Development - Separate Agent/Manager - Installation Assistant - Test the Installation Assistant

[CarlosALgit]

Description

After completing the code development issues (#600 and #601), it's needed to test the Installation Assistant script.

Tasks

• Perform an AIO amd64 installation
• Perform an AIO arm64 installation
• Perform an Offline AIO amd64 installation
• Perform an Offline AIO arm64 installation
• Perform a distributed amd64 installation (using the assistant)
• Perform a distributed arm64 installation (using the assistant)

Tip

You can follow the same testing we do for the Installation Assistant test.

Depends on

• Availability of wazuh-manager package with paths and filenames changed accordingly.

[fcaffieri]

Environment_Online

Ubuntu 22 ARM

[root@ip-172-31-44-132 /home/ubuntu]# sudo cat /etc/os-release
PRETTY_NAME="Ubuntu 22.04.3 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.3 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy

[root@ip-172-31-44-132 /home/ubuntu]# sudo uname -a
Linux ip-172-31-44-132 6.2.0-1012-aws #12~22.04.1-Ubuntu SMP Thu Sep  7 16:00:15 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux

[root@ip-172-31-44-132 /home/ubuntu]# sudo uname -m
aarch64

Ubuntu 22 AMD

[root@ip-172-31-45-215 /home/ubuntu]# sudo cat /etc/os-release
PRETTY_NAME="Ubuntu 22.04.2 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.2 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy

[root@ip-172-31-45-215 /home/ubuntu]# sudo uname -a
Linux ip-172-31-45-215 5.19.0-1025-aws #26~22.04.1-Ubuntu SMP Mon Apr 24 01:58:15 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

[root@ip-172-31-45-215 /home/ubuntu]# sudo uname -m
x86_64

Download and generate pre-signed urls:

Generate pre-signed url:

$ bash ./generate_presigned_urls.sh 
Generating presigned URLs from artifact_urls.yml...
Output file: artifact_urls_presigned.yml
Expiration time: 280000 seconds
Region: us-west-1

Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-latest_amd64.deb
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-latest_arm64.deb
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-latest.x86_64.rpm
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-latest.aarch64.rpm
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-latest_amd64.deb
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-latest_arm64.deb
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-latest.x86_64.rpm
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-latest.aarch64.rpm
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-latest_amd64.deb
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-latest_arm64.deb
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-latest.x86_64.rpm
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-latest.aarch64.rpm
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-latest_amd64.deb
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-latest_arm64.deb
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-latest.x86_64.rpm
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-latest.aarch64.rpm
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-latest_ppc64el.deb
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-latest.ppc64le.rpm
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-latest.msi
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-latest.intel64.pkg
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-latest.arm64.pkg
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-latest_i386.deb
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-latest.i386.rpm
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-latest_armhf.deb
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-latest.armv7hl.rpm
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/secondary/ova/wazuh-5.0.0-latest.ova
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/secondary/puppet-module/wazuh-wazuh-5.0.0.tar.gz
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/secondary/installation-assistant/5.0.0/wazuh-certs-tool-5.0.0-latest.sh
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/secondary/installation-assistant/5.0.0/wazuh-passwords-tool-5.0.0-latest.sh
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/secondary/installation-assistant/5.0.0/wazuh-install-5.0.0-latest.sh
Processing: s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/secondary/installation-assistant/5.0.0/config-5.0.0-latest.yml

Done! Presigned URLs have been written to artifact_urls_presigned.yml

Copy artifacts to hosts:

$ mv artifact_urls_presigned.yml artifact_urls.yml
$ scp -i ~/.ssh/wia-603-20-02-2026-21-17 -P 2200 artifact_urls.yml ubuntu@ec2-54-91-117-45.compute-1.amazonaws.com:/home/ubuntu
artifact_urls.yml                                                                                                                                                      100%   13KB  82.6KB/s   00:00    
$ scp -i ~/.ssh/wia-603-20-02-2026-21-17 -P 2200 artifact_urls.yml ubuntu@ec2-54-162-94-84.compute-1.amazonaws.com:/home/ubuntu
artifact_urls.yml     

Install Logs Online

Ubuntu 22 ARM

Logs on the console:

root@ip-172-31-44-132:/home/ubuntu# ls -ltr
total 152
-r-x------ 1 ubuntu ubuntu 123946 Feb 23 13:48 wazuh-install.sh
-rw------- 1 ubuntu ubuntu   5211 Feb 23 13:57 artifact_urls.yml
drw------- 2 root   root     4096 Feb 23 13:58 wazuh-install-packages
-rw------- 1 ubuntu ubuntu  13411 Feb 23 13:59 artifact_urls_presigned.yml
root@ip-172-31-44-132:/home/ubuntu# mv artifact_urls.yml artifact_urls_bk.yml
root@ip-172-31-44-132:/home/ubuntu# mv artifact_urls_presigned.yml artifact_urls.yml
root@ip-172-31-44-132:/home/ubuntu# bash wazuh-install.sh -d local -a -id
23/02/2026 13:59:33 INFO: Starting Wazuh installation assistant. Wazuh version: 5.0.0
23/02/2026 13:59:33 INFO: Verbose logging redirected to /var/log/wazuh-install.log
23/02/2026 13:59:42 INFO: Verifying that your system meets the recommended minimum hardware requirements.
23/02/2026 13:59:49 INFO: --- Configuration files ---
23/02/2026 13:59:49 INFO: Generating configuration files.
23/02/2026 13:59:50 INFO: Generating the root certificate.
23/02/2026 13:59:50 INFO: Generating Admin certificates.
23/02/2026 13:59:51 INFO: Generating Wazuh indexer certificates.
23/02/2026 13:59:52 INFO: Generating Wazuh manager certificates.
23/02/2026 13:59:52 INFO: Generating Wazuh dashboard certificates.
23/02/2026 13:59:53 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key and the certificates necessary for installation.
23/02/2026 13:59:53 INFO: --- Wazuh indexer ---
23/02/2026 13:59:53 INFO: Downloading wazuh_indexer package: wazuh-indexer_5.0.0-latest_arm64.deb
23/02/2026 14:00:19 INFO: wazuh_indexer package downloaded successfully: /home/ubuntu/wazuh-install-packages/wazuh-indexer_5.0.0-latest_arm64.deb
23/02/2026 14:00:19 INFO: Starting Wazuh indexer installation.
23/02/2026 14:01:06 INFO: Wazuh indexer installation finished.
23/02/2026 14:01:06 INFO: Wazuh indexer post-install configuration finished.
23/02/2026 14:01:06 INFO: Starting service wazuh-indexer.
23/02/2026 14:01:34 INFO: wazuh-indexer service started.
23/02/2026 14:01:49 INFO: Wazuh indexer cluster security configuration initialized.
23/02/2026 14:01:49 INFO: --- Wazuh manager ---
23/02/2026 14:01:49 INFO: Downloading wazuh_manager package: wazuh-manager_5.0.0-latest_arm64.deb
23/02/2026 14:02:03 INFO: wazuh_manager package downloaded successfully: /home/ubuntu/wazuh-install-packages/wazuh-manager_5.0.0-latest_arm64.deb
23/02/2026 14:02:03 INFO: Starting the Wazuh manager installation.
23/02/2026 14:02:53 INFO: Wazuh manager installation finished.
23/02/2026 14:02:53 INFO: Wazuh manager vulnerability detection configuration finished.
23/02/2026 14:02:53 INFO: Starting service wazuh-manager.
23/02/2026 14:03:03 INFO: wazuh-manager service started.
23/02/2026 14:03:03 INFO: --- Wazuh dashboard ---
23/02/2026 14:03:03 INFO: Downloading wazuh_dashboard package: wazuh-dashboard_5.0.0-latest_arm64.deb
23/02/2026 14:03:13 INFO: wazuh_dashboard package downloaded successfully: /home/ubuntu/wazuh-install-packages/wazuh-dashboard_5.0.0-latest_arm64.deb
23/02/2026 14:03:13 INFO: Starting Wazuh dashboard installation.
23/02/2026 14:06:11 INFO: Wazuh dashboard installation finished.
23/02/2026 14:06:11 INFO: Wazuh dashboard post-install configuration finished.
23/02/2026 14:06:11 INFO: Starting service wazuh-dashboard.
23/02/2026 14:06:12 INFO: wazuh-dashboard service started.
23/02/2026 14:06:12 INFO: Wazuh dashboard web application initialized.
23/02/2026 14:06:12 INFO: --- Summary ---
23/02/2026 14:06:12 INFO: You can access the web interface https://<wazuh_dashboard_ip>:443
    User: admin
    Password: admin
23/02/2026 14:06:12 INFO: Installation finished.
root@ip-172-31-44-132:/home/ubuntu#

Logs in wazuh-install.log:

[root@ip-172-31-44-132 /home/ubuntu]# sudo cat /var/log/wazuh-install.log
23/02/2026 13:59:33 INFO: Starting Wazuh installation assistant. Wazuh version: 5.0.0
23/02/2026 13:59:33 INFO: Verbose logging redirected to /var/log/wazuh-install.log
23/02/2026 13:59:42 INFO: Verifying that your system meets the recommended minimum hardware requirements.
Hit:1 http://us-east-1.ec2.ports.ubuntu.com/ubuntu-ports jammy InRelease
Hit:2 http://ports.ubuntu.com/ubuntu-ports jammy-security InRelease
Hit:3 http://us-east-1.ec2.ports.ubuntu.com/ubuntu-ports jammy-updates InRelease
Hit:4 http://us-east-1.ec2.ports.ubuntu.com/ubuntu-ports jammy-backports InRelease
Reading package lists...
23/02/2026 13:59:49 INFO: --- Configuration files ---
23/02/2026 13:59:49 INFO: Generating configuration files.
23/02/2026 13:59:50 INFO: Generating the root certificate.
23/02/2026 13:59:50 INFO: Generating Admin certificates.
23/02/2026 13:59:51 INFO: Generating Wazuh indexer certificates.
23/02/2026 13:59:52 INFO: Generating Wazuh manager certificates.
23/02/2026 13:59:52 INFO: Generating Wazuh dashboard certificates.
23/02/2026 13:59:53 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key and the certificates necessary for installation.
23/02/2026 13:59:53 INFO: --- Wazuh indexer ---
23/02/2026 13:59:53 INFO: Downloading wazuh_indexer package: wazuh-indexer_5.0.0-latest_arm64.deb
23/02/2026 14:00:19 INFO: wazuh_indexer package downloaded successfully: /home/ubuntu/wazuh-install-packages/wazuh-indexer_5.0.0-latest_arm64.deb
23/02/2026 14:00:19 INFO: Starting Wazuh indexer installation.
Reading package lists... Building dependency tree... Reading state information... The following NEW packages will be installed: wazuh-indexer 0 upgraded, 1 newly installed, 0 to remove and 94 not upgraded. Need to get 0 B/902 MB of archives. After this operation, 1222 MB of additional disk space will be used. Get:1 /home/ubuntu/wazuh-install-packages/wazuh-indexer_5.0.0-latest_arm64.deb wazuh-indexer arm64 5.0.0-latest [902 MB] Selecting previously unselected package wazuh-indexer.
 (Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 105352 files and directories currently installed.)
 Preparing to unpack .../wazuh-indexer_5.0.0-latest_arm64.deb ...
 Running Wazuh Indexer Pre-Installation Script
 Unpacking wazuh-indexer (5.0.0-latest) ...
 Setting up wazuh-indexer (5.0.0-latest) ...
 Running Wazuh Indexer Post-Installation Script
 ### NOT starting on installation, please execute the following statements to configure wazuh-indexer service to start automatically using systemd
 sudo systemctl daemon-reload
 sudo systemctl enable wazuh-indexer.service
 ### You can start wazuh-indexer service by executing
 sudo systemctl start wazuh-indexer.service
 Processing triggers for libc-bin (2.35-0ubuntu3.13) ...
 NEEDRESTART-VER: 3.5 NEEDRESTART-KCUR: 6.2.0-1012-aws NEEDRESTART-KEXP: 6.8.0-1046-aws NEEDRESTART-KSTA: 3 NEEDRESTART-SVC: chrony.service NEEDRESTART-SVC: cron.service NEEDRESTART-SVC: dbus.service NEEDRESTART-SVC: getty@tty1.service NEEDRESTART-SVC: irqbalance.service NEEDRESTART-SVC: multipathd.service NEEDRESTART-SVC: networkd-dispatcher.service NEEDRESTART-SVC: packagekit.service NEEDRESTART-SVC: polkit.service NEEDRESTART-SVC: rsyslog.service NEEDRESTART-SVC: serial-getty@ttyS0.service NEEDRESTART-SVC: ssh.service NEEDRESTART-SVC: systemd-journald.service NEEDRESTART-SVC: systemd-logind.service NEEDRESTART-SVC: systemd-manager NEEDRESTART-SVC: systemd-networkd.service NEEDRESTART-SVC: systemd-resolved.service NEEDRESTART-SVC: systemd-udevd.service NEEDRESTART-SVC: unattended-upgrades.service NEEDRESTART-SVC: user@1000.service
23/02/2026 14:01:06 INFO: Wazuh indexer installation finished.
mkdir: cannot create directory ‘/etc/wazuh-indexer/certs’: File exists
23/02/2026 14:01:06 INFO: Wazuh indexer post-install configuration finished.
23/02/2026 14:01:06 INFO: Starting service wazuh-indexer.
Synchronizing state of wazuh-indexer.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable wazuh-indexer
Created symlink /etc/systemd/system/multi-user.target.wants/wazuh-indexer.service → /lib/systemd/system/wazuh-indexer.service.
23/02/2026 14:01:34 INFO: wazuh-indexer service started.
Security Admin v7
Will connect to 127.0.0.1:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 3.3.2
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: YELLOW
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
Populate config from /etc/wazuh-indexer/opensearch-security/
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml
   SUCC: Configuration for 'config' created or updated
Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml
   SUCC: Configuration for 'roles' created or updated
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml
   SUCC: Configuration for 'rolesmapping' created or updated
Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml
   SUCC: Configuration for 'internalusers' created or updated
Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml
   SUCC: Configuration for 'actiongroups' created or updated
Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml
   SUCC: Configuration for 'tenants' created or updated
Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml
   SUCC: Configuration for 'nodesdn' created or updated
Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml
   SUCC: Configuration for 'audit' created or updated
Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml
   SUCC: Configuration for 'allowlist' created or updated
SUCC: Expected 9 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","actiongroups","config","internalusers"],"updated_config_size":9,"message":null} is 9 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","actiongroups","config","internalusers"]) due to: null
Done with success
23/02/2026 14:01:49 INFO: Wazuh indexer cluster security configuration initialized.
23/02/2026 14:01:49 INFO: --- Wazuh manager ---
23/02/2026 14:01:49 INFO: Downloading wazuh_manager package: wazuh-manager_5.0.0-latest_arm64.deb
23/02/2026 14:02:03 INFO: wazuh_manager package downloaded successfully: /home/ubuntu/wazuh-install-packages/wazuh-manager_5.0.0-latest_arm64.deb
23/02/2026 14:02:03 INFO: Starting the Wazuh manager installation.
Reading package lists... Building dependency tree... Reading state information... Suggested packages: expect The following NEW packages will be installed: wazuh-manager 0 upgraded, 1 newly installed, 0 to remove and 94 not upgraded. Need to get 0 B/452 MB of archives. After this operation, 821 MB of additional disk space will be used. Get:1 /home/ubuntu/wazuh-install-packages/wazuh-manager_5.0.0-latest_arm64.deb wazuh-manager arm64 5.0.0-latest [452 MB] Selecting previously unselected package wazuh-manager.
 (Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 108870 files and directories currently installed.)
 Preparing to unpack .../wazuh-manager_5.0.0-latest_arm64.deb ...
 Unpacking wazuh-manager (5.0.0-latest) ...
 Setting up wazuh-manager (5.0.0-latest) ...
 Processing triggers for libc-bin (2.35-0ubuntu3.13) ...
 NEEDRESTART-VER: 3.5 NEEDRESTART-KCUR: 6.2.0-1012-aws NEEDRESTART-KEXP: 6.8.0-1046-aws NEEDRESTART-KSTA: 3 NEEDRESTART-SVC: chrony.service NEEDRESTART-SVC: cron.service NEEDRESTART-SVC: dbus.service NEEDRESTART-SVC: getty@tty1.service NEEDRESTART-SVC: irqbalance.service NEEDRESTART-SVC: multipathd.service NEEDRESTART-SVC: networkd-dispatcher.service NEEDRESTART-SVC: packagekit.service NEEDRESTART-SVC: polkit.service NEEDRESTART-SVC: rsyslog.service NEEDRESTART-SVC: serial-getty@ttyS0.service NEEDRESTART-SVC: ssh.service NEEDRESTART-SVC: systemd-journald.service NEEDRESTART-SVC: systemd-logind.service NEEDRESTART-SVC: systemd-manager NEEDRESTART-SVC: systemd-networkd.service NEEDRESTART-SVC: systemd-resolved.service NEEDRESTART-SVC: systemd-udevd.service NEEDRESTART-SVC: unattended-upgrades.service NEEDRESTART-SVC: user@1000.service
23/02/2026 14:02:53 INFO: Wazuh manager installation finished.
23/02/2026 14:02:53 INFO: Wazuh manager vulnerability detection configuration finished.
23/02/2026 14:02:53 INFO: Starting service wazuh-manager.
Created symlink /etc/systemd/system/multi-user.target.wants/wazuh-manager.service → /lib/systemd/system/wazuh-manager.service.
23/02/2026 14:03:03 INFO: wazuh-manager service started.
23/02/2026 14:03:03 INFO: --- Wazuh dashboard ---
23/02/2026 14:03:03 INFO: Downloading wazuh_dashboard package: wazuh-dashboard_5.0.0-latest_arm64.deb
23/02/2026 14:03:13 INFO: wazuh_dashboard package downloaded successfully: /home/ubuntu/wazuh-install-packages/wazuh-dashboard_5.0.0-latest_arm64.deb
23/02/2026 14:03:13 INFO: Starting Wazuh dashboard installation.
Reading package lists... Building dependency tree... Reading state information... The following NEW packages will be installed: wazuh-dashboard 0 upgraded, 1 newly installed, 0 to remove and 94 not upgraded. Need to get 0 B/220 MB of archives. After this operation, 1300 MB of additional disk space will be used. Get:1 /home/ubuntu/wazuh-install-packages/wazuh-dashboard_5.0.0-latest_arm64.deb wazuh-dashboard arm64 5.0.0-latest [220 MB] Selecting previously unselected package wazuh-dashboard.
 (Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 118871 files and directories currently installed.)
 Preparing to unpack .../wazuh-dashboard_5.0.0-latest_arm64.deb ...
 Creating wazuh-dashboard group... OK
 Creating wazuh-dashboard user... OK
 Unpacking wazuh-dashboard (5.0.0-latest) ...
 Setting up wazuh-dashboard (5.0.0-latest) ...
 NEEDRESTART-VER: 3.5 NEEDRESTART-KCUR: 6.2.0-1012-aws NEEDRESTART-KEXP: 6.8.0-1046-aws NEEDRESTART-KSTA: 3 NEEDRESTART-SVC: chrony.service NEEDRESTART-SVC: cron.service NEEDRESTART-SVC: dbus.service NEEDRESTART-SVC: getty@tty1.service NEEDRESTART-SVC: irqbalance.service NEEDRESTART-SVC: multipathd.service NEEDRESTART-SVC: networkd-dispatcher.service NEEDRESTART-SVC: packagekit.service NEEDRESTART-SVC: polkit.service NEEDRESTART-SVC: rsyslog.service NEEDRESTART-SVC: serial-getty@ttyS0.service NEEDRESTART-SVC: ssh.service NEEDRESTART-SVC: systemd-journald.service NEEDRESTART-SVC: systemd-logind.service NEEDRESTART-SVC: systemd-manager NEEDRESTART-SVC: systemd-networkd.service NEEDRESTART-SVC: systemd-resolved.service NEEDRESTART-SVC: systemd-udevd.service NEEDRESTART-SVC: unattended-upgrades.service NEEDRESTART-SVC: user@1000.service
23/02/2026 14:06:11 INFO: Wazuh dashboard installation finished.
23/02/2026 14:06:11 INFO: Wazuh dashboard post-install configuration finished.
23/02/2026 14:06:11 INFO: Starting service wazuh-dashboard.
Created symlink /etc/systemd/system/multi-user.target.wants/wazuh-dashboard.service → /lib/systemd/system/wazuh-dashboard.service.
23/02/2026 14:06:12 INFO: wazuh-dashboard service started.
23/02/2026 14:06:12 INFO: Wazuh dashboard web application initialized.
23/02/2026 14:06:12 INFO: Installation finished.

Ubuntu 22 AMD

Logs on the console:

root@ip-172-31-45-215:/home/ubuntu# ls -ltr
total 140
-r-x------ 1 ubuntu ubuntu 123946 Feb 23 13:48 wazuh-install.sh
-rw------- 1 ubuntu ubuntu  13411 Feb 23 14:02 artifact_urls_presigned.yml
root@ip-172-31-45-215:/home/ubuntu# mv artifact_urls_presigned.yml artifact_urls.yml
root@ip-172-31-45-215:/home/ubuntu# bash wazuh-install.sh -d local -a -id
23/02/2026 14:03:04 INFO: Starting Wazuh installation assistant. Wazuh version: 5.0.0
23/02/2026 14:03:04 INFO: Verbose logging redirected to /var/log/wazuh-install.log
23/02/2026 14:03:09 INFO: Verifying that your system meets the recommended minimum hardware requirements.
23/02/2026 14:03:15 INFO: --- Configuration files ---
23/02/2026 14:03:15 INFO: Generating configuration files.
23/02/2026 14:03:15 INFO: Generating the root certificate.
23/02/2026 14:03:15 INFO: Generating Admin certificates.
23/02/2026 14:03:15 INFO: Generating Wazuh indexer certificates.
23/02/2026 14:03:16 INFO: Generating Wazuh manager certificates.
23/02/2026 14:03:16 INFO: Generating Wazuh dashboard certificates.
23/02/2026 14:03:16 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key and the certificates necessary for installation.
23/02/2026 14:03:16 INFO: --- Wazuh indexer ---
23/02/2026 14:03:16 INFO: Downloading wazuh_indexer package: wazuh-indexer_5.0.0-latest_amd64.deb
23/02/2026 14:03:41 INFO: wazuh_indexer package downloaded successfully: /home/ubuntu/wazuh-install-packages/wazuh-indexer_5.0.0-latest_amd64.deb
23/02/2026 14:03:41 INFO: Starting Wazuh indexer installation.
23/02/2026 14:04:19 INFO: Wazuh indexer installation finished.
23/02/2026 14:04:19 INFO: Wazuh indexer post-install configuration finished.
23/02/2026 14:04:19 INFO: Starting service wazuh-indexer.
23/02/2026 14:04:43 INFO: wazuh-indexer service started.
23/02/2026 14:04:58 INFO: Wazuh indexer cluster security configuration initialized.
23/02/2026 14:04:58 INFO: --- Wazuh manager ---
23/02/2026 14:04:58 INFO: Downloading wazuh_manager package: wazuh-manager_5.0.0-latest_amd64.deb
23/02/2026 14:05:12 INFO: wazuh_manager package downloaded successfully: /home/ubuntu/wazuh-install-packages/wazuh-manager_5.0.0-latest_amd64.deb
23/02/2026 14:05:12 INFO: Starting the Wazuh manager installation.
23/02/2026 14:05:52 INFO: Wazuh manager installation finished.
23/02/2026 14:05:52 INFO: Wazuh manager vulnerability detection configuration finished.
23/02/2026 14:05:52 INFO: Starting service wazuh-manager.
23/02/2026 14:06:02 INFO: wazuh-manager service started.
23/02/2026 14:06:02 INFO: --- Wazuh dashboard ---
23/02/2026 14:06:02 INFO: Downloading wazuh_dashboard package: wazuh-dashboard_5.0.0-latest_amd64.deb
23/02/2026 14:06:12 INFO: wazuh_dashboard package downloaded successfully: /home/ubuntu/wazuh-install-packages/wazuh-dashboard_5.0.0-latest_amd64.deb
23/02/2026 14:06:12 INFO: Starting Wazuh dashboard installation.
23/02/2026 14:09:19 INFO: Wazuh dashboard installation finished.
23/02/2026 14:09:20 INFO: Wazuh dashboard post-install configuration finished.
23/02/2026 14:09:20 INFO: Starting service wazuh-dashboard.
23/02/2026 14:09:21 INFO: wazuh-dashboard service started.
23/02/2026 14:09:21 INFO: Wazuh dashboard web application initialized.
23/02/2026 14:09:21 INFO: --- Summary ---
23/02/2026 14:09:21 INFO: You can access the web interface https://<wazuh_dashboard_ip>:443
    User: admin
    Password: admin
23/02/2026 14:09:21 INFO: Installation finished.
root@ip-172-31-45-215:/home/ubuntu#

Logs in wazuh-install.log:

[root@ip-172-31-45-215 /home/ubuntu]# sudo cat /var/log/wazuh-install.log
23/02/2026 14:03:04 INFO: Starting Wazuh installation assistant. Wazuh version: 5.0.0
23/02/2026 14:03:04 INFO: Verbose logging redirected to /var/log/wazuh-install.log
23/02/2026 14:03:09 INFO: Verifying that your system meets the recommended minimum hardware requirements.
Hit:1 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy InRelease
Hit:2 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy-updates InRelease
Hit:3 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy-backports InRelease
Hit:4 http://security.ubuntu.com/ubuntu jammy-security InRelease
Reading package lists...
23/02/2026 14:03:15 INFO: --- Configuration files ---
23/02/2026 14:03:15 INFO: Generating configuration files.
23/02/2026 14:03:15 INFO: Generating the root certificate.
23/02/2026 14:03:15 INFO: Generating Admin certificates.
23/02/2026 14:03:15 INFO: Generating Wazuh indexer certificates.
23/02/2026 14:03:16 INFO: Generating Wazuh manager certificates.
23/02/2026 14:03:16 INFO: Generating Wazuh dashboard certificates.
23/02/2026 14:03:16 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key and the certificates necessary for installation.
23/02/2026 14:03:16 INFO: --- Wazuh indexer ---
23/02/2026 14:03:16 INFO: Downloading wazuh_indexer package: wazuh-indexer_5.0.0-latest_amd64.deb
23/02/2026 14:03:41 INFO: wazuh_indexer package downloaded successfully: /home/ubuntu/wazuh-install-packages/wazuh-indexer_5.0.0-latest_amd64.deb
23/02/2026 14:03:41 INFO: Starting Wazuh indexer installation.
Reading package lists... Building dependency tree... Reading state information... The following NEW packages will be installed: wazuh-indexer 0 upgraded, 1 newly installed, 0 to remove and 102 not upgraded. Need to get 0 B/903 MB of archives. After this operation, 1222 MB of additional disk space will be used. Get:1 /home/ubuntu/wazuh-install-packages/wazuh-indexer_5.0.0-latest_amd64.deb wazuh-indexer amd64 5.0.0-latest [903 MB] Selecting previously unselected package wazuh-indexer.
 (Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 101998 files and directories currently installed.)
 Preparing to unpack .../wazuh-indexer_5.0.0-latest_amd64.deb ...
 Running Wazuh Indexer Pre-Installation Script
 Unpacking wazuh-indexer (5.0.0-latest) ...
 Setting up wazuh-indexer (5.0.0-latest) ...
 Running Wazuh Indexer Post-Installation Script
 ### NOT starting on installation, please execute the following statements to configure wazuh-indexer service to start automatically using systemd
 sudo systemctl daemon-reload
 sudo systemctl enable wazuh-indexer.service
 ### You can start wazuh-indexer service by executing
 sudo systemctl start wazuh-indexer.service
 Processing triggers for libc-bin (2.35-0ubuntu3.13) ...
 NEEDRESTART-VER: 3.5 NEEDRESTART-KCUR: 5.19.0-1025-aws NEEDRESTART-KEXP: 6.8.0-1046-aws NEEDRESTART-KSTA: 3 NEEDRESTART-SVC: acpid.service NEEDRESTART-SVC: chrony.service NEEDRESTART-SVC: cron.service NEEDRESTART-SVC: dbus.service NEEDRESTART-SVC: getty@tty1.service NEEDRESTART-SVC: irqbalance.service NEEDRESTART-SVC: multipathd.service NEEDRESTART-SVC: networkd-dispatcher.service NEEDRESTART-SVC: packagekit.service NEEDRESTART-SVC: polkit.service NEEDRESTART-SVC: serial-getty@ttyS0.service NEEDRESTART-SVC: ssh.service NEEDRESTART-SVC: systemd-journald.service NEEDRESTART-SVC: systemd-logind.service NEEDRESTART-SVC: systemd-manager NEEDRESTART-SVC: systemd-networkd.service NEEDRESTART-SVC: systemd-resolved.service NEEDRESTART-SVC: unattended-upgrades.service NEEDRESTART-SVC: user@1000.service
23/02/2026 14:04:19 INFO: Wazuh indexer installation finished.
mkdir: cannot create directory ‘/etc/wazuh-indexer/certs’: File exists
23/02/2026 14:04:19 INFO: Wazuh indexer post-install configuration finished.
23/02/2026 14:04:19 INFO: Starting service wazuh-indexer.
Synchronizing state of wazuh-indexer.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable wazuh-indexer
Created symlink /etc/systemd/system/multi-user.target.wants/wazuh-indexer.service → /lib/systemd/system/wazuh-indexer.service.
23/02/2026 14:04:43 INFO: wazuh-indexer service started.
Security Admin v7
Will connect to 127.0.0.1:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 3.3.2
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
Populate config from /etc/wazuh-indexer/opensearch-security/
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml
   SUCC: Configuration for 'config' created or updated
Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml
   SUCC: Configuration for 'roles' created or updated
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml
   SUCC: Configuration for 'rolesmapping' created or updated
Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml
   SUCC: Configuration for 'internalusers' created or updated
Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml
   SUCC: Configuration for 'actiongroups' created or updated
Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml
   SUCC: Configuration for 'tenants' created or updated
Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml
   SUCC: Configuration for 'nodesdn' created or updated
Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml
   SUCC: Configuration for 'audit' created or updated
Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml
   SUCC: Configuration for 'allowlist' created or updated
SUCC: Expected 9 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","actiongroups","config","internalusers"],"updated_config_size":9,"message":null} is 9 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","actiongroups","config","internalusers"]) due to: null
Done with success
14:04:58.189 [httpclient-dispatch-1] ERROR org.apache.hc.client5.http.impl.async - null
java.util.ConcurrentModificationException: null
	at java.base/java.util.HashMap$HashIterator.nextNode(HashMap.java:1606) ~[?:?]
	at java.base/java.util.HashMap$KeyIterator.next(HashMap.java:1629) ~[?:?]
	at org.apache.hc.core5.reactor.SingleCoreIOReactor.processEvents(SingleCoreIOReactor.java:172) ~[httpcore5-5.3.4.jar:5.3.4]
	at org.apache.hc.core5.reactor.SingleCoreIOReactor.doExecute(SingleCoreIOReactor.java:125) ~[httpcore5-5.3.4.jar:5.3.4]
	at org.apache.hc.core5.reactor.AbstractSingleCoreIOReactor.execute(AbstractSingleCoreIOReactor.java:92) [httpcore5-5.3.4.jar:5.3.4]
	at org.apache.hc.core5.reactor.IOReactorWorker.run(IOReactorWorker.java:44) [httpcore5-5.3.4.jar:5.3.4]
	at java.base/java.lang.Thread.run(Thread.java:1447) [?:?]
23/02/2026 14:04:58 INFO: Wazuh indexer cluster security configuration initialized.
23/02/2026 14:04:58 INFO: --- Wazuh manager ---
23/02/2026 14:04:58 INFO: Downloading wazuh_manager package: wazuh-manager_5.0.0-latest_amd64.deb
23/02/2026 14:05:12 INFO: wazuh_manager package downloaded successfully: /home/ubuntu/wazuh-install-packages/wazuh-manager_5.0.0-latest_amd64.deb
23/02/2026 14:05:12 INFO: Starting the Wazuh manager installation.
Reading package lists... Building dependency tree... Reading state information... Suggested packages: expect The following NEW packages will be installed: wazuh-manager 0 upgraded, 1 newly installed, 0 to remove and 102 not upgraded. Need to get 0 B/461 MB of archives. After this operation, 819 MB of additional disk space will be used. Get:1 /home/ubuntu/wazuh-install-packages/wazuh-manager_5.0.0-latest_amd64.deb wazuh-manager amd64 5.0.0-latest [461 MB] Selecting previously unselected package wazuh-manager.
 (Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 105517 files and directories currently installed.)
 Preparing to unpack .../wazuh-manager_5.0.0-latest_amd64.deb ...
 Unpacking wazuh-manager (5.0.0-latest) ...
 Setting up wazuh-manager (5.0.0-latest) ...
 NEEDRESTART-VER: 3.5 NEEDRESTART-KCUR: 5.19.0-1025-aws NEEDRESTART-KEXP: 6.8.0-1046-aws NEEDRESTART-KSTA: 3 NEEDRESTART-SVC: acpid.service NEEDRESTART-SVC: chrony.service NEEDRESTART-SVC: cron.service NEEDRESTART-SVC: dbus.service NEEDRESTART-SVC: getty@tty1.service NEEDRESTART-SVC: irqbalance.service NEEDRESTART-SVC: multipathd.service NEEDRESTART-SVC: networkd-dispatcher.service NEEDRESTART-SVC: packagekit.service NEEDRESTART-SVC: polkit.service NEEDRESTART-SVC: serial-getty@ttyS0.service NEEDRESTART-SVC: ssh.service NEEDRESTART-SVC: systemd-journald.service NEEDRESTART-SVC: systemd-logind.service NEEDRESTART-SVC: systemd-manager NEEDRESTART-SVC: systemd-networkd.service NEEDRESTART-SVC: systemd-resolved.service NEEDRESTART-SVC: unattended-upgrades.service NEEDRESTART-SVC: user@1000.service
23/02/2026 14:05:52 INFO: Wazuh manager installation finished.
23/02/2026 14:05:52 INFO: Wazuh manager vulnerability detection configuration finished.
23/02/2026 14:05:52 INFO: Starting service wazuh-manager.
Created symlink /etc/systemd/system/multi-user.target.wants/wazuh-manager.service → /lib/systemd/system/wazuh-manager.service.
23/02/2026 14:06:02 INFO: wazuh-manager service started.
23/02/2026 14:06:02 INFO: --- Wazuh dashboard ---
23/02/2026 14:06:02 INFO: Downloading wazuh_dashboard package: wazuh-dashboard_5.0.0-latest_amd64.deb
23/02/2026 14:06:12 INFO: wazuh_dashboard package downloaded successfully: /home/ubuntu/wazuh-install-packages/wazuh-dashboard_5.0.0-latest_amd64.deb
23/02/2026 14:06:12 INFO: Starting Wazuh dashboard installation.
Reading package lists... Building dependency tree... Reading state information... The following NEW packages will be installed: wazuh-dashboard 0 upgraded, 1 newly installed, 0 to remove and 102 not upgraded. Need to get 0 B/220 MB of archives. After this operation, 1304 MB of additional disk space will be used. Get:1 /home/ubuntu/wazuh-install-packages/wazuh-dashboard_5.0.0-latest_amd64.deb wazuh-dashboard amd64 5.0.0-latest [220 MB] Selecting previously unselected package wazuh-dashboard.
 (Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 115518 files and directories currently installed.)
 Preparing to unpack .../wazuh-dashboard_5.0.0-latest_amd64.deb ...
 Creating wazuh-dashboard group... OK
 Creating wazuh-dashboard user... OK
 Unpacking wazuh-dashboard (5.0.0-latest) ...
 Setting up wazuh-dashboard (5.0.0-latest) ...
 NEEDRESTART-VER: 3.5 NEEDRESTART-KCUR: 5.19.0-1025-aws NEEDRESTART-KEXP: 6.8.0-1046-aws NEEDRESTART-KSTA: 3 NEEDRESTART-SVC: acpid.service NEEDRESTART-SVC: chrony.service NEEDRESTART-SVC: cron.service NEEDRESTART-SVC: dbus.service NEEDRESTART-SVC: getty@tty1.service NEEDRESTART-SVC: irqbalance.service NEEDRESTART-SVC: multipathd.service NEEDRESTART-SVC: networkd-dispatcher.service NEEDRESTART-SVC: packagekit.service NEEDRESTART-SVC: polkit.service NEEDRESTART-SVC: serial-getty@ttyS0.service NEEDRESTART-SVC: ssh.service NEEDRESTART-SVC: systemd-journald.service NEEDRESTART-SVC: systemd-logind.service NEEDRESTART-SVC: systemd-manager NEEDRESTART-SVC: systemd-networkd.service NEEDRESTART-SVC: systemd-resolved.service NEEDRESTART-SVC: unattended-upgrades.service NEEDRESTART-SVC: user@1000.service
23/02/2026 14:09:19 INFO: Wazuh dashboard installation finished.
23/02/2026 14:09:20 INFO: Wazuh dashboard post-install configuration finished.
23/02/2026 14:09:20 INFO: Starting service wazuh-dashboard.
Created symlink /etc/systemd/system/multi-user.target.wants/wazuh-dashboard.service → /lib/systemd/system/wazuh-dashboard.service.
23/02/2026 14:09:21 INFO: wazuh-dashboard service started.
23/02/2026 14:09:21 INFO: Wazuh dashboard web application initialized.
23/02/2026 14:09:21 INFO: Installation finished.

Installed packages Online

Ubuntu 22 ARM

[root@ip-172-31-44-132 /home/ubuntu]# sudo grep ' install ' /var/log/dpkg.log | tail
2026-02-23 14:00:27 status half-installed wazuh-indexer:arm64 5.0.0-latest
2026-02-23 14:00:56 status installed wazuh-indexer:arm64 5.0.0-latest
2026-02-23 14:00:56 status installed libc-bin:arm64 2.35-0ubuntu3.13
2026-02-23 14:02:08 install wazuh-manager:arm64 <none> 5.0.0-latest
2026-02-23 14:02:08 status half-installed wazuh-manager:arm64 5.0.0-latest
2026-02-23 14:02:43 status installed wazuh-manager:arm64 5.0.0-latest
2026-02-23 14:02:43 status installed libc-bin:arm64 2.35-0ubuntu3.13
2026-02-23 14:03:18 install wazuh-dashboard:arm64 <none> 5.0.0-latest
2026-02-23 14:03:18 status half-installed wazuh-dashboard:arm64 5.0.0-latest
2026-02-23 14:05:51 status installed wazuh-dashboard:arm64 5.0.0-latest

Ubuntu 22 AMD

[root@ip-172-31-45-215 /home/ubuntu]# sudo grep ' install ' /var/log/dpkg.log | tail
2026-02-23 14:03:46 install wazuh-indexer:amd64 <none> 5.0.0-latest
2026-02-23 14:03:46 status half-installed wazuh-indexer:amd64 5.0.0-latest
2026-02-23 14:04:14 status installed wazuh-indexer:amd64 5.0.0-latest
2026-02-23 14:04:14 status installed libc-bin:amd64 2.35-0ubuntu3.13
2026-02-23 14:05:16 install wazuh-manager:amd64 <none> 5.0.0-latest
2026-02-23 14:05:16 status half-installed wazuh-manager:amd64 5.0.0-latest
2026-02-23 14:05:45 status installed wazuh-manager:amd64 5.0.0-latest
2026-02-23 14:06:16 install wazuh-dashboard:amd64 <none> 5.0.0-latest
2026-02-23 14:06:16 status half-installed wazuh-dashboard:amd64 5.0.0-latest
2026-02-23 14:09:08 status installed wazuh-dashboard:amd64 5.0.0-latest

Wazuh Indexer Online

Ubuntu 22 ARM

Wazuh indexer status

[root@ip-172-31-44-132 /home/ubuntu]# sudo systemctl status wazuh-indexer
● wazuh-indexer.service - wazuh-indexer
     Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2026-02-23 14:01:34 UTC; 5h 29min ago
       Docs: https://documentation.wazuh.com
   Main PID: 85857 (java)
      Tasks: 193 (limit: 9308)
     Memory: 4.8G
        CPU: 6h 4min 51.694s
     CGroup: /system.slice/wazuh-indexer.service
             ├─85857 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -XX:+ShowCodeDetailsInExceptionMessages -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dio.netty.allocator.numDirectArenas=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.locale.providers=SPI,CLDR -Xms3884m -Xmx3884m -XX:+UseG1GC -XX:G1ReservePercent=25 -XX:InitiatingHeapOccupancyPercent=30 -Djava.io.tmpdir=/tmp/opensearch-15876304020597396231 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/lib/wazuh-indexer -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log "-Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m" --add-modules=jdk.incubator.vector -javaagent:agent/opensearch-agent.jar --add-opens=java.base/java.nio=org.apache.arrow.memory.core,ALL-UNNAMED -Dorg.apache.lucene.store.MMapDirectory.sharedArenaMaxPermits=1 -XX:MaxDirectMemorySize=2036334592 -Dopensearch.path.home=/usr/share/wazuh-indexer -Dopensearch.path.conf=/etc/wazuh-indexer -Dopensearch.distribution.type=deb -Dopensearch.bundled_jdk=true -cp "/usr/share/wazuh-indexer/lib/*" org.opensearch.bootstrap.OpenSearch -p /run/wazuh-indexer/wazuh-indexer.pid --quiet
             └─85872 /usr/share/wazuh-indexer/engine/bin/wazuh-engine -f

Feb 23 14:01:10 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: Unknown module: org.apache.arrow.memory.core specified to --add-opens
Feb 23 14:01:11 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
Feb 23 14:01:11 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: sun.misc.Unsafe::objectFieldOffset has been called by net.bytebuddy.dynamic.loading.ClassInjector$UsingUnsafe$Dispatcher$CreationAction
Feb 23 14:01:11 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: Please consider reporting this to the maintainers of class net.bytebuddy.dynamic.loading.ClassInjector$UsingUnsafe$Dispatcher$CreationAction
Feb 23 14:01:11 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: sun.misc.Unsafe::objectFieldOffset will be removed in a future release
Feb 23 14:01:13 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: A restricted method in java.lang.System has been called
Feb 23 14:01:13 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: java.lang.System::load has been called by com.sun.jna.Native in an unnamed module (file:/usr/share/wazuh-indexer/lib/jna-5.16.0.jar)
Feb 23 14:01:13 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module
Feb 23 14:01:13 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: Restricted methods will be blocked in a future release unless native access is enabled
Feb 23 14:01:34 ip-172-31-44-132 systemd[1]: Started wazuh-indexer.

Service status

[root@ip-172-31-44-132 /home/ubuntu]# sudo journalctl -xe -u wazuh-indexer.service --no-pager
Feb 23 14:01:07 ip-172-31-44-132 systemd[1]: Starting wazuh-indexer...
░░ Subject: A start job for unit wazuh-indexer.service has begun execution
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit wazuh-indexer.service has begun execution.
░░
░░ The job identifier is 19973.
Feb 23 14:01:10 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: Using incubator modules: jdk.incubator.vector
Feb 23 14:01:10 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: Unknown module: org.apache.arrow.memory.core specified to --add-opens
Feb 23 14:01:11 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
Feb 23 14:01:11 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: sun.misc.Unsafe::objectFieldOffset has been called by net.bytebuddy.dynamic.loading.ClassInjector$UsingUnsafe$Dispatcher$CreationAction
Feb 23 14:01:11 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: Please consider reporting this to the maintainers of class net.bytebuddy.dynamic.loading.ClassInjector$UsingUnsafe$Dispatcher$CreationAction
Feb 23 14:01:11 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: sun.misc.Unsafe::objectFieldOffset will be removed in a future release
Feb 23 14:01:13 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: A restricted method in java.lang.System has been called
Feb 23 14:01:13 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: java.lang.System::load has been called by com.sun.jna.Native in an unnamed module (file:/usr/share/wazuh-indexer/lib/jna-5.16.0.jar)
Feb 23 14:01:13 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module
Feb 23 14:01:13 ip-172-31-44-132 wazuh-indexer[85857]: WARNING: Restricted methods will be blocked in a future release unless native access is enabled
Feb 23 14:01:34 ip-172-31-44-132 systemd[1]: Started wazuh-indexer.
░░ Subject: A start job for unit wazuh-indexer.service has finished successfully
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit wazuh-indexer.service has finished successfully.
░░
░░ The job identifier is 19973.

Errors

[root@ip-172-31-44-132 /home/ubuntu]# head -n 400 /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E \"error|warn\"
[2026-02-23T16:42:54,149][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,169][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Description]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ParentImage]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ParentImage]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.OriginalFileName]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ParentImage]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.IntegrityLevel]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Description]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.IntegrityLevel]];
[2026-02-23T16:42:54,170][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,171][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ParentImage]];
[2026-02-23T16:42:54,171][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,171][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,171][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,171][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,171][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,171][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,171][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,171][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.OriginalFileName]];
[2026-02-23T16:42:54,180][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,180][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,180][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,180][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.OriginalFileName]];
[2026-02-23T16:42:54,180][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,180][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,180][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.OriginalFileName]];
[2026-02-23T16:42:54,180][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,180][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,180][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Product]];
[2026-02-23T16:42:54,180][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ParentImage]];
[2026-02-23T16:42:54,180][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,180][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,180][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ImageLoaded]];
[2026-02-23T16:42:54,180][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Description]];
[2026-02-23T16:42:54,181][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,181][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:42:54,181][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ParentCommandLine]];
[2026-02-23T16:42:54,181][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ImageLoaded]];
[2026-02-23T16:42:54,181][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ImageLoaded]];
[2026-02-23T16:42:54,181][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ImageLoaded]];
[2026-02-23T16:42:54,181][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ParentImage]];
[2026-02-23T16:42:54,181][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ImageLoaded]];
[2026-02-23T16:42:54,181][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ImageLoaded]];
[2026-02-23T16:42:54,181][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Hashes]];
[2026-02-23T16:42:54,181][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ImageLoaded]];
[2026-02-23T16:42:54,181][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Description]];

Ubuntu 22 AMD

Wazuh indexer status

[root@ip-172-31-45-215 /home/ubuntu]# sudo systemctl status wazuh-indexer
● wazuh-indexer.service - wazuh-indexer
     Loaded: loaded (/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2026-02-23 14:04:43 UTC; 5h 26min ago
       Docs: https://documentation.wazuh.com
   Main PID: 92325 (java)
      Tasks: 204 (limit: 9398)
     Memory: 4.9G
        CPU: 5h 9min 35.578s
     CGroup: /system.slice/wazuh-indexer.service
             ├─92325 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -XX:+ShowCodeDetailsInExceptionMessages -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dio.netty.allocator.numDirectArenas=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.locale.providers=SPI,CLDR -Xms3923m -Xmx3923m -XX:+UseG1GC -XX:G1ReservePercent=25 -XX:InitiatingHeapOccupancyPercent=30 -Djava.io.tmpdir=/tmp/opensearch-18101495625238258045 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/lib/wazuh-indexer -XX:ErrorFile=/var/log/wazuh-indexer/hs_err_pid%p.log "-Xlog:gc*,gc+age=trace,safepoint:file=/var/log/wazuh-indexer/gc.log:utctime,pid,tags:filecount=32,filesize=64m" --add-modules=jdk.incubator.vector -javaagent:agent/opensearch-agent.jar --add-opens=java.base/java.nio=org.apache.arrow.memory.core,ALL-UNNAMED -Dorg.apache.lucene.store.MMapDirectory.sharedArenaMaxPermits=1 -XX:MaxDirectMemorySize=2057306112 -Dopensearch.path.home=/usr/share/wazuh-indexer -Dopensearch.path.conf=/etc/wazuh-indexer -Dopensearch.distribution.type=deb -Dopensearch.bundled_jdk=true -cp "/usr/share/wazuh-indexer/lib/*" org.opensearch.bootstrap.OpenSearch -p /run/wazuh-indexer/wazuh-indexer.pid --quiet
             └─92326 /usr/share/wazuh-indexer/engine/bin/wazuh-engine -f

Feb 23 14:04:23 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: Unknown module: org.apache.arrow.memory.core specified to --add-opens
Feb 23 14:04:23 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
Feb 23 14:04:23 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: sun.misc.Unsafe::objectFieldOffset has been called by net.bytebuddy.dynamic.loading.ClassInjector$UsingUnsafe$Dispatcher$CreationAction
Feb 23 14:04:23 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: Please consider reporting this to the maintainers of class net.bytebuddy.dynamic.loading.ClassInjector$UsingUnsafe$Dispatcher$CreationAction
Feb 23 14:04:23 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: sun.misc.Unsafe::objectFieldOffset will be removed in a future release
Feb 23 14:04:25 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: A restricted method in java.lang.System has been called
Feb 23 14:04:25 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: java.lang.System::load has been called by com.sun.jna.Native in an unnamed module (file:/usr/share/wazuh-indexer/lib/jna-5.16.0.jar)
Feb 23 14:04:25 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module
Feb 23 14:04:25 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: Restricted methods will be blocked in a future release unless native access is enabled
Feb 23 14:04:43 ip-172-31-45-215 systemd[1]: Started wazuh-indexer.

Service status

[root@ip-172-31-45-215 /home/ubuntu]# sudo journalctl -xe -u wazuh-indexer.service --no-pager
Feb 23 14:04:20 ip-172-31-45-215 systemd[1]: Starting wazuh-indexer...
░░ Subject: A start job for unit wazuh-indexer.service has begun execution
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit wazuh-indexer.service has begun execution.
░░
░░ The job identifier is 21189.
Feb 23 14:04:23 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: Using incubator modules: jdk.incubator.vector
Feb 23 14:04:23 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: Unknown module: org.apache.arrow.memory.core specified to --add-opens
Feb 23 14:04:23 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
Feb 23 14:04:23 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: sun.misc.Unsafe::objectFieldOffset has been called by net.bytebuddy.dynamic.loading.ClassInjector$UsingUnsafe$Dispatcher$CreationAction
Feb 23 14:04:23 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: Please consider reporting this to the maintainers of class net.bytebuddy.dynamic.loading.ClassInjector$UsingUnsafe$Dispatcher$CreationAction
Feb 23 14:04:23 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: sun.misc.Unsafe::objectFieldOffset will be removed in a future release
Feb 23 14:04:25 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: A restricted method in java.lang.System has been called
Feb 23 14:04:25 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: java.lang.System::load has been called by com.sun.jna.Native in an unnamed module (file:/usr/share/wazuh-indexer/lib/jna-5.16.0.jar)
Feb 23 14:04:25 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module
Feb 23 14:04:25 ip-172-31-45-215 wazuh-indexer[92325]: WARNING: Restricted methods will be blocked in a future release unless native access is enabled
Feb 23 14:04:43 ip-172-31-45-215 systemd[1]: Started wazuh-indexer.
░░ Subject: A start job for unit wazuh-indexer.service has finished successfully
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit wazuh-indexer.service has finished successfully.
░░
░░ The job identifier is 21189.

Errors

[root@ip-172-31-45-215 /home/ubuntu]# head -n 400 /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E \"error|warn\"
[2026-02-23T16:45:33,872][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,901][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,901][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,901][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,901][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ParentImage]];
[2026-02-23T16:45:33,901][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,901][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,901][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,901][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,901][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,906][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,906][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,906][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,906][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ParentImage]];
[2026-02-23T16:45:33,906][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,906][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,906][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,906][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,906][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,906][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.ParentImage]];
[2026-02-23T16:45:33,906][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];
[2026-02-23T16:45:33,906][ERROR][o.o.a.u.DocLevelMonitorQueries] [wazuh-indexer] MapperParsingException[failed to parse]; nested: QueryShardException[No field mapping can be found for the field with name [windows.EventData.Image]];

Wazuh Dashboard Online

Ubuntu 22 ARM

Wazuh dashboard status

[root@ip-172-31-44-132 /home/ubuntu]# sudo systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
     Loaded: loaded (/lib/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2026-02-23 14:06:12 UTC; 5h 24min ago
   Main PID: 108553 (node)
      Tasks: 11 (limit: 9308)
     Memory: 210.6M
        CPU: 43.243s
     CGroup: /system.slice/wazuh-dashboard.service
             └─108553 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist

Feb 23 19:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T19:21:43Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"All default notification channels are now present and verified"}
Feb 23 19:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T19:21:43Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Starting Alerting sample monitors check"}
Feb 23 19:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T19:21:43Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Monitor already exists [Sample: Slack]"}
Feb 23 19:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T19:21:43Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Monitor already exists [Sample: PagerDuty]"}
Feb 23 19:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T19:21:43Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Monitor already exists [Sample: Jira]"}
Feb 23 19:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T19:21:43Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Monitor already exists [Sample: Shuffle]"}
Feb 23 19:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T19:21:43Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Alerting sample monitors check finished"}
Feb 23 19:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T19:21:43Z","tags":["info","healthcheck","server-api:connection-compatibility"],"pid":108553,"message":"Server API [default] version [5.0.0] is compatible with the dashboard version"}
Feb 23 19:22:48 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"response","@timestamp":"2026-02-23T19:22:48Z","tags":[],"pid":108553,"method":"get","statusCode":302,"req":{"url":"/","routePath":"/","method":"get","headers":{"host":"54.91.117.45","user-agent":"Go-http-client/1.1","accept-encoding":"gzip"},"remoteAddress":"54.255.201.10","userAgent":"Go-http-client/1.1"},"res":{"statusCode":302,"responseTime":4,"contentLength":9},"message":"GET / 302 4ms - 9.0B"}
Feb 23 19:22:48 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"response","@timestamp":"2026-02-23T19:22:48Z","tags":[],"pid":108553,"method":"get","statusCode":200,"req":{"url":"/app/login","routePath":"/app/login","method":"get","headers":{"host":"54.91.117.45","user-agent":"Go-http-client/1.1","referer":"https://54.91.117.45","accept-encoding":"gzip"},"remoteAddress":"54.255.201.10","userAgent":"Go-http-client/1.1","referer":"https://54.91.117.45"},"res":{"statusCode":200,"responseTime":20,"contentLength":9},"message":"GET /app/login 200 20ms - 9.0B"}

Service status

[root@ip-172-31-44-132 /home/ubuntu]# sudo journalctl -xe -u wazuh-dashboard.service --no-pager | head -n 150
Feb 23 14:06:12 ip-172-31-44-132 systemd[1]: Started wazuh-dashboard.
░░ Subject: A start job for unit wazuh-dashboard.service has finished successfully
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit wazuh-dashboard.service has finished successfully.
░░
░░ The job identifier is 20143.
Feb 23 14:06:34 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:34Z","tags":["info","plugins-service"],"pid":108553,"message":"Plugin \"applicationConfig\" is disabled."}
Feb 23 14:06:34 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:34Z","tags":["info","plugins-service"],"pid":108553,"message":"Plugin \"banner\" is disabled."}
Feb 23 14:06:34 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:34Z","tags":["info","plugins-service"],"pid":108553,"message":"Plugin \"chat\" is disabled."}
Feb 23 14:06:34 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:34Z","tags":["info","plugins-service"],"pid":108553,"message":"Plugin \"contextProvider\" is disabled."}
Feb 23 14:06:34 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:34Z","tags":["info","plugins-service"],"pid":108553,"message":"Plugin \"cspHandler\" is disabled."}
Feb 23 14:06:34 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:34Z","tags":["info","plugins-service"],"pid":108553,"message":"Plugin \"dataSource\" is disabled."}
Feb 23 14:06:34 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:34Z","tags":["info","plugins-service"],"pid":108553,"message":"Plugin \"dataImporter\" is disabled."}
Feb 23 14:06:34 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:34Z","tags":["info","plugins-service"],"pid":108553,"message":"Plugin \"datasetManagement\" is disabled."}
Feb 23 14:06:34 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:34Z","tags":["info","plugins-service"],"pid":108553,"message":"Plugin \"explore\" is disabled."}
Feb 23 14:06:34 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:34Z","tags":["info","plugins-service"],"pid":108553,"message":"Plugin \"visTypeXy\" is disabled."}
Feb 23 14:06:34 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:34Z","tags":["info","plugins-service"],"pid":108553,"message":"Plugin \"workspace\" is disabled."}
Feb 23 14:06:34 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:34Z","tags":["info","dynamic-config-service"],"pid":108553,"message":"registering middleware to inject context to AsyncLocalStorage"}
Feb 23 14:06:34 ip-172-31-44-132 opensearch-dashboards[108553]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:06:34 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:34Z","tags":["info","plugins-system"],"pid":108553,"message":"Setting up [52] plugins: [usageCollection,opensearchDashboardsUsageCollection,opensearchDashboardsLegacy,mapsLegacy,share,opensearchUiShared,embeddable,legacyExport,expressions,data,savedObjects,queryEnhancements,home,dashboard,visualizations,visTypeVega,visTypeTable,visTypeTimeline,visTypeMarkdown,visBuilder,visAugmenter,tileMap,regionMap,inputControlVis,visualize,apmOss,management,indexPatternManagement,dataSourceManagement,securityAnalyticsDashboards,reportsDashboards,customImportMapDashboards,indexManagementDashboards,anomalyDetectionDashboards,alertingDashboards,notificationsDashboards,console,advancedSettings,healtcheck,dataExplorer,charts,visTypeVislib,visTypeTimeseries,visTypeTagcloud,visTypeMetric,discover,savedObjectsManagement,securityDashboards,wazuhCore,wazuhCheckUpdates,wazuh,bfetch]"}
Feb 23 14:06:34 ip-172-31-44-132 opensearch-dashboards[108553]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:06:34 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:34Z","tags":["info","plugins","queryEnhancements"],"pid":108553,"message":"queryEnhancements: Setup complete"}
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:35Z","tags":["info","dynamic-config-service"],"pid":108553,"message":"initiating start()"}
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:35Z","tags":["info","dynamic-config-service"],"pid":108553,"message":"finished start()"}
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:35Z","tags":["info","savedobjects-service"],"pid":108553,"message":"Waiting until all OpenSearch nodes are compatible with OpenSearch Dashboards before starting saved objects migrations..."}
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:35Z","tags":["info","savedobjects-service"],"pid":108553,"message":"Starting saved objects migrations"}
Feb 23 14:06:35 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:35Z","tags":["info","savedobjects-service"],"pid":108553,"message":"Creating index .kibana_1."}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","savedobjects-service"],"pid":108553,"message":"Pointing alias .kibana to .kibana_1."}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","savedobjects-service"],"pid":108553,"message":"Finished in 230ms."}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["warning","cross-compatibility-service"],"pid":108553,"message":"Starting cross compatibility service"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck"],"pid":108553,"message":"Enabled checks [36]: [integrations:default-notifications-channels-and-alerting-monitors,server-api:connection-compatibility,server-api:run-as,saved-objects:dashboards,index-pattern:monitoring,index-pattern:statistics,index-pattern:states-vulnerabilities,index-pattern:states-inventory,index-pattern:states-inventory-groups,index-pattern:states-inventory-hardware,index-pattern:states-inventory-hotfixes,index-pattern:states-inventory-interfaces,index-pattern:states-inventory-networks,index-pattern:states-inventory-packages,index-pattern:states-inventory-ports,index-pattern:states-inventory-processes,index-pattern:states-inventory-protocols,index-pattern:states-inventory-system,index-pattern:states-inventory-users,index-pattern:states-inventory-services,index-pattern:states-inventory-browser-extensions,index-pattern:states-fim-files,index-pattern:states-fim-registry-keys,index-pattern:states-fim-registry-values,index-pattern:states-sca,index-pattern:events-system-activity,index-pattern:events-security,index-pattern:events-access-management,index-pattern:events-applications,index-pattern:events-other,index-pattern:events-network-activity,index-pattern:events-cloud-services,index-pattern:events-cloud-services-aws,index-pattern:events-cloud-services-azure,index-pattern:events-cloud-services-gcp,index-pattern:events]"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Starting verification of default notification channels"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","saved-objects:dashboards"],"pid":108553,"message":"Initializing/overwriting saved objects"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:monitoring"],"pid":108553,"message":"Index pattern with ID [wazuh-monitoring*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory-groups"],"pid":108553,"message":"Index pattern with ID [wazuh-states-inventory-groups*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory-networks"],"pid":108553,"message":"Index pattern with ID [wazuh-states-inventory-networks*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory-browser-extensions"],"pid":108553,"message":"Index pattern with ID [wazuh-states-inventory-browser-extensions*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory-protocols"],"pid":108553,"message":"Index pattern with ID [wazuh-states-inventory-protocols*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory-hardware"],"pid":108553,"message":"Index pattern with ID [wazuh-states-inventory-hardware*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:statistics"],"pid":108553,"message":"Index pattern with ID [wazuh-statistics*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory-packages"],"pid":108553,"message":"Index pattern with ID [wazuh-states-inventory-packages*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory-system"],"pid":108553,"message":"Index pattern with ID [wazuh-states-inventory-system*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-fim-files"],"pid":108553,"message":"Index pattern with ID [wazuh-states-fim-files*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory-processes"],"pid":108553,"message":"Index pattern with ID [wazuh-states-inventory-processes*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory"],"pid":108553,"message":"Index pattern with ID [wazuh-states-inventory*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-sca"],"pid":108553,"message":"Index pattern with ID [wazuh-states-sca*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory-services"],"pid":108553,"message":"Index pattern with ID [wazuh-states-inventory-services*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory-hotfixes"],"pid":108553,"message":"Index pattern with ID [wazuh-states-inventory-hotfixes*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-fim-registry-keys"],"pid":108553,"message":"Index pattern with ID [wazuh-states-fim-registry-keys*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory-ports"],"pid":108553,"message":"Index pattern with ID [wazuh-states-inventory-ports*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-vulnerabilities"],"pid":108553,"message":"Index pattern with ID [wazuh-states-vulnerabilities*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:events-system-activity"],"pid":108553,"message":"Index pattern with ID [wazuh-events-v5-system-activity*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory-users"],"pid":108553,"message":"Index pattern with ID [wazuh-states-inventory-users*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-fim-registry-values"],"pid":108553,"message":"Index pattern with ID [wazuh-states-fim-registry-values*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory-interfaces"],"pid":108553,"message":"Index pattern with ID [wazuh-states-inventory-interfaces*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:events-security"],"pid":108553,"message":"Index pattern with ID [wazuh-events-v5-security*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:events-applications"],"pid":108553,"message":"Index pattern with ID [wazuh-events-v5-applications*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:events-other"],"pid":108553,"message":"Index pattern with ID [wazuh-events-v5-other*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:events-network-activity"],"pid":108553,"message":"Index pattern with ID [wazuh-events-v5-network-activity*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:events-access-management"],"pid":108553,"message":"Index pattern with ID [wazuh-events-v5-access-management*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:events-cloud-services"],"pid":108553,"message":"Index pattern with ID [wazuh-events-v5-cloud-services*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:events"],"pid":108553,"message":"Index pattern with ID [wazuh-events*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:events-cloud-services-aws"],"pid":108553,"message":"Index pattern with ID [wazuh-events-v5-cloud-services-aws*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:events-cloud-services-azure"],"pid":108553,"message":"Index pattern with ID [wazuh-events-v5-cloud-services-azure*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:events-cloud-services-gcp"],"pid":108553,"message":"Index pattern with ID [wazuh-events-v5-cloud-services-gcp*] does not exist"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:monitoring"],"pid":108553,"message":"Created index pattern with ID [wazuh-monitoring*] title [wazuh-monitoring*]"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory-groups"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-inventory-groups*] title [wazuh-states-inventory-groups*]"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory-networks"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-inventory-networks*] title [wazuh-states-inventory-networks*]"}
Feb 23 14:06:36 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:36Z","tags":["info","healthcheck","index-pattern:states-inventory-protocols"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-inventory-protocols*] title [wazuh-states-inventory-protocols*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:states-inventory-system"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-inventory-system*] title [wazuh-states-inventory-system*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:statistics"],"pid":108553,"message":"Created index pattern with ID [wazuh-statistics*] title [wazuh-statistics*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:states-inventory-processes"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-inventory-processes*] title [wazuh-states-inventory-processes*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:states-fim-files"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-fim-files*] title [wazuh-states-fim-files*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:states-inventory-hardware"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-inventory-hardware*] title [wazuh-states-inventory-hardware*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:states-sca"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-sca*] title [wazuh-states-sca*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:states-inventory-hotfixes"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-inventory-hotfixes*] title [wazuh-states-inventory-hotfixes*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:states-inventory-packages"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-inventory-packages*] title [wazuh-states-inventory-packages*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:states-inventory-services"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-inventory-services*] title [wazuh-states-inventory-services*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:states-inventory"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-inventory*] title [wazuh-states-inventory*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:states-inventory-ports"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-inventory-ports*] title [wazuh-states-inventory-ports*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:states-inventory-browser-extensions"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-inventory-browser-extensions*] title [wazuh-states-inventory-browser-extensions*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:states-fim-registry-keys"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-fim-registry-keys*] title [wazuh-states-fim-registry-keys*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"No existing Wazuh default notification channels found"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:states-vulnerabilities"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-vulnerabilities*] title [wazuh-states-vulnerabilities*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:states-fim-registry-values"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-fim-registry-values*] title [wazuh-states-fim-registry-values*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:states-inventory-users"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-inventory-users*] title [wazuh-states-inventory-users*]"}
Feb 23 14:06:37 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:37Z","tags":["info","healthcheck","index-pattern:states-inventory-interfaces"],"pid":108553,"message":"Created index pattern with ID [wazuh-states-inventory-interfaces*] title [wazuh-states-inventory-interfaces*]"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","index-pattern:events-cloud-services-gcp"],"pid":108553,"message":"Created index pattern with ID [wazuh-events-v5-cloud-services-gcp*] title [wazuh-events-v5-cloud-services-gcp*]"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","index-pattern:events-access-management"],"pid":108553,"message":"Created index pattern with ID [wazuh-events-v5-access-management*] title [wazuh-events-v5-access-management*]"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","index-pattern:events-system-activity"],"pid":108553,"message":"Created index pattern with ID [wazuh-events-v5-system-activity*] title [wazuh-events-v5-system-activity*]"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","index-pattern:events-other"],"pid":108553,"message":"Created index pattern with ID [wazuh-events-v5-other*] title [wazuh-events-v5-other*]"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","index-pattern:events-applications"],"pid":108553,"message":"Created index pattern with ID [wazuh-events-v5-applications*] title [wazuh-events-v5-applications*]"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","index-pattern:events-security"],"pid":108553,"message":"Created index pattern with ID [wazuh-events-v5-security*] title [wazuh-events-v5-security*]"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Created 4 notification channels: Slack Channel, Jira Channel, PagerDuty Channel, Shuffle Channel"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"All default notification channels are now present and verified"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Starting Alerting sample monitors check"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","server-api:connection-compatibility"],"pid":108553,"message":"Server API [default] version [5.0.0] is compatible with the dashboard version"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["warning","healthcheck","server-api:run-as"],"pid":108553,"message":"Some server API hosts have not enabled the run_as or the user has no the ability to use it or both are not enabled: default (Run as disabled in host). Ensure every configured API host allows run_as for the API user."}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["error","healthcheck","server-api:run-as"],"pid":108553,"message":"Error checking server API allow_run_as: Some server API hosts have not enabled the run_as or the user has no the ability to use it or both are not enabled: default (Run as disabled in host). Ensure every configured API host allows run_as for the API user."}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["error","healthcheck","server-api:run-as"],"pid":108553,"message":"Error running task [server-api:run-as]: Error checking server API allow_run_as: Some server API hosts have not enabled the run_as or the user has no the ability to use it or both are not enabled: default (Run as disabled in host). Ensure every configured API host allows run_as for the API user."}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","index-pattern:events-cloud-services"],"pid":108553,"message":"Created index pattern with ID [wazuh-events-v5-cloud-services*] title [wazuh-events-v5-cloud-services*]"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","index-pattern:events-cloud-services-azure"],"pid":108553,"message":"Created index pattern with ID [wazuh-events-v5-cloud-services-azure*] title [wazuh-events-v5-cloud-services-azure*]"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Created sample monitor [Sample: Slack]"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","index-pattern:events-cloud-services-aws"],"pid":108553,"message":"Created index pattern with ID [wazuh-events-v5-cloud-services-aws*] title [wazuh-events-v5-cloud-services-aws*]"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","index-pattern:events-network-activity"],"pid":108553,"message":"Created index pattern with ID [wazuh-events-v5-network-activity*] title [wazuh-events-v5-network-activity*]"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","index-pattern:events"],"pid":108553,"message":"Created index pattern with ID [wazuh-events*] title [wazuh-events*]"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","index-pattern:events"],"pid":108553,"message":"Setting default index pattern to [wazuh-events*] from health check initialization task"}
Feb 23 14:06:38 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:38Z","tags":["info","healthcheck","index-pattern:events"],"pid":108553,"message":"Default index pattern set to [wazuh-events*]"}
Feb 23 14:06:39 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:39Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Created sample monitor [Sample: PagerDuty]"}
Feb 23 14:06:40 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:40Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Created sample monitor [Sample: Jira]"}
Feb 23 14:06:41 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:41Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Created sample monitor [Sample: Shuffle]"}
Feb 23 14:06:41 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:41Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Alerting sample monitors check finished"}
Feb 23 14:06:42 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:42Z","tags":["info","healthcheck"],"pid":108553,"message":"Checks are ok"}
Feb 23 14:06:42 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:42Z","tags":["info","healthcheck"],"pid":108553,"message":"Set scheduled checks each 900000ms"}
Feb 23 14:06:42 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:42Z","tags":["info","plugins-system"],"pid":108553,"message":"Starting [52] plugins: [usageCollection,opensearchDashboardsUsageCollection,opensearchDashboardsLegacy,mapsLegacy,share,opensearchUiShared,embeddable,legacyExport,expressions,data,savedObjects,queryEnhancements,home,dashboard,visualizations,visTypeVega,visTypeTable,visTypeTimeline,visTypeMarkdown,visBuilder,visAugmenter,tileMap,regionMap,inputControlVis,visualize,apmOss,management,indexPatternManagement,dataSourceManagement,securityAnalyticsDashboards,reportsDashboards,customImportMapDashboards,indexManagementDashboards,anomalyDetectionDashboards,alertingDashboards,notificationsDashboards,console,advancedSettings,healtcheck,dataExplorer,charts,visTypeVislib,visTypeTimeseries,visTypeTagcloud,visTypeMetric,discover,savedObjectsManagement,securityDashboards,wazuhCore,wazuhCheckUpdates,wazuh,bfetch]"}
Feb 23 14:06:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:43Z","tags":["info","plugins","wazuh","initialize"],"pid":108553,"message":"dashboard index: .kibana"}
Feb 23 14:06:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:43Z","tags":["info","plugins","wazuh","initialize"],"pid":108553,"message":"App revision: 00"}
Feb 23 14:06:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:43Z","tags":["info","plugins","wazuh","initialize"],"pid":108553,"message":"Total RAM: 7769MB"}
Feb 23 14:06:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:43Z","tags":["listening","info"],"pid":108553,"message":"Server running at https://0.0.0.0:443"}
Feb 23 14:06:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:06:43Z","tags":["info","http","server","OpenSearchDashboards"],"pid":108553,"message":"http server running at https://0.0.0.0:443"}
Feb 23 14:21:42 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:21:42Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Starting verification of default notification channels"}
Feb 23 14:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:21:42Z","tags":["info","healthcheck","saved-objects:dashboards"],"pid":108553,"message":"Initializing missing saved objects"}
Feb 23 14:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:21:43Z","tags":["warning","healthcheck","server-api:run-as"],"pid":108553,"message":"Some server API hosts have not enabled the run_as or the user has no the ability to use it or both are not enabled: default (Run as disabled in host). Ensure every configured API host allows run_as for the API user."}
Feb 23 14:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:21:43Z","tags":["error","healthcheck","server-api:run-as"],"pid":108553,"message":"Error checking server API allow_run_as: Some server API hosts have not enabled the run_as or the user has no the ability to use it or both are not enabled: default (Run as disabled in host). Ensure every configured API host allows run_as for the API user."}
Feb 23 14:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:21:43Z","tags":["error","healthcheck","server-api:run-as"],"pid":108553,"message":"Error running task [server-api:run-as]: Error checking server API allow_run_as: Some server API hosts have not enabled the run_as or the user has no the ability to use it or both are not enabled: default (Run as disabled in host). Ensure every configured API host allows run_as for the API user."}
Feb 23 14:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:21:43Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"All default notification channels are now present and verified"}
Feb 23 14:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:21:43Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Starting Alerting sample monitors check"}
Feb 23 14:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:21:43Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Monitor already exists [Sample: Slack]"}
Feb 23 14:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:21:43Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Monitor already exists [Sample: PagerDuty]"}
Feb 23 14:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:21:43Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Monitor already exists [Sample: Jira]"}
Feb 23 14:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:21:43Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Monitor already exists [Sample: Shuffle]"}
Feb 23 14:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:21:43Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Alerting sample monitors check finished"}
Feb 23 14:21:43 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:21:43Z","tags":["info","healthcheck","server-api:connection-compatibility"],"pid":108553,"message":"Server API [default] version [5.0.0] is compatible with the dashboard version"}
Feb 23 14:36:42 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:36:42Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":108553,"message":"Starting verification of default notification channels"}
Feb 23 14:36:42 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:36:42Z","tags":["info","healthcheck","saved-objects:dashboards"],"pid":108553,"message":"Initializing missing saved objects"}
Feb 23 14:36:42 ip-172-31-44-132 opensearch-dashboards[108553]: {"type":"log","@timestamp":"2026-02-23T14:36:42Z","tags":["warning","healthcheck","server-api:run-as"],"pid":108553,"message":"Some server API hosts have not enabled the run_as or the user has no the ability to use it or both are not enabled: default (Run as disabled in host). Ensure every configured API host allows run_as for the API user."}

Ubuntu 22 AMD

Wazuh dashboard status

[root@ip-172-31-45-215 /home/ubuntu]# sudo systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
     Loaded: loaded (/lib/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2026-02-23 14:09:21 UTC; 5h 21min ago
   Main PID: 114932 (node)
      Tasks: 11 (limit: 9398)
     Memory: 197.5M
        CPU: 36.227s
     CGroup: /system.slice/wazuh-dashboard.service
             └─114932 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist

Feb 23 19:24:44 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T19:24:44Z","tags":["error","healthcheck","server-api:run-as"],"pid":114932,"message":"Error checking server API allow_run_as: Some server API hosts have not enabled the run_as or the user has no the ability to use it or both are not enabled: default (Run as disabled in host). Ensure every configured API host allows run_as for the API user."}
Feb 23 19:24:44 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T19:24:44Z","tags":["error","healthcheck","server-api:run-as"],"pid":114932,"message":"Error running task [server-api:run-as]: Error checking server API allow_run_as: Some server API hosts have not enabled the run_as or the user has no the ability to use it or both are not enabled: default (Run as disabled in host). Ensure every configured API host allows run_as for the API user."}
Feb 23 19:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T19:24:45Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"All default notification channels are now present and verified"}
Feb 23 19:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T19:24:45Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Starting Alerting sample monitors check"}
Feb 23 19:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T19:24:45Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Monitor already exists [Sample: Slack]"}
Feb 23 19:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T19:24:45Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Monitor already exists [Sample: PagerDuty]"}
Feb 23 19:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T19:24:45Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Monitor already exists [Sample: Jira]"}
Feb 23 19:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T19:24:45Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Monitor already exists [Sample: Shuffle]"}
Feb 23 19:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T19:24:45Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Alerting sample monitors check finished"}
Feb 23 19:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T19:24:45Z","tags":["info","healthcheck","server-api:connection-compatibility"],"pid":114932,"message":"Server API [default] version [5.0.0] is compatible with the dashboard version"}

Service status

[root@ip-172-31-45-215 /home/ubuntu]# sudo journalctl -xe -u wazuh-dashboard.service --no-pager | head -n 150
Feb 23 14:09:21 ip-172-31-45-215 systemd[1]: Started wazuh-dashboard.
░░ Subject: A start job for unit wazuh-dashboard.service has finished successfully
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit wazuh-dashboard.service has finished successfully.
░░
░░ The job identifier is 21357.
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:36Z","tags":["info","plugins-service"],"pid":114932,"message":"Plugin \"applicationConfig\" is disabled."}
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:36Z","tags":["info","plugins-service"],"pid":114932,"message":"Plugin \"banner\" is disabled."}
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:36Z","tags":["info","plugins-service"],"pid":114932,"message":"Plugin \"chat\" is disabled."}
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:36Z","tags":["info","plugins-service"],"pid":114932,"message":"Plugin \"cspHandler\" is disabled."}
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:36Z","tags":["info","plugins-service"],"pid":114932,"message":"Plugin \"contextProvider\" is disabled."}
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:36Z","tags":["info","plugins-service"],"pid":114932,"message":"Plugin \"dataSource\" is disabled."}
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:36Z","tags":["info","plugins-service"],"pid":114932,"message":"Plugin \"dataImporter\" is disabled."}
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:36Z","tags":["info","plugins-service"],"pid":114932,"message":"Plugin \"datasetManagement\" is disabled."}
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:36Z","tags":["info","plugins-service"],"pid":114932,"message":"Plugin \"explore\" is disabled."}
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:36Z","tags":["info","plugins-service"],"pid":114932,"message":"Plugin \"visTypeXy\" is disabled."}
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:36Z","tags":["info","plugins-service"],"pid":114932,"message":"Plugin \"workspace\" is disabled."}
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:36Z","tags":["info","dynamic-config-service"],"pid":114932,"message":"registering middleware to inject context to AsyncLocalStorage"}
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:36Z","tags":["info","plugins-system"],"pid":114932,"message":"Setting up [52] plugins: [usageCollection,opensearchDashboardsUsageCollection,opensearchDashboardsLegacy,mapsLegacy,share,opensearchUiShared,legacyExport,embeddable,expressions,data,savedObjects,queryEnhancements,home,dashboard,visualizations,visTypeVega,visTypeTimeline,visTypeTable,visTypeMarkdown,visAugmenter,visBuilder,tileMap,regionMap,inputControlVis,visualize,apmOss,management,indexPatternManagement,dataSourceManagement,reportsDashboards,securityAnalyticsDashboards,indexManagementDashboards,customImportMapDashboards,anomalyDetectionDashboards,alertingDashboards,notificationsDashboards,console,advancedSettings,healtcheck,dataExplorer,bfetch,charts,visTypeVislib,visTypeTimeseries,visTypeTagcloud,visTypeMetric,discover,savedObjectsManagement,securityDashboards,wazuhCore,wazuhCheckUpdates,wazuh]"}
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:36Z","tags":["info","plugins","queryEnhancements"],"pid":114932,"message":"queryEnhancements: Setup complete"}
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:09:36 ip-172-31-45-215 opensearch-dashboards[114932]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:09:37 ip-172-31-45-215 opensearch-dashboards[114932]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:09:37 ip-172-31-45-215 opensearch-dashboards[114932]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:09:37 ip-172-31-45-215 opensearch-dashboards[114932]: [agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead
Feb 23 14:09:37 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:37Z","tags":["info","dynamic-config-service"],"pid":114932,"message":"initiating start()"}
Feb 23 14:09:37 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:37Z","tags":["info","dynamic-config-service"],"pid":114932,"message":"finished start()"}
Feb 23 14:09:37 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:37Z","tags":["info","savedobjects-service"],"pid":114932,"message":"Waiting until all OpenSearch nodes are compatible with OpenSearch Dashboards before starting saved objects migrations..."}
Feb 23 14:09:37 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:37Z","tags":["info","savedobjects-service"],"pid":114932,"message":"Starting saved objects migrations"}
Feb 23 14:09:37 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:37Z","tags":["info","savedobjects-service"],"pid":114932,"message":"Creating index .kibana_1."}
Feb 23 14:09:37 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:37Z","tags":["info","savedobjects-service"],"pid":114932,"message":"Pointing alias .kibana to .kibana_1."}
Feb 23 14:09:37 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:37Z","tags":["info","savedobjects-service"],"pid":114932,"message":"Finished in 294ms."}
Feb 23 14:09:37 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:37Z","tags":["warning","cross-compatibility-service"],"pid":114932,"message":"Starting cross compatibility service"}
Feb 23 14:09:37 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:37Z","tags":["info","healthcheck"],"pid":114932,"message":"Enabled checks [36]: [integrations:default-notifications-channels-and-alerting-monitors,server-api:connection-compatibility,server-api:run-as,saved-objects:dashboards,index-pattern:monitoring,index-pattern:statistics,index-pattern:states-vulnerabilities,index-pattern:states-inventory,index-pattern:states-inventory-groups,index-pattern:states-inventory-hardware,index-pattern:states-inventory-hotfixes,index-pattern:states-inventory-interfaces,index-pattern:states-inventory-networks,index-pattern:states-inventory-packages,index-pattern:states-inventory-ports,index-pattern:states-inventory-processes,index-pattern:states-inventory-protocols,index-pattern:states-inventory-system,index-pattern:states-inventory-users,index-pattern:states-inventory-services,index-pattern:states-inventory-browser-extensions,index-pattern:states-fim-files,index-pattern:states-fim-registry-keys,index-pattern:states-fim-registry-values,index-pattern:states-sca,index-pattern:events-system-activity,index-pattern:events-security,index-pattern:events-access-management,index-pattern:events-applications,index-pattern:events-other,index-pattern:events-network-activity,index-pattern:events-cloud-services,index-pattern:events-cloud-services-aws,index-pattern:events-cloud-services-azure,index-pattern:events-cloud-services-gcp,index-pattern:events]"}
Feb 23 14:09:37 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:37Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Starting verification of default notification channels"}
Feb 23 14:09:37 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:37Z","tags":["info","healthcheck","saved-objects:dashboards"],"pid":114932,"message":"Initializing/overwriting saved objects"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-inventory-services"],"pid":114932,"message":"Index pattern with ID [wazuh-states-inventory-services*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:events"],"pid":114932,"message":"Index pattern with ID [wazuh-events*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:statistics"],"pid":114932,"message":"Index pattern with ID [wazuh-statistics*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-inventory-packages"],"pid":114932,"message":"Index pattern with ID [wazuh-states-inventory-packages*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-fim-files"],"pid":114932,"message":"Index pattern with ID [wazuh-states-fim-files*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:events-system-activity"],"pid":114932,"message":"Index pattern with ID [wazuh-events-v5-system-activity*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:events-cloud-services-azure"],"pid":114932,"message":"Index pattern with ID [wazuh-events-v5-cloud-services-azure*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-inventory-system"],"pid":114932,"message":"Index pattern with ID [wazuh-states-inventory-system*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:events-other"],"pid":114932,"message":"Index pattern with ID [wazuh-events-v5-other*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-inventory-ports"],"pid":114932,"message":"Index pattern with ID [wazuh-states-inventory-ports*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-inventory-processes"],"pid":114932,"message":"Index pattern with ID [wazuh-states-inventory-processes*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:events-cloud-services"],"pid":114932,"message":"Index pattern with ID [wazuh-events-v5-cloud-services*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:events-access-management"],"pid":114932,"message":"Index pattern with ID [wazuh-events-v5-access-management*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-inventory"],"pid":114932,"message":"Index pattern with ID [wazuh-states-inventory*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-inventory-interfaces"],"pid":114932,"message":"Index pattern with ID [wazuh-states-inventory-interfaces*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:events-network-activity"],"pid":114932,"message":"Index pattern with ID [wazuh-events-v5-network-activity*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-inventory-hardware"],"pid":114932,"message":"Index pattern with ID [wazuh-states-inventory-hardware*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:events-cloud-services-gcp"],"pid":114932,"message":"Index pattern with ID [wazuh-events-v5-cloud-services-gcp*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-fim-registry-keys"],"pid":114932,"message":"Index pattern with ID [wazuh-states-fim-registry-keys*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-inventory-users"],"pid":114932,"message":"Index pattern with ID [wazuh-states-inventory-users*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:events-security"],"pid":114932,"message":"Index pattern with ID [wazuh-events-v5-security*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-vulnerabilities"],"pid":114932,"message":"Index pattern with ID [wazuh-states-vulnerabilities*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-fim-registry-values"],"pid":114932,"message":"Index pattern with ID [wazuh-states-fim-registry-values*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-inventory-hotfixes"],"pid":114932,"message":"Index pattern with ID [wazuh-states-inventory-hotfixes*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:monitoring"],"pid":114932,"message":"Index pattern with ID [wazuh-monitoring*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-inventory-browser-extensions"],"pid":114932,"message":"Index pattern with ID [wazuh-states-inventory-browser-extensions*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-sca"],"pid":114932,"message":"Index pattern with ID [wazuh-states-sca*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-inventory-networks"],"pid":114932,"message":"Index pattern with ID [wazuh-states-inventory-networks*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:events-cloud-services-aws"],"pid":114932,"message":"Index pattern with ID [wazuh-events-v5-cloud-services-aws*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:events-applications"],"pid":114932,"message":"Index pattern with ID [wazuh-events-v5-applications*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-inventory-groups"],"pid":114932,"message":"Index pattern with ID [wazuh-states-inventory-groups*] does not exist"}
Feb 23 14:09:38 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:38Z","tags":["info","healthcheck","index-pattern:states-inventory-protocols"],"pid":114932,"message":"Index pattern with ID [wazuh-states-inventory-protocols*] does not exist"}
Feb 23 14:09:39 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:39Z","tags":["info","healthcheck","index-pattern:states-inventory-services"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-inventory-services*] title [wazuh-states-inventory-services*]"}
Feb 23 14:09:39 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:39Z","tags":["info","healthcheck","index-pattern:statistics"],"pid":114932,"message":"Created index pattern with ID [wazuh-statistics*] title [wazuh-statistics*]"}
Feb 23 14:09:39 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:39Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"No existing Wazuh default notification channels found"}
Feb 23 14:09:39 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:39Z","tags":["info","healthcheck","index-pattern:states-fim-files"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-fim-files*] title [wazuh-states-fim-files*]"}
Feb 23 14:09:39 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:39Z","tags":["info","healthcheck","index-pattern:states-inventory-processes"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-inventory-processes*] title [wazuh-states-inventory-processes*]"}
Feb 23 14:09:39 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:39Z","tags":["info","healthcheck","index-pattern:states-inventory-ports"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-inventory-ports*] title [wazuh-states-inventory-ports*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:states-inventory-interfaces"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-inventory-interfaces*] title [wazuh-states-inventory-interfaces*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:states-inventory-browser-extensions"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-inventory-browser-extensions*] title [wazuh-states-inventory-browser-extensions*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Created 4 notification channels: Slack Channel, Jira Channel, PagerDuty Channel, Shuffle Channel"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"All default notification channels are now present and verified"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Starting Alerting sample monitors check"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:states-inventory-hardware"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-inventory-hardware*] title [wazuh-states-inventory-hardware*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:states-fim-registry-keys"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-fim-registry-keys*] title [wazuh-states-fim-registry-keys*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:monitoring"],"pid":114932,"message":"Created index pattern with ID [wazuh-monitoring*] title [wazuh-monitoring*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:states-inventory"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-inventory*] title [wazuh-states-inventory*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:states-inventory-packages"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-inventory-packages*] title [wazuh-states-inventory-packages*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:events"],"pid":114932,"message":"Created index pattern with ID [wazuh-events*] title [wazuh-events*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","server-api:connection-compatibility"],"pid":114932,"message":"Server API [default] version [5.0.0] is compatible with the dashboard version"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:states-inventory-system"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-inventory-system*] title [wazuh-states-inventory-system*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:states-vulnerabilities"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-vulnerabilities*] title [wazuh-states-vulnerabilities*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:states-fim-registry-values"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-fim-registry-values*] title [wazuh-states-fim-registry-values*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:events-access-management"],"pid":114932,"message":"Created index pattern with ID [wazuh-events-v5-access-management*] title [wazuh-events-v5-access-management*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:events-other"],"pid":114932,"message":"Created index pattern with ID [wazuh-events-v5-other*] title [wazuh-events-v5-other*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:events-cloud-services-azure"],"pid":114932,"message":"Created index pattern with ID [wazuh-events-v5-cloud-services-azure*] title [wazuh-events-v5-cloud-services-azure*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Created sample monitor [Sample: Slack]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["warning","healthcheck","server-api:run-as"],"pid":114932,"message":"Some server API hosts have not enabled the run_as or the user has no the ability to use it or both are not enabled: default (Run as disabled in host). Ensure every configured API host allows run_as for the API user."}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["error","healthcheck","server-api:run-as"],"pid":114932,"message":"Error checking server API allow_run_as: Some server API hosts have not enabled the run_as or the user has no the ability to use it or both are not enabled: default (Run as disabled in host). Ensure every configured API host allows run_as for the API user."}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["error","healthcheck","server-api:run-as"],"pid":114932,"message":"Error running task [server-api:run-as]: Error checking server API allow_run_as: Some server API hosts have not enabled the run_as or the user has no the ability to use it or both are not enabled: default (Run as disabled in host). Ensure every configured API host allows run_as for the API user."}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:states-inventory-users"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-inventory-users*] title [wazuh-states-inventory-users*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:events-system-activity"],"pid":114932,"message":"Created index pattern with ID [wazuh-events-v5-system-activity*] title [wazuh-events-v5-system-activity*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:events-security"],"pid":114932,"message":"Created index pattern with ID [wazuh-events-v5-security*] title [wazuh-events-v5-security*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:states-sca"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-sca*] title [wazuh-states-sca*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:states-inventory-hotfixes"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-inventory-hotfixes*] title [wazuh-states-inventory-hotfixes*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:states-inventory-networks"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-inventory-networks*] title [wazuh-states-inventory-networks*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:states-inventory-groups"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-inventory-groups*] title [wazuh-states-inventory-groups*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:states-inventory-protocols"],"pid":114932,"message":"Created index pattern with ID [wazuh-states-inventory-protocols*] title [wazuh-states-inventory-protocols*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:events-network-activity"],"pid":114932,"message":"Created index pattern with ID [wazuh-events-v5-network-activity*] title [wazuh-events-v5-network-activity*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:events-cloud-services"],"pid":114932,"message":"Created index pattern with ID [wazuh-events-v5-cloud-services*] title [wazuh-events-v5-cloud-services*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:events-cloud-services-gcp"],"pid":114932,"message":"Created index pattern with ID [wazuh-events-v5-cloud-services-gcp*] title [wazuh-events-v5-cloud-services-gcp*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:events-applications"],"pid":114932,"message":"Created index pattern with ID [wazuh-events-v5-applications*] title [wazuh-events-v5-applications*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:events-cloud-services-aws"],"pid":114932,"message":"Created index pattern with ID [wazuh-events-v5-cloud-services-aws*] title [wazuh-events-v5-cloud-services-aws*]"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:events"],"pid":114932,"message":"Setting default index pattern to [wazuh-events*] from health check initialization task"}
Feb 23 14:09:40 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:40Z","tags":["info","healthcheck","index-pattern:events"],"pid":114932,"message":"Default index pattern set to [wazuh-events*]"}
Feb 23 14:09:41 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:41Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Created sample monitor [Sample: PagerDuty]"}
Feb 23 14:09:42 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:42Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Created sample monitor [Sample: Jira]"}
Feb 23 14:09:43 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:43Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Created sample monitor [Sample: Shuffle]"}
Feb 23 14:09:43 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:43Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Alerting sample monitors check finished"}
Feb 23 14:09:44 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:44Z","tags":["info","healthcheck"],"pid":114932,"message":"Checks are ok"}
Feb 23 14:09:44 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:44Z","tags":["info","healthcheck"],"pid":114932,"message":"Set scheduled checks each 900000ms"}
Feb 23 14:09:44 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:44Z","tags":["info","plugins-system"],"pid":114932,"message":"Starting [52] plugins: [usageCollection,opensearchDashboardsUsageCollection,opensearchDashboardsLegacy,mapsLegacy,share,opensearchUiShared,legacyExport,embeddable,expressions,data,savedObjects,queryEnhancements,home,dashboard,visualizations,visTypeVega,visTypeTimeline,visTypeTable,visTypeMarkdown,visAugmenter,visBuilder,tileMap,regionMap,inputControlVis,visualize,apmOss,management,indexPatternManagement,dataSourceManagement,reportsDashboards,securityAnalyticsDashboards,indexManagementDashboards,customImportMapDashboards,anomalyDetectionDashboards,alertingDashboards,notificationsDashboards,console,advancedSettings,healtcheck,dataExplorer,bfetch,charts,visTypeVislib,visTypeTimeseries,visTypeTagcloud,visTypeMetric,discover,savedObjectsManagement,securityDashboards,wazuhCore,wazuhCheckUpdates,wazuh]"}
Feb 23 14:09:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:45Z","tags":["info","plugins","wazuh","initialize"],"pid":114932,"message":"dashboard index: .kibana"}
Feb 23 14:09:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:45Z","tags":["info","plugins","wazuh","initialize"],"pid":114932,"message":"App revision: 00"}
Feb 23 14:09:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:45Z","tags":["info","plugins","wazuh","initialize"],"pid":114932,"message":"Total RAM: 7848MB"}
Feb 23 14:09:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:45Z","tags":["listening","info"],"pid":114932,"message":"Server running at https://0.0.0.0:443"}
Feb 23 14:09:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:09:45Z","tags":["info","http","server","OpenSearchDashboards"],"pid":114932,"message":"http server running at https://0.0.0.0:443"}
Feb 23 14:24:44 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:24:44Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Starting verification of default notification channels"}
Feb 23 14:24:44 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:24:44Z","tags":["info","healthcheck","saved-objects:dashboards"],"pid":114932,"message":"Initializing missing saved objects"}
Feb 23 14:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:24:45Z","tags":["warning","healthcheck","server-api:run-as"],"pid":114932,"message":"Some server API hosts have not enabled the run_as or the user has no the ability to use it or both are not enabled: default (Run as disabled in host). Ensure every configured API host allows run_as for the API user."}
Feb 23 14:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:24:45Z","tags":["error","healthcheck","server-api:run-as"],"pid":114932,"message":"Error checking server API allow_run_as: Some server API hosts have not enabled the run_as or the user has no the ability to use it or both are not enabled: default (Run as disabled in host). Ensure every configured API host allows run_as for the API user."}
Feb 23 14:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:24:45Z","tags":["error","healthcheck","server-api:run-as"],"pid":114932,"message":"Error running task [server-api:run-as]: Error checking server API allow_run_as: Some server API hosts have not enabled the run_as or the user has no the ability to use it or both are not enabled: default (Run as disabled in host). Ensure every configured API host allows run_as for the API user."}
Feb 23 14:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:24:45Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"All default notification channels are now present and verified"}
Feb 23 14:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:24:45Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Starting Alerting sample monitors check"}
Feb 23 14:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:24:45Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Monitor already exists [Sample: Slack]"}
Feb 23 14:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:24:45Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Monitor already exists [Sample: PagerDuty]"}
Feb 23 14:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:24:45Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Monitor already exists [Sample: Jira]"}
Feb 23 14:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:24:45Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Monitor already exists [Sample: Shuffle]"}
Feb 23 14:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:24:45Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Alerting sample monitors check finished"}
Feb 23 14:24:45 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:24:45Z","tags":["info","healthcheck","server-api:connection-compatibility"],"pid":114932,"message":"Server API [default] version [5.0.0] is compatible with the dashboard version"}
Feb 23 14:38:44 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"error","@timestamp":"2026-02-23T14:38:44Z","tags":["connection","client","error"],"pid":114932,"level":"error","error":{"message":"40C805A2AF7F0000:error:0A000076:SSL routines:tls_choose_sigalg:no suitable signature algorithm:../deps/openssl/openssl/ssl/t1_lib.c:3340:\n","name":"Error","stack":"Error: 40C805A2AF7F0000:error:0A000076:SSL routines:tls_choose_sigalg:no suitable signature algorithm:../deps/openssl/openssl/ssl/t1_lib.c:3340:\n","code":"ERR_SSL_NO_SUITABLE_SIGNATURE_ALGORITHM"},"message":"40C805A2AF7F0000:error:0A000076:SSL routines:tls_choose_sigalg:no suitable signature algorithm:../deps/openssl/openssl/ssl/t1_lib.c:3340:\n"}
Feb 23 14:39:44 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:39:44Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":114932,"message":"Starting verification of default notification channels"}
Feb 23 14:39:44 ip-172-31-45-215 opensearch-dashboards[114932]: {"type":"log","@timestamp":"2026-02-23T14:39:44Z","tags":["info","healthcheck","saved-objects:dashboards"],"pid":114932,"message":"Initializing missing saved objects"}

Wazuh Manager Online

Ubuntu 22 ARM

Wazuh manager status

[root@ip-172-31-44-132 /home/ubuntu]# sudo systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
     Loaded: loaded (/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2026-02-23 14:03:03 UTC; 5h 28min ago
      Tasks: 163 (limit: 9308)
     Memory: 1.7G
        CPU: 15min 332ms
     CGroup: /system.slice/wazuh-manager.service
             ├─107509 /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/api/scripts/wazuh_manager_apid.py
             ├─107524 /var/wazuh-manager/bin/wazuh-manager-authd
             ├─107534 /var/wazuh-manager/bin/wazuh-manager-db
             ├─107551 /var/wazuh-manager/bin/wazuh-manager-analysisd
             ├─107718 /var/wazuh-manager/bin/wazuh-manager-remoted
             ├─107749 /var/wazuh-manager/bin/wazuh-manager-monitord
             ├─107754 /var/wazuh-manager/bin/wazuh-manager-modulesd
             ├─107878 /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/api/scripts/wazuh_manager_apid.py
             ├─107879 /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/api/scripts/wazuh_manager_apid.py
             ├─107882 /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/api/scripts/wazuh_manager_apid.py
             ├─107886 /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/api/scripts/wazuh_manager_apid.py
             ├─107907 /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/framework/scripts/wazuh_manager_clusterd.py
             ├─107957 /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/framework/scripts/wazuh_manager_clusterd.py
             └─107958 /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/framework/scripts/wazuh_manager_clusterd.py

Feb 23 14:03:00 ip-172-31-44-132 env[107414]: Started wazuh-manager-analysisd...
Feb 23 14:03:00 ip-172-31-44-132 env[107414]: Started wazuh-manager-remoted...
Feb 23 14:03:00 ip-172-31-44-132 env[107414]: Started wazuh-manager-monitord...
Feb 23 14:03:00 ip-172-31-44-132 env[107752]: 2026/02/23 14:03:00 wazuh-manager-modulesd:router: INFO: Loaded router module.
Feb 23 14:03:00 ip-172-31-44-132 env[107752]: 2026/02/23 14:03:00 wazuh-manager-modulesd:content_manager: INFO: Loaded content_manager module.
Feb 23 14:03:00 ip-172-31-44-132 env[107752]: 2026/02/23 14:03:00 wazuh-manager-modulesd:inventory-sync: INFO: Loaded Inventory sync module.
Feb 23 14:03:00 ip-172-31-44-132 env[107414]: Started wazuh-manager-modulesd...
Feb 23 14:03:01 ip-172-31-44-132 env[107414]: Started wazuh-manager-clusterd...
Feb 23 14:03:03 ip-172-31-44-132 env[107414]: Completed.
Feb 23 14:03:03 ip-172-31-44-132 systemd[1]: Started Wazuh manager.

Service status

[root@ip-172-31-44-132 /home/ubuntu]# sudo journalctl -xe -u wazuh-manager.service --no-pager
Feb 23 14:02:53 ip-172-31-44-132 systemd[1]: Starting Wazuh manager...
░░ Subject: A start job for unit wazuh-manager.service has begun execution
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit wazuh-manager.service has begun execution.
░░
░░ The job identifier is 20058.
Feb 23 14:02:56 ip-172-31-44-132 env[107459]: 2026/02/23 14:02:56 wazuh-manager-modulesd:router: INFO: Loaded router module.
Feb 23 14:02:56 ip-172-31-44-132 env[107459]: 2026/02/23 14:02:56 wazuh-manager-modulesd:content_manager: INFO: Loaded content_manager module.
Feb 23 14:02:56 ip-172-31-44-132 env[107459]: 2026/02/23 14:02:56 wazuh-manager-modulesd:inventory-sync: INFO: Loaded Inventory sync module.
Feb 23 14:02:57 ip-172-31-44-132 env[107414]: Starting Wazuh v5.0.0...
Feb 23 14:02:59 ip-172-31-44-132 env[107414]: Started wazuh-manager-apid...
Feb 23 14:02:59 ip-172-31-44-132 env[107414]: Started wazuh-manager-authd...
Feb 23 14:02:59 ip-172-31-44-132 env[107414]: Started wazuh-manager-db...
Feb 23 14:03:00 ip-172-31-44-132 env[107414]: Started wazuh-manager-analysisd...
Feb 23 14:03:00 ip-172-31-44-132 env[107414]: Started wazuh-manager-remoted...
Feb 23 14:03:00 ip-172-31-44-132 env[107414]: Started wazuh-manager-monitord...
Feb 23 14:03:00 ip-172-31-44-132 env[107752]: 2026/02/23 14:03:00 wazuh-manager-modulesd:router: INFO: Loaded router module.
Feb 23 14:03:00 ip-172-31-44-132 env[107752]: 2026/02/23 14:03:00 wazuh-manager-modulesd:content_manager: INFO: Loaded content_manager module.
Feb 23 14:03:00 ip-172-31-44-132 env[107752]: 2026/02/23 14:03:00 wazuh-manager-modulesd:inventory-sync: INFO: Loaded Inventory sync module.
Feb 23 14:03:00 ip-172-31-44-132 env[107414]: Started wazuh-manager-modulesd...
Feb 23 14:03:01 ip-172-31-44-132 env[107414]: Started wazuh-manager-clusterd...
Feb 23 14:03:03 ip-172-31-44-132 env[107414]: Completed.
Feb 23 14:03:03 ip-172-31-44-132 systemd[1]: Started Wazuh manager.
░░ Subject: A start job for unit wazuh-manager.service has finished successfully
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit wazuh-manager.service has finished successfully.
░░
░░ The job identifier is 20058.

Errors

root@ip-172-31-44-132:/home/ubuntu# cat /var/wazuh-manager/logs/wazuh-manager.log | grep -i -E "error|warn"
2026/02/23 14:02:59 wazuh-manager-analysisd: WARNING: Failed to load timezone database: 'Timezone database not found at "/var/wazuh-manager/queue/tzdb/iana"', try to download it
2026/02/23 14:03:00 wazuh-manager-analysisd: WARNING: Router: EPS settings could not be loaded from the store due to 'File '/var/wazuh-manager/engine/store/router/eps/0' does not exist'. Using default settings
2026/02/23 14:03:00 wazuh-manager-analysisd: WARNING: [CMSync::getPolicyHashFromRemote('standard')] Attempt 1/3: space.hash.sha256 field not found for space: standard
2026/02/23 14:03:05 wazuh-manager-analysisd: WARNING: [CMSync::getPolicyHashFromRemote('standard')] Attempt 2/3: space.hash.sha256 field not found for space: standard
2026/02/23 14:03:10 wazuh-manager-analysisd: WARNING: [CMSync::getPolicyHashFromRemote('standard')] Attempt 3/3: space.hash.sha256 field not found for space: standard
2026/02/23 14:03:10 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'standard': space.hash.sha256 field not found for space: standard
2026/02/23 14:03:10 wazuh-manager-analysisd: WARNING: Event not processed: {"wazuh":{"protocol":{"queue":49,"location":"wazuh-manager-monitord"},"cluster":{"name":"wazuh"}},"agent":{"name":"ip-172-31-44-132","id":"000"},"host":{"os":{"name":"Ubuntu","version":"22.04.3 LTS (Jammy Jellyfish)","full":"jammy","platform":"ubuntu","kernel":"Linux |ip-172-31-44-132 |6.2.0-1012-aws |#12~22.04.1-Ubuntu SMP Thu Sep  7 16:00:15 UTC 2023 |aarch64"},"ip":["172.31.44.132"],"architecture":"aarch64"},"event":{"original":"ossec: Manager started."}}
2026/02/23 14:03:10 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_f4c8': Policy JSON must have a 'root_decoder' UUID
2026/02/23 14:05:12 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_2bdb': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:19:25 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_03c9': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:21:25 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_6497': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:23:25 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_0a17': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:25:25 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_4631': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:27:25 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_10c2': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:29:25 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_aa5e': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:31:26 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_f68f': Policy JSON must have a 'root_decoder' UUID
root@ip-172-31-44-132:/home/ubuntu#

Ubuntu 22 AMD

Wazuh manager status

[root@ip-172-31-45-215 /home/ubuntu]# sudo systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
     Loaded: loaded (/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2026-02-23 14:06:02 UTC; 5h 25min ago
      Tasks: 163 (limit: 9398)
     Memory: 1.8G
        CPU: 14min 28.964s
     CGroup: /system.slice/wazuh-manager.service
             ├─113910 /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/api/scripts/wazuh_manager_apid.py
             ├─113925 /var/wazuh-manager/bin/wazuh-manager-authd
             ├─113935 /var/wazuh-manager/bin/wazuh-manager-db
             ├─113952 /var/wazuh-manager/bin/wazuh-manager-analysisd
             ├─114120 /var/wazuh-manager/bin/wazuh-manager-remoted
             ├─114150 /var/wazuh-manager/bin/wazuh-manager-monitord
             ├─114156 /var/wazuh-manager/bin/wazuh-manager-modulesd
             ├─114296 /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/api/scripts/wazuh_manager_apid.py
             ├─114297 /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/api/scripts/wazuh_manager_apid.py
             ├─114300 /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/api/scripts/wazuh_manager_apid.py
             ├─114303 /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/api/scripts/wazuh_manager_apid.py
             ├─114310 /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/framework/scripts/wazuh_manager_clusterd.py
             ├─114353 /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/framework/scripts/wazuh_manager_clusterd.py
             └─114354 /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/framework/scripts/wazuh_manager_clusterd.py

Feb 23 14:05:59 ip-172-31-45-215 env[113808]: Started wazuh-manager-analysisd...
Feb 23 14:05:59 ip-172-31-45-215 env[113808]: Started wazuh-manager-remoted...
Feb 23 14:05:59 ip-172-31-45-215 env[113808]: Started wazuh-manager-monitord...
Feb 23 14:05:59 ip-172-31-45-215 env[114154]: 2026/02/23 14:05:59 wazuh-manager-modulesd:router: INFO: Loaded router module.
Feb 23 14:05:59 ip-172-31-45-215 env[114154]: 2026/02/23 14:05:59 wazuh-manager-modulesd:content_manager: INFO: Loaded content_manager module.
Feb 23 14:05:59 ip-172-31-45-215 env[114154]: 2026/02/23 14:05:59 wazuh-manager-modulesd:inventory-sync: INFO: Loaded Inventory sync module.
Feb 23 14:05:59 ip-172-31-45-215 env[113808]: Started wazuh-manager-modulesd...
Feb 23 14:06:00 ip-172-31-45-215 env[113808]: Started wazuh-manager-clusterd...
Feb 23 14:06:02 ip-172-31-45-215 env[113808]: Completed.
Feb 23 14:06:02 ip-172-31-45-215 systemd[1]: Started Wazuh manager.

Service status

[root@ip-172-31-45-215 /home/ubuntu]# sudo journalctl -xe -u wazuh-manager.service --no-pager
Feb 23 14:05:53 ip-172-31-45-215 systemd[1]: Starting Wazuh manager...
░░ Subject: A start job for unit wazuh-manager.service has begun execution
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit wazuh-manager.service has begun execution.
░░
░░ The job identifier is 21273.
Feb 23 14:05:55 ip-172-31-45-215 env[113854]: 2026/02/23 14:05:55 wazuh-manager-modulesd:router: INFO: Loaded router module.
Feb 23 14:05:55 ip-172-31-45-215 env[113854]: 2026/02/23 14:05:55 wazuh-manager-modulesd:content_manager: INFO: Loaded content_manager module.
Feb 23 14:05:55 ip-172-31-45-215 env[113854]: 2026/02/23 14:05:55 wazuh-manager-modulesd:inventory-sync: INFO: Loaded Inventory sync module.
Feb 23 14:05:56 ip-172-31-45-215 env[113808]: Starting Wazuh v5.0.0...
Feb 23 14:05:58 ip-172-31-45-215 env[113808]: Started wazuh-manager-apid...
Feb 23 14:05:58 ip-172-31-45-215 env[113808]: Started wazuh-manager-authd...
Feb 23 14:05:58 ip-172-31-45-215 env[113808]: Started wazuh-manager-db...
Feb 23 14:05:59 ip-172-31-45-215 env[113808]: Started wazuh-manager-analysisd...
Feb 23 14:05:59 ip-172-31-45-215 env[113808]: Started wazuh-manager-remoted...
Feb 23 14:05:59 ip-172-31-45-215 env[113808]: Started wazuh-manager-monitord...
Feb 23 14:05:59 ip-172-31-45-215 env[114154]: 2026/02/23 14:05:59 wazuh-manager-modulesd:router: INFO: Loaded router module.
Feb 23 14:05:59 ip-172-31-45-215 env[114154]: 2026/02/23 14:05:59 wazuh-manager-modulesd:content_manager: INFO: Loaded content_manager module.
Feb 23 14:05:59 ip-172-31-45-215 env[114154]: 2026/02/23 14:05:59 wazuh-manager-modulesd:inventory-sync: INFO: Loaded Inventory sync module.
Feb 23 14:05:59 ip-172-31-45-215 env[113808]: Started wazuh-manager-modulesd...
Feb 23 14:06:00 ip-172-31-45-215 env[113808]: Started wazuh-manager-clusterd...
Feb 23 14:06:02 ip-172-31-45-215 env[113808]: Completed.
Feb 23 14:06:02 ip-172-31-45-215 systemd[1]: Started Wazuh manager.
░░ Subject: A start job for unit wazuh-manager.service has finished successfully
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit wazuh-manager.service has finished successfully.
░░
░░ The job identifier is 21273.

Errors

root@ip-172-31-45-215:/home/ubuntu# cat /var/wazuh-manager/logs/wazuh-manager.log | grep -i -E "error|warn"
2026/02/23 14:05:58 wazuh-manager-analysisd: WARNING: Failed to load timezone database: 'Timezone database not found at "/var/wazuh-manager/queue/tzdb/iana"', try to download it
2026/02/23 14:05:59 wazuh-manager-analysisd: WARNING: Router: EPS settings could not be loaded from the store due to 'File '/var/wazuh-manager/engine/store/router/eps/0' does not exist'. Using default settings
2026/02/23 14:05:59 wazuh-manager-analysisd: WARNING: [CMSync::getPolicyHashFromRemote('standard')] Attempt 1/3: space.hash.sha256 field not found for space: standard
2026/02/23 14:06:04 wazuh-manager-analysisd: WARNING: [CMSync::getPolicyHashFromRemote('standard')] Attempt 2/3: space.hash.sha256 field not found for space: standard
2026/02/23 14:06:09 wazuh-manager-analysisd: WARNING: [CMSync::getPolicyHashFromRemote('standard')] Attempt 3/3: space.hash.sha256 field not found for space: standard
2026/02/23 14:06:09 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'standard': space.hash.sha256 field not found for space: standard
2026/02/23 14:06:09 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_68f2': Policy JSON must have a 'root_decoder' UUID
2026/02/23 14:06:09 wazuh-manager-analysisd: WARNING: Event not processed: {"wazuh":{"protocol":{"queue":49,"location":"wazuh-manager-monitord"},"cluster":{"name":"wazuh"}},"agent":{"name":"ip-172-31-45-215","id":"000"},"host":{"os":{"name":"Ubuntu","version":"22.04.2 LTS (Jammy Jellyfish)","full":"jammy","platform":"ubuntu","kernel":"Linux |ip-172-31-45-215 |5.19.0-1025-aws |#26~22.04.1-Ubuntu SMP Mon Apr 24 01:58:15 UTC 2023 |x86_64"},"ip":["172.31.45.215"],"architecture":"x86_64"},"event":{"original":"ossec: Manager started."}}
2026/02/23 14:08:11 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_bc11': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:14:24 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_34be': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:16:25 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_1c71': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:18:25 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_f8cc': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:20:08 wazuh-manager-authd: ERROR: Invalid request for new agent from: 185.226.197.28
2026/02/23 19:20:08 wazuh-manager-authd: ERROR: Invalid request for new agent from: 185.226.197.27
2026/02/23 19:20:25 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_65cd': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:22:25 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_8c1b': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:24:25 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_af5e': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:26:25 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_2036': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:28:25 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_b3bf': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:30:25 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_7e10': Policy JSON must have a 'root_decoder' UUID
2026/02/23 19:32:25 wazuh-manager-analysisd: WARNING: [CM::Sync] Failed to synchronize namespace for space 'custom': Failed to store resources in namespace 'cmsync_custom_f21f': Policy JSON must have a 'root_decoder' UUID
root@ip-172-31-45-215:/home/ubuntu#