Hi, using Wazuh 4 here. I tried to get help from that community with no luck.
Basically it was all working but know, MAYBE due to the disk filling up (now solved), the interface after the login says
And cant get the app starting as before.
Any hint where I can look for errors?
Maybe this is why kibana can’t access what its needed?
{"type":"error","@timestamp":"2020-12-07T09:19:08Z","tags":["connection","client","error"],"pid":9985,"level":"error","error":{"message":"140423888828224:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\n","name":"Error","stack":"Error: 140423888828224:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\n"},"message":"140423888828224:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1544:SSL alert number 46\n"}
Any help is really appreciated, I just can’t use the server anymore…
So this is an openssl certificate unknown error, so I’m guessing that kibana is not able to verify the ssl certificate of one or more Elasticsearch nodes. I guess that some of the possible reasons might be that the certificate has expired, you have ssl disabled in Elasticsearch but not in Kibana or you are missing the root certificate.
You said that the disk was filled up, you might have deleted some certificates by mistake or did you restart Elasticsearch/kibana with different settings?
Nope, I deleted a bunch of logfile in the /logs/ directory.
The installation dates a week before, I doubt the certificate was expired.
Error was very subtle, was solved thanks to great support from the Slack Wazuh channel. File
/usr/share/kibana/optimize/wazuh/config/wazuh-registry.json
was created and was empty, because there was no space to write into it, hence the errors.
The solution was to delete the file and restart Kibana. File will be recreated with a new session token and configuration.