": {
4.5.3:   "cpu-utilization" : 0.01,
4.5.3:   "io-total-throughput-in-bytes" : 250000.0,
4.5.3:   "io-total-syscallrate-per-second" : 0.1
4.5.3: },

4.8.0: "hot-shard-rca": {
4.8.0:   "cpu-utilization" : 0.015,
4.8.0:   "top-k-consumers" : 50
4.8.0: },

    4.5.3: "muted-rcas": [
4.5.3:     "HotShardRca",
4.5.3:     "HotShardClusterRca"
4.5.3: ],

4.8.0:  "muted-rcas": [
4.8.0: ],
    • Conclusion
      • OpenSearch internal change, we do not control it
  • opensearch-performance-analyzer/rca_cluster_manager.conf 
    4.5.3: "hot-shard-rca": {
4.5.3:   "cpu-utilization" : 0.01,
4.5.3:   "io-total-throughput-in-bytes" : 250000.0,
4.5.3:   "io-total-syscallrate-per-second" : 0.1
4.5.3: },

4.8.0: "hot-shard-rca": {
4.8.0:   "cpu-utilization" : 0.015,
4.8.0:   "top-k-consumers" : 50
4.8.0: },

    4.5.3: "hot-shard-cluster-rca": {
4.5.3:   "cpu-utilization-cluster-percentage" : 0.3,
4.5.3:   "io-total-throughput-cluster-percentage" : 0.3,
4.5.3:   "io-total-syscallrate-cluster-percentage" : 0.3
4.5.3: },

4.8.0: "hot-shard-cluster-rca": {
4.8.0:   "cpu-utilization-cluster-percentage" : 0.3
4.8.0: },

    4.5.3: "muted-rcas": [
4.5.3:     "HotShardRca",
4.5.3:     "HotShardClusterRca"
4.5.3: ],

4.8.0: "muted-rcas": [
4.8.0: ],
    • Conclusion
      • OpenSearch internal change, we do not control it
  • opensearch-performance-analyzer/rca_idle_cluster_manager.conf 
    4.5.3: "hot-shard-rca": {
4.5.3:   "cpu-utilization" : 0.01,
4.5.3:   "io-total-throughput-in-bytes" : 250000.0,
4.5.3:   "io-total-syscallrate-per-second" : 0.1
4.5.3: },

4.8.0: "hot-shard-rca": {
4.8.0:   "cpu-utilization" : 0.015,
4.8.0:   "top-k-consumers" : 50
4.8.0: },

    4.5.3: "hot-shard-cluster-rca": {
4.5.3:   "cpu-utilization-cluster-percentage" : 0.3,
4.5.3:   "io-total-throughput-cluster-percentage" : 0.3,
4.5.3:   "io-total-syscallrate-cluster-percentage" : 0.3
4.5.3: },

4.8.0: "hot-shard-cluster-rca": {
4.8.0:   "cpu-utilization-cluster-percentage" : 0.3
4.8.0: },

    4.5.3: "muted-rcas": [
4.5.3:     "HotShardRca",
4.5.3:     "HotShardClusterRca"
4.5.3: ],

4.8.0: "muted-rcas": [
4.8.0: ],
    • Conclusion
      • OpenSearch internal change, we do not control it
  • opensearch-performance-analyzer/supervisord.conf 
    4.5.3: childlogdir=/usr/share/supervisor/performance_analyzer            ; ('AUTO' child log dir, default $TEMP)

4.8.0: childlogdir=/usr/share/supervisor/performance_analyzer             ; ('AUTO' child log dir, default $TEMP)

    4.5.3: ; include files themselves.
4.5.3: 
4.5.3: [include]

4.8.0: ; include files themselves.
4.8.0: [include]

    4.5.3: Not present 

4.8.0: autostart=true                                                      ; start at supervisord start (default: true)
4.8.0: autorestart=unexpected                                              ; autorestart if exited after running (def: unexpected)
4.8.0: exitcodes=1                                                         ; 'expected' exit codes used with autorestart, System.exit(1) called from PerformanceAnalyzerApp.cleanupAndExit() - if Reader Thread crashes.
4.8.0:  
4.8.0: [eventlistener:stop_supervisord]
4.8.0: command=bash -c "printf 'READY\n' && while read line; do kill -SIGQUIT $PPID; done < /dev/stdin"
4.8.0: events=PROCESS_STATE_FATAL
4.8.0: buffer_size=100
    • Conclusion
      • OpenSearch internal change, we do not control it
  • opensearch-security/config.yml 
    4.5.3: ; supervisor config file
4.5.3: 
4.5.3: [unix_http_server]
4.5.3: file=/usr/share/supervisor/performance_analyzer/supervisord.sock
4.5.3: chmod=0770
4.5.3: 
4.5.3: [supervisord]
4.5.3: logfile=/usr/share/supervisor/performance_analyzer/supervisord.log ; (main log file;default $CWD/supervisord.log)
4.5.3: pidfile=/usr/share/supervisor/performance_analyzer/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
4.5.3: childlogdir=/usr/share/supervisor/performance_analyzer            ; ('AUTO' child log dir, default $TEMP)
4.5.3: 
4.5.3: ; the below section must remain in the config file for RPC
4.5.3: ; (supervisorctl/web interface) to work, additional interfaces may be
4.5.3: ; added by defining them in separate rpcinterface: sections
4.5.3: [rpcinterface:supervisor]
4.5.3: supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
4.5.3: 
4.5.3: [supervisorctl]
4.5.3: serverurl=/usr/share/supervisord.sock
4.5.3: 
4.5.3: ; The [include] section can just contain the "files" setting.  This
4.5.3: ; setting can list multiple files (separated by whitespace or
4.5.3: ; newlines).  It can also contain wildcards.  The filenames are
4.5.3: ; interpreted as relative to this file.  Included files *cannot*a---

4.8.0: ---

    4.5.3: Not present

4.8.0: #private_tenant_enabled: true
4.8.0: #default_tenant: ""

    4.5.3: Not present

4.8.0: jwt_clock_skew_tolerance_seconds: 30

    4.5.3: ; include files themselves.
4.5.3: 
4.5.3: [include]
4.5.3: files = /etc/supervisor/conf.d/*.conf
4.5.3: 
4.5.3: [program:performance_analyzer]
4.5.3: command=/usr/share/opensearch/performance-analyzer-rca/bin/performance-analyzer-agent /usr/share/opensearch
4.5.3: user=1000

4.8.0: Not present
    • Conclusion
      • OpenSearch internal change, we do not control it

Conclusion

  • OpenSearch internal changes, we do not control it

@rauldpm
Copy link
Member Author

rauldpm commented Oct 16, 2023

It is necessary to finish the Wazuh dashboard bump to continue with the remaining tasks

@wazuhci wazuhci moved this from In progress to Blocked in Release 4.8.0 Oct 16, 2023
@rauldpm rauldpm mentioned this issue Oct 23, 2023
Closed
@rauldpm
Copy link
Member Author

rauldpm commented Oct 26, 2023 •
edited
Loading

Update report

@wazuhci wazuhci moved this from Blocked to In progress in Release 4.8.0 Oct 26, 2023
@rauldpm rauldpm mentioned this issue Oct 26, 2023
Merged
8 tasks
@rauldpm rauldpm linked a pull request Oct 26, 2023 that will close this issue
Bump Wazuh indexer to OpenSearch 2.10.0 #2562
Merged
8 tasks
@wazuhci wazuhci moved this from In progress to Pending review in Release 4.8.0 Oct 26, 2023
@rauldpm rauldpm mentioned this issue Oct 30, 2023
Closed
@wazuhci wazuhci moved this from Pending review to In review in Release 4.8.0 Oct 31, 2023
@wazuhci wazuhci moved this from In review to Pending final review in Release 4.8.0 Oct 31, 2023
@davidjiglesias
Copy link
Member

LGTM!

@wazuhci wazuhci moved this from Pending final review to Done in Release 4.8.0 Nov 2, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rauldpm rauldpm

Labels
level/task Subtask issue type/change Change requested type/enhancement Enhancement issue
Projects
No open projects
Release 4.8.0
Archived in project
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Bump Wazuh indexer to OpenSearch 2.10.0 wazuh/wazuh-packages
2 participants
@rauldpm @davidjiglesias