Error in a delayed request related to DELETE action

[rauldpm]

Description

Testing the v4.9.0 Alpha 3 AMI after using it to test the AIX, HP-UX, and Solaris SPARC systems (only used to check agents status and remove them using the manage_agent binary), I found the following error message in the Wazuh dashboard journalctl output

Jul 22 21:30:45 wazuh-server opensearch-dashboards[5573]: {"type":"log","@timestamp":"2024-07-22T21:30:45Z","tags":["error","plugins","wazuh","queue"],"pid":5573,"message":"An error ocurred in the delayed request: \"DELETE /security/user/authenticate\": Request failed with status code 401"}
Jul 22 21:30:45 wazuh-server opensearch-dashboards[5573]: {"type":"log","@timestamp":"2024-07-22T21:30:45Z","tags":["error","plugins","wazuh","queue"],"pid":5573,"message":"An error ocurred in the delayed request: \"DELETE /security/user/authenticate\": Request failed with status code 401"}

I found some issues reporting this, like wazuh/wazuh-dashboard-plugins#5958, where the conclusion is:

That error happens if you execute the action (delete) and the token expires before it is executed. The API returns a 401 unauthorized. It looks like it is working as designed.

I have not executed any command in the AMI that requires a TOKEN, testing in a second deployed AMI, I cannot reproduce this error message

The message date is Jul 22 21:30:45, and the AMI was launched Jul 22 2024 20:54:37, at this time, the password change script finished sometime before (only takes 5 minutes so if the log is related, it should indicate something like 21:00:00, not 21:30:45)

Can this message be related to the manage_agent calls?

Related

• Release 4.9.0 - Alpha 3 - Specific systems wazuh#24722 (comment)

[asteriscos]

@rauldpm I understand you didn't perform any action that requires a token, but can you recall if you had a browser opened in wazuh-dashboard?

[rauldpm]

@rauldpm I understand you didn't perform any action that requires a token, but can you recall if you had a browser opened in wazuh-dashboard?

Probably, I had to check the agent status in the Wazuh dashboard UI

[gdiazlo]

This is a normal behavior as the UI tries to invalidate the token once the session expires.