Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] The Command Manager sends the same command more than once #195

Open
AlexRuiz7 opened this issue Dec 19, 2024 · 0 comments
Open

[BUG] The Command Manager sends the same command more than once #195

AlexRuiz7 opened this issue Dec 19, 2024 · 0 comments
Labels
level/task Task issue type/bug Bug issue

Comments

@AlexRuiz7
Copy link
Member

Describe the bug
During the tests of the Data persistence model MVP refinement II, it has been detected that the Command Manager sends the same command more than once.

To Reproduce
Steps to reproduce the behavior:

  1. Using the latest packages from the MVP, generate a command on the Wazuh Server.
curl -X PUT https://127.0.0.1:55000/agents/restart -k -H "Authorization: Bearer $TOKEN"
  1. Check the /var/log/wazuh-indexer/wazuh-cluster.log

Expected behavior
The Command Manager must send each command just once.

Plugins
Command Manager plugin.

Additional context

Slack thread on which this behavior was reported: https://wazuh-team.slack.com/archives/C07S3L2791C/p1734550624477849?thread_ts=1734464878.137829&cid=C07S3L2791C.

wazuh-server logs

Dec 18 19:22:41 rhel-server env[56066]: 2024/12/18 19:22:41 INFO: [Management API] wazuh 127.0.0.1 "POST /orders" with parameters {} and body {"orders": [{"action": {"args": ["validGroup"], "name": "set-group", "version": "v4"}, "source": "Engine", "document_id": "ASM425MBUqDANn3L4kgo", "user": "user53", "order_id": "ACM425MBUqDANn3L4kgo", "request_id": "_yM425MBUqDANn3L4kco", "timeout": 30, "target": {"id": "8c1870d7-3cd1-461f-bfc6-eb1a424b983e", "type": "agent"}, "status": "pending"}]} done in 0.109s: 200
Dec 18 19:22:41 rhel-server env[71150]: 2024/12/18 19:22:41 DEBUG: [Communications API] Request headers: {'host': '192.168.56.120', 'user-agent': 'WazuhXDR/5.0.0 (Endpoint; x86_64; Linux)', 'accept': 'application/json', 'authorization': 'Bearer eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ3YXp1aCIsImF1ZCI6IldhenVoIENvbW11bmljYXRpb25zIEFQSSIsImlhdCI6MTczNDU0OTE5NywiZXhwIjoxNzM0NTUwMDk3LCJ1dWlkIjoiOGMxODcwZDctM2NkMS00NjFmLWJmYzYtZWIxYTQyNGI5ODNlIn0.JIwd6ombjMM363BpL4FIzyzuK9uEmkHcX5rC_y6FppNr40Jo_ewLsYi0On1pu6Hq-4-stnyKEL46XXHZslmNsA'}
Dec 18 19:22:41 rhel-server env[71150]: 2024/12/18 19:22:41 INFO: [Communications API] (8c1870d7-3cd1-461f-bfc6-eb1a424b983e) "GET /api/v1/commands" with parameters {} and body {} done in 8.027s: 200
Dec 18 19:22:42 rhel-server env[71164]: 2024/12/18 19:22:42 DEBUG: [Communications API] Request headers: {'host': '192.168.56.120', 'user-agent': 'WazuhXDR/5.0.0 (Endpoint; x86_64; Linux)', 'accept': 'application/json', 'authorization': 'Bearer eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ3YXp1aCIsImF1ZCI6IldhenVoIENvbW11bmljYXRpb25zIEFQSSIsImlhdCI6MTczNDU0OTE5NywiZXhwIjoxNzM0NTUwMDk3LCJ1dWlkIjoiOGMxODcwZDctM2NkMS00NjFmLWJmYzYtZWIxYTQyNGI5ODNlIn0.JIwd6ombjMM363BpL4FIzyzuK9uEmkHcX5rC_y6FppNr40Jo_ewLsYi0On1pu6Hq-4-stnyKEL46XXHZslmNsA'}
Dec 18 19:22:42 rhel-server env[71164]: 2024/12/18 19:22:42 INFO: [Communications API] (8c1870d7-3cd1-461f-bfc6-eb1a424b983e) "GET /api/v1/files" with parameters {"file_name": "validGroup.yml"} and body {} done in 0.043s: 200
Dec 18 19:22:42 rhel-server env[56097]: 2024/12/18 19:22:42 DEBUG: [Communications API] Connecting to the indexer client.
Dec 18 19:22:42 rhel-server env[56097]: 2024/12/18 19:22:42 DEBUG: [Communications API] Closing the indexer client session.
Dec 18 19:22:42 rhel-server env[71150]: 2024/12/18 19:22:42 DEBUG: [Communications API] Request headers: {'host': '192.168.56.120', 'user-agent': 'WazuhXDR/5.0.0 (Endpoint; x86_64; Linux)', 'accept': 'application/json', 'authorization': 'Bearer eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ3YXp1aCIsImF1ZCI6IldhenVoIENvbW11bmljYXRpb25zIEFQSSIsImlhdCI6MTczNDU0OTE5NywiZXhwIjoxNzM0NTUwMDk3LCJ1dWlkIjoiOGMxODcwZDctM2NkMS00NjFmLWJmYzYtZWIxYTQyNGI5ODNlIn0.JIwd6ombjMM363BpL4FIzyzuK9uEmkHcX5rC_y6FppNr40Jo_ewLsYi0On1pu6Hq-4-stnyKEL46XXHZslmNsA', 'content-type': 'application/json', 'content-length': '814'}
Dec 18 19:22:42 rhel-server env[71150]: 2024/12/18 19:22:42 DEBUG: [Communications API] Request body stream: {"agent":{"groups":["validGroup"],"host":{"architecture":"x86_64","hostname":"rhel-agent","ip":["10.0.2.15","192.168.56.121"],"os":{"name":"Red Hat Enterprise Linux","type":"Linux","version":"9.3 (Plow)"}},"id":"8c1870d7-3cd1-461f-bfc6-eb1a424b983e","name":"rhel-agent","type":"Endpoint","version":"5.0.0"}}
Dec 18 19:22:42 rhel-server env[71150]: {"id":"ASM425MBUqDANn3L4kgo","module":"command","operation":"update"}
Dec 18 19:22:42 rhel-server env[71150]: {"command":{"result":{"code":0,"message":"CentralizedConfiguration set-group done."}}}
Dec 18 19:22:42 rhel-server env[71150]: {"id":"2f059b5915e3f90a107f56114b91268c28c8af1c","module":"inventory","operation":"update","type":"hardware"}
Dec 18 19:22:42 rhel-server env[71150]: {"@timestamp":"2024-12-18T19:22:42.132Z","host":{"cpu":{"cores":2,"name":"11th Gen Intel(R) Core(TM) i7-1165G7 @ 2.80GHz","speed":2804.0},"memory":{"free":1622792,"total":2002664,"used":{"percentage":19}}},"observer":{"serial_number":"0"}}
Dec 18 19:22:42 rhel-server env[71150]: 2024/12/18 19:22:42 INFO: [Communications API] (8c1870d7-3cd1-461f-bfc6-eb1a424b983e) "POST /api/v1/events/stateful" with parameters {} and body {} done in 0.399s: 200
Dec 18 19:22:42 rhel-server env[56066]: 2024/12/18 19:22:42 INFO: [Management API] wazuh 127.0.0.1 "POST /security/user/authenticate" with parameters {} and body {} done in 0.762s: 200
Dec 18 19:22:42 rhel-server env[56066]: 2024/12/18 19:22:42 DEBUG: [Management API] Decoded token {'username': 'wazuh', 'roles': (1,), 'token_nbf_time': 1734549762, 'run_as': False, 'origin_node_type': 'master'}
Dec 18 19:22:42 rhel-server env[55615]: 2024/12/18 19:22:42 INFO: [Local 780731] [Main] Sending orders to the other nodes
Dec 18 19:22:42 rhel-server env[55615]: 2024/12/18 19:22:42 INFO: [Local 780731] [Main] Sending orders to the Communications API
Dec 18 19:22:42 rhel-server env[56066]: 2024/12/18 19:22:42 INFO: [Management API] wazuh 127.0.0.1 "POST /orders" with parameters {} and body {"orders": [{"action": {"args": ["validGroup"], "name": "set-group", "version": "v4"}, "source": "Engine", "document_id": "ASM425MBUqDANn3L4kgo", "user": "user53", "order_id": "ACM425MBUqDANn3L4kgo", "request_id": "_yM425MBUqDANn3L4kco", "timeout": 30, "target": {"id": "8c1870d7-3cd1-461f-bfc6-eb1a424b983e", "type": "agent"}, "status": "pending"}]} done in 0.115s: 200
Dec 18 19:22:43 rhel-server env[71164]: 2024/12/18 19:22:43 DEBUG: [Communications API] Request headers: {'host': '192.168.56.120', 'user-agent': 'WazuhXDR/5.0.0 (Endpoint; x86_64; Linux)', 'accept': 'application/json', 'authorization': 'Bearer eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ3YXp1aCIsImF1ZCI6IldhenVoIENvbW11bmljYXRpb25zIEFQSSIsImlhdCI6MTczNDU0OTE5NywiZXhwIjoxNzM0NTUwMDk3LCJ1dWlkIjoiOGMxODcwZDctM2NkMS00NjFmLWJmYzYtZWIxYTQyNGI5ODNlIn0.JIwd6ombjMM363BpL4FIzyzuK9uEmkHcX5rC_y6FppNr40Jo_ewLsYi0On1pu6Hq-4-stnyKEL46XXHZslmNsA'}
Dec 18 19:22:43 rhel-server env[71164]: 2024/12/18 19:22:43 INFO: [Communications API] (8c1870d7-3cd1-461f-bfc6-eb1a424b983e) "GET /api/v1/commands" with parameters {} and body {} done in 0.699s: 200

wazuh-agent logs

Dec 18 19:22:43 rhel-agent env[3964]: [2024-12-18 19:22:43.139] [wazuh-agent] [error] [ERROR] [sqlite_manager.cpp:270] [Execute] Error during database operation: UNIQUE constraint failed: COMMAND.id.
Dec 18 19:22:43 rhel-agent env[3964]: [2024-12-18 19:22:43.139] [wazuh-agent] [error] [ERROR] [command_store.cpp:105] [StoreCommand] StoreCommand operation failed: UNIQUE constraint failed: COMMAND.id.
Dec 18 19:22:43 rhel-agent env[3964]: [2024-12-18 19:22:43.140] [wazuh-agent] [error] [ERROR] [command_handler.hpp:81] [CommandsProcessingTask] Error storing command: ASM425MBUqDANn3L4kgo set-group. Error: Agent's database failure
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
level/task Task issue type/bug Bug issue
Projects
Status: Blocked
Development

No branches or pull requests

1 participant