Release 4.3.6 - Release Candidate 1 - E2E UX tests - Demo environment #3101
Comments
1 task
Task 1: No errors or warnings found in logs 🔴AgentsAmazon Linux 🟢
RHEL 🟢
Ubuntu 🟢
Debian 🟢
CentOS 🟢
Windows 🟢
AGENT STATUS: RUNNING
NO ERRORS FOUND IN OSSEC.LOG
ManagersMaster-env1 🟡
1 warning message found in No error or warning messages in [root@wazuh-manager-master-0 wazuh-user]# egrep -i "ERROR|WARNING" /var/ossec/logs/cluster.log`
[root@wazuh-manager-master-0 wazuh-user]# Wazuh control [root@wazuh-manager-master-0 wazuh-user]# /var/ossec/bin/wazuh-control status
wazuh-clusterd is running...
wazuh-modulesd is running...
wazuh-monitord is running...
wazuh-logcollector is running...
wazuh-remoted is running...
wazuh-syscheckd is running...
wazuh-analysisd is running...
wazuh-maild not running...
wazuh-execd is running...
wazuh-db is running...
wazuh-authd is running...
wazuh-agentlessd not running...
wazuh-integratord is running...
wazuh-dbd not running...
wazuh-csyslogd not running...
wazuh-apid is running...
Filebeat [root@wazuh-manager-master-0 wazuh-user]# filebeat test output
elasticsearch: https://10.0.2.230:9200...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 10.0.2.230
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.3
dial up... OK
talk to server... OK
version: 7.10.2
elasticsearch: https://10.0.2.169:9200...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 10.0.2.169
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.3
dial up... OK
talk to server... OK
version: 7.10.2
elasticsearch: https://10.0.2.170:9200...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 10.0.2.170
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.3
dial up... OK
talk to server... OK
version: 7.10.2Master-env2 🟢
No error or warning messages in [root@wazuh-manager-master-0 wazuh-user]# egrep -i "ERROR|WARNING" /var/ossec/logs/ossec.log
[root@wazuh-manager-master-0 wazuh-user]#No error or warning messages in [root@wazuh-manager-master-0 wazuh-user]# egrep -i "ERROR|WARNING" /var/ossec/logs/cluster.log
[root@wazuh-manager-master-0 wazuh-user]#Wazuh control [root@wazuh-manager-master-0 wazuh-user]# /var/ossec/bin/wazuh-control status
wazuh-clusterd is running...
wazuh-modulesd is running...
wazuh-monitord is running...
wazuh-logcollector is running...
wazuh-remoted is running...
wazuh-syscheckd is running...
wazuh-analysisd is running...
wazuh-maild not running...
wazuh-execd is running...
wazuh-db is running...
wazuh-authd is running...
wazuh-agentlessd not running...
wazuh-integratord is running...
wazuh-dbd not running...
wazuh-csyslogd not running...
wazuh-apid is running...
Filebeat [root@wazuh-manager-master-0 wazuh-user]# filebeat test output
elasticsearch: https://10.0.2.230:9200...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 10.0.2.230
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.3
dial up... OK
talk to server... OK
version: 7.10.2
elasticsearch: https://10.0.2.169:9200...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 10.0.2.169
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.3
dial up... OK
talk to server... OK
version: 7.10.2
elasticsearch: https://10.0.2.170:9200...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 10.0.2.170
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.3
dial up... OK
talk to server... OK
version: 7.10.2Worker-env1 🟢
[root@wazuh-manager-worker-0 wazuh-user]# egrep -i "ERROR|WARNING" /var/ossec/logs/ossec.log
[root@wazuh-manager-worker-0 wazuh-user]#
[root@wazuh-manager-worker-0 wazuh-user]# egrep -i "ERROR|WARNING" /var/ossec/logs/cluster.log
[root@wazuh-manager-worker-0 wazuh-user]#Wazuh control [root@wazuh-manager-worker-0 wazuh-user]# /var/ossec/bin/wazuh-control status
wazuh-clusterd is running...
wazuh-modulesd is running...
wazuh-monitord is running...
wazuh-logcollector is running...
wazuh-remoted is running...
wazuh-syscheckd is running...
wazuh-analysisd is running...
wazuh-maild not running...
wazuh-execd is running...
wazuh-db is running...
wazuh-authd not running...
wazuh-agentlessd not running...
wazuh-integratord is running...
wazuh-dbd not running...
wazuh-csyslogd not running...
wazuh-apid is running...
Filebeat [root@wazuh-manager-worker-0 wazuh-user]# filebeat test output
elasticsearch: https://10.0.2.230:9200...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 10.0.2.230
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.3
dial up... OK
talk to server... OK
version: 7.10.2
elasticsearch: https://10.0.2.169:9200...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 10.0.2.169
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.3
dial up... OK
talk to server... OK
version: 7.10.2
elasticsearch: https://10.0.2.170:9200...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 10.0.2.170
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.3
dial up... OK
talk to server... OK
version: 7.10.2IndexersBootstrap 🟡Some warning appears in
Indexer log This error is related to: wazuh/wazuh-packages#1511 [root@ip-10-0-2-230 wazuh-user]# egrep -i "ERROR|WARNING" /var/log/wazuh-indexer/wazuh.log
[2022-07-18T20:12:28,702][ERROR][o.o.s.a.s.SinkProvider ] [node-1] Default endpoint could not be created, auditlog will not work properly.MasterB 🟡Some warning appears in
Indexer log This error is related to: wazuh/wazuh-packages#1511 [root@ip-10-0-2-169 wazuh-user]# egrep -i "ERROR|WARNING" /var/log/wazuh-indexer/wazuh.log
[2022-07-18T20:09:16,317][ERROR][o.o.s.a.s.SinkProvider ] [node-2] Default endpoint could not be created, auditlog will not work properly.MasterC 🟡Some warning appears in
Indexer log This error is related to: wazuh/wazuh-packages#1511 [root@ip-10-0-2-170 wazuh-user]# egrep -i "ERROR|WARNING" /var/log/wazuh-indexer/wazuh.log
[2022-07-18T20:09:19,613][ERROR][o.o.s.a.s.SinkProvider ] [node-3] Default endpoint could not be created, auditlog will not work properly.DashboardIndexer 🟡
Dashboard 🔴
1 error while restarting the dashboard
{"date":"2022-07-18T21:45:27.785Z","level":"error","location":"monitoring:insertMonitoringDataElasticsearch","message":"Could not check if the index wazuh-monitoring-2022.29w exists due to no permissions for create, delete or check"}
{"date":"2022-07-18T21:45:27.867Z","level":"error","location":"monitoring:insertMonitoringDataElasticsearch","message":"Could not check if the index wazuh-monitoring-2022.29w exists due to no permissions for create, delete or check"}Issues |
Task 2: The daemons are running with the correct user 🟢AgentsAmazon Linux 🟢
root 1032 0.0 0.2 38500 2936 ? Sl 13:36 0:00 /var/ossec/bin/wazuh-execd
wazuh 1044 0.0 0.5 264500 5668 ? Sl 13:36 0:00 /var/ossec/bin/wazuh-agentd
root 1059 1.1 0.8 204512 8424 ? SNl 13:36 0:08 /var/ossec/bin/wazuh-syscheckd
root 1073 0.0 0.4 481016 4620 ? Sl 13:36 0:00 /var/ossec/bin/wazuh-logcollector
root 1095 0.0 1.4 741624 14348 ? Sl 13:36 0:00 /var/ossec/bin/wazuh-modulesdRHEL 🟢
root 4301 0.0 0.0 36308 1668 ? Sl 13:41 0:00 /var/ossec/bin/wazuh-execd
wazuh 4313 0.0 0.0 262040 3124 ? Sl 13:41 0:00 /var/ossec/bin/wazuh-agentd
root 4328 5.9 0.2 415672 8600 ? SNl 13:41 0:23 /var/ossec/bin/wazuh-syscheckd
root 4341 0.0 0.0 478724 2608 ? Sl 13:41 0:00 /var/ossec/bin/wazuh-logcollector
root 4365 0.3 0.6 1034304 23984 ? Sl 13:41 0:01 /var/ossec/bin/wazuh-modulesdUbuntu 🟢
root 17355 0.0 0.3 43524 3260 ? Sl 14:15 0:00 /var/ossec/bin/wazuh-execd
wazuh 17366 0.0 0.5 269468 5284 ? Sl 14:15 0:01 /var/ossec/bin/wazuh-agentd
root 17381 0.0 0.7 208976 7856 ? SNl 14:15 0:08 /var/ossec/bin/wazuh-syscheckd
root 17396 0.0 0.4 485948 4492 ? Sl 14:15 0:00 /var/ossec/bin/wazuh-logcollector
root 17411 0.0 1.3 749164 13728 ? Sl 14:15 0:01 /var/ossec/bin/wazuh-modulesdDebian 🟢
root 20482 0.0 0.2 42208 2628 ? Sl 14:15 0:00 /var/ossec/bin/wazuh-execd
wazuh 20493 0.0 0.5 268236 5208 ? Sl 14:15 0:01 /var/ossec/bin/wazuh-agentd
root 20507 0.0 0.7 273020 7380 ? SNl 14:15 0:06 /var/ossec/bin/wazuh-syscheckd
root 20524 0.0 0.4 484860 4296 ? Sl 14:15 0:00 /var/ossec/bin/wazuh-logcollector
root 20555 0.0 1.2 745740 11976 ? Sl 14:15 0:01 /var/ossec/bin/wazuh-modulesdCentOS 🟢
root 29007 0.0 0.1 36220 1516 ? Sl 14:28 0:00 /var/ossec/bin/wazuh-execd
wazuh 29019 0.0 0.3 262044 3084 ? Sl 14:29 0:02 /var/ossec/bin/wazuh-agentd
root 29034 0.1 0.5 201932 5224 ? SNl 14:29 0:11 /var/ossec/bin/wazuh-syscheckd
root 29048 0.0 0.2 478596 2340 ? Sl 14:29 0:01 /var/ossec/bin/wazuh-logcollector
root 29066 0.0 2.2 739252 22524 ? Sl 14:29 0:02 /var/ossec/bin/wazuh-modulesdWindows 🟢
ManagersMaster-env1 🟢
wazuh 29980 0.1 2.5 821392 100176 ? Sl 16:56 0:15 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
wazuh 30006 0.0 0.0 39232 3384 ? Sl 16:56 0:00 /var/ossec/bin/wazuh-integratord
root 30025 0.2 0.1 194956 5856 ? Sl 16:56 0:24 /var/ossec/bin/wazuh-authd
wazuh 30042 0.0 0.3 775968 15260 ? Sl 16:56 0:08 /var/ossec/bin/wazuh-db
wazuh 30054 0.0 1.4 317364 59752 ? S 16:56 0:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
wazuh 30057 0.0 1.6 466436 63960 ? S 16:56 0:06 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
root 30072 0.0 0.0 39272 3176 ? Sl 16:56 0:00 /var/ossec/bin/wazuh-execd
wazuh 30087 0.2 2.3 1293472 92940 ? Sl 16:56 0:20 /var/ossec/bin/wazuh-analysisd
root 30099 0.1 0.2 270452 8584 ? SNl 16:56 0:12 /var/ossec/bin/wazuh-syscheckd
wazuh 30119 0.4 0.1 1179140 6736 ? Sl 16:56 0:36 /var/ossec/bin/wazuh-remoted
root 30152 0.0 0.1 481672 5152 ? Sl 16:56 0:00 /var/ossec/bin/wazuh-logcollector
wazuh 30173 0.0 0.0 39252 3224 ? Sl 16:56 0:00 /var/ossec/bin/wazuh-monitord
root 30223 3.4 6.3 1424400 255288 ? Sl 16:56 5:13 /var/ossec/bin/wazuh-modulesd
wazuh 30340 0.1 1.3 443544 54116 ? Sl 16:56 0:11 /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/wazuh-clusterd.py
wazuh 30364 0.0 1.0 280460 43828 ? S 16:56 0:02 /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/wazuh-clusterd.py
wazuh 30367 0.0 1.0 362388 41852 ? S 16:56 0:02 /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/wazuh-clusterd.pyMaster-env2 🟢
wazuh 27890 0.1 2.5 821300 100064 ? Sl 16:56 0:13 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
wazuh 27924 0.0 0.0 39232 3380 ? Sl 16:56 0:00 /var/ossec/bin/wazuh-integratord
root 27935 0.2 0.1 194956 5836 ? Sl 16:56 0:25 /var/ossec/bin/wazuh-authd
wazuh 27952 0.0 0.3 710428 14940 ? Sl 16:56 0:06 /var/ossec/bin/wazuh-db
wazuh 27964 0.0 1.5 317372 59860 ? S 16:56 0:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
wazuh 27967 0.0 1.6 466172 64016 ? S 16:56 0:05 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
root 27982 0.0 0.0 39272 3240 ? Sl 16:56 0:00 /var/ossec/bin/wazuh-execd
wazuh 27997 0.0 2.2 1293376 91776 ? Sl 16:56 0:09 /var/ossec/bin/wazuh-analysisd
root 28009 0.1 0.2 270556 8444 ? SNl 16:56 0:12 /var/ossec/bin/wazuh-syscheckd
wazuh 28030 0.1 0.1 1179128 6992 ? Sl 16:56 0:10 /var/ossec/bin/wazuh-remoted
root 28062 0.0 0.1 481676 4988 ? Sl 16:56 0:00 /var/ossec/bin/wazuh-logcollector
wazuh 28084 0.0 0.0 39252 3180 ? Sl 16:56 0:00 /var/ossec/bin/wazuh-monitord
root 28133 3.9 7.5 1416824 299700 ? Sl 16:56 6:02 /var/ossec/bin/wazuh-modulesd
wazuh 28261 0.0 1.1 428476 45792 ? Sl 16:56 0:02 /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/wazuh-clusterd.py
wazuh 28282 0.0 1.0 280460 42940 ? S 16:56 0:01 /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/wazuh-clusterd.py
wazuh 28285 0.0 1.0 362388 41696 ? S 16:56 0:01 /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/wazuh-clusterd.pyWorker-env1 🟢
wazuh 17236 0.5 2.3 741632 94540 ? Sl 18:57 0:11 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
wazuh 17267 0.0 0.0 39236 3412 ? Sl 18:57 0:00 /var/ossec/bin/wazuh-integratord
wazuh 17279 0.0 0.2 775972 11072 ? Sl 18:57 0:01 /var/ossec/bin/wazuh-db
root 17303 0.0 0.0 39288 3228 ? Sl 18:57 0:00 /var/ossec/bin/wazuh-execd
wazuh 17305 0.0 1.4 310420 57340 ? S 18:57 0:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
wazuh 17308 0.0 1.5 465076 60124 ? S 18:57 0:00 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
wazuh 17324 0.0 0.7 1293328 28936 ? Sl 18:57 0:01 /var/ossec/bin/wazuh-analysisd
root 17335 0.5 0.2 204944 8708 ? SNl 18:57 0:10 /var/ossec/bin/wazuh-syscheckd
wazuh 17357 0.1 0.1 523728 4648 ? Sl 18:57 0:03 /var/ossec/bin/wazuh-remoted
root 17388 0.0 0.1 481680 5012 ? Sl 18:57 0:00 /var/ossec/bin/wazuh-logcollector
wazuh 17412 0.0 0.0 39256 3164 ? Sl 18:57 0:00 /var/ossec/bin/wazuh-monitord
root 17460 6.5 6.8 1180896 271520 ? Sl 18:57 2:21 /var/ossec/bin/wazuh-modulesd
wazuh 17586 0.1 1.3 588308 55152 ? Sl 18:57 0:02 /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/wazuh-clusterd.py
wazuh 17810 0.0 1.1 288228 45284 ? S 18:57 0:00 /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/wazuh-clusterd.py
wazuh 18553 0.0 1.1 440844 47248 ? S 19:00 0:00 /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/wazuh-clusterd.pyIndexersBootstrap 🟢
MasterB 🟢
MasterC 🟢
DashboardIndexer 🟢
Dashboard 🟢
wazuh-d+ 19944 1.7 1.8 994592 151328 ? Ssl 21:45 0:09 /usr/share/wazuh-dashboard/bin/../node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/bin/../src/cli/dist -c /etc/wazuh-dashboard/opensearch_dashboards.yml |
Task 3: The status of the Wazuh Indexer clusters is as expected. 🟢
|
This was referenced Jul 18, 2022
Task 4: No errors in the browser's developer console when browsing the App 🔴When accessing Issue: |
Task 5: Alerts are being generated for each of the modules configured for this purpose 🟢These are the modules configured in environment 1, and we can see events generated in all of them:
However, Osquery is configured in this environment, but it doesn't appear. If we enable it, see can see events:
These are the modules configured in environment 2, and we can see events generated in all of them except System Auditing and Policy monitoring, but they are enabled by default:
|
Task 6: No warning symbols in Discover when expanding a document 🟢After performing several tests both in Discover and in different modules, we have not been able to find any warning. |
Task 7: Generate an alert and check it in the web UI 🟢Bad connection to CentOS agent: Generated alerts:
Alert info |
Repository owner
moved this from In Review
to Done
in Release 4.3.6
Jul 20, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
The following issue aims to run the specified test for the current release candidate, report the results, and open new issues for any encountered errors.
Test information
Proposed checks
Conclusion 🔴
New bugs have been found when testing. In addition, some previously reported problems have been found again.
Issues found
Detected issues and previously reported
New opened issues
Auditors' validation
The definition of done for this one is the validation of the conclusions and the test results from all auditors.
All checks from below must be accepted in order to close this issue.
References
The text was updated successfully, but these errors were encountered: