Release 4.4.0 - Alpha 1 - E2E UX tests - Wazuh Indexer #15534
Assignees
Labels
Comments
jotacarma90
added
release test/4.4.0
1 task
Environment installation 🟢Hosts informationHosts informationAll the hosts used for this test are like this one: The IP addresses for this scenario are:
Wazuh indexer 🟢Wazuh indexer 🟢Followed the step-by-step documentation at: Certificates creation 🟢Content of Created and copied the certificates to all the required nodes: Wazuh indexer installation 🟢Installed dependency: Import repository: Installing the Wazuh indexer: Modified the config file Deploying certificates 🟢Starting the service 🟢Cluster initialization 🟢Testing the cluster installation: Wazuh manager (master node)🟢Wazuh manager (master node)🟢Followed the step-by-step documentation at: Installing the Wazuh manager 🟢Added the repository: Installed the Wazuh manager package: Enabled the service and started the master node: Installing filebeat 🟢Installed the filebeat package: Filebeat configuration 🟢Downloaded the configuration file: Modified the configuration: Configuring the credentials: Download the alerts template: Installed the Wazuh module for filebeat: Deploying certificates 🟢Starting filebeat 🟢Verify filebeat installation: Cluster configuration 🟢Creating random key: Modifying cluster configuration: <cluster>
<name>wazuh</name>
<node_name>master-node</node_name>
<node_type>master</node_type>
<key>525f3ae3a8451d56aa051e448e3298cf</key>
<port>1516</port>
<bind_addr>0.0.0.0</bind_addr>
<nodes>
<node>192.168.1.201</node>
</nodes>
<hidden>no</hidden>
<disabled>no</disabled>
</cluster>Restart the manager: Verify cluster status: Wazuh manager (worker node)🟢Wazuh manager (worker node)🟢Followed the step-by-step documentation at: Installing the Wazuh manager 🟢Added the repository: Installed the Wazuh manager package: Enabled the service and started the master node: Installing filebeat 🟢Installed the filebeat package: Filebeat configuration 🟢Downloaded the configuration file: Modified the configuration: Configuring the credentials: Download the alerts template: Installed the Wazuh module for filebeat: Deploying certificates 🟢Starting filebeat 🟢Verify filebeat installation: Cluster configuration 🟢Modifying cluster configuration: <cluster>
<name>wazuh</name>
<node_name>worker-node</node_name>
<node_type>worker</node_type>
<key>525f3ae3a8451d56aa051e448e3298cf</key>
<port>1516</port>
<bind_addr>0.0.0.0</bind_addr>
<nodes>
<node>192.168.1.201</node>
</nodes>
<hidden>no</hidden>
<disabled>no</disabled>
</cluster>Restart the manager: Verify cluster status: Wazuh dashboard 🟢Wazuh dashboard 🟢Followed the step-by-step documentation at: Dashboard installation 🟢Installed dependency: Added the Wazuh repository: Installed the Wazuh dashboard: Dashboard configuration 🟢Modified the file Deploying certificates 🟢Starting the dashboard service 🟢Screenshot of the UI after starting the service: Wazuh agent 🟢Wazuh agent 🟢Followed the installation guide at: Agent installation 🟢Added the Wazuh repository: Installing the agent: Starting the agent 🟢The agent is properly registered through the cluster. Logs from worker node Logs from master node It is connected to the worker node: Screenshot from the UI: |
Wazuh indexer package information 🟢The package specs are: [root@al2-indexer ~]# rpm -qi wazuh-indexer
Name : wazuh-indexer
Version : 4.4.0
Release : 1
Architecture: x86_64
Install Date: Fri 02 Dec 2022 08:33:44 AM UTC
Group : System Environment/Daemons
Size : 675161741
License : GPL
Signature : RSA/SHA256, Tue 29 Nov 2022 10:23:19 AM UTC, Key ID 96b3ee5f29111145
Source RPM : wazuh-indexer-4.4.0-1.src.rpm
Build Date : Tue 29 Nov 2022 09:47:55 AM UTC
Build Host : ip-172-31-70-151.ec2.internal
Relocations : (not relocatable)
Packager : Wazuh, Inc <[email protected]>
Vendor : Wazuh, Inc <[email protected]>
URL : https://www.wazuh.com/
Summary : Wazuh indexer is a search and analytics engine for security-related data. Documentation can be found at https://documentation.wazuh.com/current/getting-started/components/wazuh-indexer.html
Description :
Wazuh indexer is a near real-time full-text search and analytics engine that gathers security-related data into one platform. This Wazuh central component indexes and stores alerts generated by the Wazuh server. Wazuh indexer can be configured as a single-node or multi-node cluster, providing scalability and high availability. Documentation can be found at https://documentation.wazuh.com/current/getting-started/components/wazuh-indexer.html
|
Installed files location, size, and permissions 🟢Content of /usr/share/wazuh-indexerContent of /etc/wazuh-indexerContent of /var/log/wazuh-indexerCompared with the report from 4.3.10 testing, didn't find any change regarding location, size, or permissions of the installed files. |
Installation footprint 🟢[root@al2-indexer ~]# find /etc -user wazuh-indexer -not -regex ".*wazuh\-indexer.*" -name "*"
[root@al2-indexer ~]# find /usr -user wazuh-indexer -not -regex ".*wazuh\-indexer.*" -name "*"
[root@al2-indexer ~]# find /var -user wazuh-indexer -not -regex ".*wazuh\-indexer.*" -name "*"
[root@al2-indexer ~]# find /bin -user wazuh-indexer -not -regex ".*wazuh\-indexer.*" -name "*"
[root@al2-indexer ~]# find /etc -group wazuh-indexer -not -regex ".*wazuh\-indexer.*" -name "*"
[root@al2-indexer ~]# find /usr -group wazuh-indexer -not -regex ".*wazuh\-indexer.*" -name "*"
[root@al2-indexer ~]# find /var -group wazuh-indexer -not -regex ".*wazuh\-indexer.*" -name "*"
[root@al2-indexer ~]# find /bin -group wazuh-indexer -not -regex ".*wazuh\-indexer.*" -name "*"
[root@al2-indexer ~]# |
Wazuh indexer service 🟢Content of service fileWazuh indexer service status |
Wazuh indexer installation logs 🟡[root@al2-indexer ~]# journalctl | grep -i wazuh-indexer
Dec 02 08:33:10 al2-indexer groupadd[55301]: group added to /etc/group: name=wazuh-indexer, GID=994
Dec 02 08:33:10 al2-indexer groupadd[55301]: group added to /etc/gshadow: name=wazuh-indexer
Dec 02 08:33:10 al2-indexer groupadd[55301]: new group: name=wazuh-indexer, GID=994
Dec 02 08:33:10 al2-indexer useradd[55306]: new user: name=wazuh-indexer, UID=996, GID=994, home=/usr/share/wazuh-indexer, shell=/sbin/nologin
Dec 02 08:33:45 al2-indexer yum[55291]: Installed: wazuh-indexer-4.4.0-1.x86_64
Dec 02 08:41:07 al2-indexer systemd[1]: Configuration file /usr/lib/systemd/system/wazuh-indexer.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
Dec 02 08:41:07 al2-indexer systemd[1]: Configuration file /usr/lib/systemd/system/wazuh-indexer.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
Dec 02 08:41:07 al2-indexer systemd[1]: Configuration file /usr/lib/systemd/system/wazuh-indexer.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
Dec 02 08:41:13 al2-indexer systemd[1]: Starting Wazuh-indexer...
Dec 02 08:41:16 al2-indexer systemd-entrypoint[55505]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opensearch-2.3.0.jar)
Dec 02 08:41:18 al2-indexer systemd-entrypoint[55505]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensearch-2.3.0.jar)
Dec 02 08:41:32 al2-indexer systemd[1]: Started Wazuh-indexer.
Dec 02 08:41:53 al2-indexer systemd[1]: Configuration file /usr/lib/systemd/system/wazuh-indexer.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
Dec 02 08:45:03 al2-indexer systemd[1]: Configuration file /usr/lib/systemd/system/wazuh-indexer.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
Dec 02 08:46:51 al2-indexer runuser[55806]: pam_unix(runuser:session): session opened for user wazuh-indexer by vagrant(uid=0)
Dec 02 08:46:57 al2-indexer runuser[55806]: pam_unix(runuser:session): session closed for user wazuh-indexer
Dec 02 11:03:12 al2-indexer systemd[1]: Configuration file /usr/lib/systemd/system/wazuh-indexer.service is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.
[root@al2-indexer ~]#Found a couple of warnings related to the System::setSecurityManager method. However, they are not descriptive regarding the possible consequences that this might lead to. In addition, they are not found in previous testing issues for this component. |
Wazuh indexer indices, templates, and shards 🟢Indices [root@al2-indexer ~]# curl -u admin:admin -k https://192.168.1.198:9200/_cat/indices?v=true
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open wazuh-alerts-4.x-2022.12.02 dSrzvodqQDqtRdJkOaMq8Q 3 0 566 0 1.2mb 1.2mb
green open wazuh-monitoring-2022.48w SoicMZj7QAWyraVvvSO4qQ 1 0 4 0 66.6kb 66.6kb
green open .kibana_1 CF4S-V7wQnuxQMProLJDLw 1 0 4 0 15.6kb 15.6kb
green open .opendistro_security duh8mBXVTu20loC41W7QQg 1 0 10 0 65.1kb 65.1kb
green open wazuh-statistics-2022.48w ft-VajwUR1m4i_uZSrn0fg 1 0 0 0 208b 208b
[root@al2-indexer ~]#Templates [root@al2-indexer ~]# curl -u admin:admin -k https://192.168.1.198:9200/_cat/templates?pretty
wazuh-agent [wazuh-monitoring-*] 0
wazuh [wazuh-alerts-4.x-*, wazuh-archives-4.x-*] 0 1
wazuh-statistics [wazuh-statistics-*] 0
[root@al2-indexer ~]#Shards [root@al2-indexer ~]# curl -u admin:admin -k https://192.168.1.198:9200/_cat/shards?v=true
index shard prirep state docs store ip node
wazuh-monitoring-2022.48w 0 p STARTED 4 66.6kb 192.168.1.198 indexer-1
.kibana_1 0 p STARTED 4 15.6kb 192.168.1.198 indexer-1
.opendistro_security 0 p STARTED 10 65.1kb 192.168.1.198 indexer-1
wazuh-alerts-4.x-2022.12.02 1 p STARTED 188 434.1kb 192.168.1.198 indexer-1
wazuh-alerts-4.x-2022.12.02 2 p STARTED 201 470kb 192.168.1.198 indexer-1
wazuh-alerts-4.x-2022.12.02 0 p STARTED 177 393.1kb 192.168.1.198 indexer-1
wazuh-statistics-2022.48w 0 p STARTED 0 208b 192.168.1.198 indexer-1
[root@al2-indexer ~]#Everything seems to be ok regarding previous testing issues. |
Wazuh indexer cluster status 🟢Cluster status [root@al2-indexer ~]# curl -u admin:admin -k https://192.168.1.198:9200/_cluster/state/nodes?pretty
{
"cluster_name" : "wazuh-cluster",
"cluster_uuid" : "T7PdkT2OQxagXdkKLIJ1Wg",
"nodes" : {
"cajwgy70RTWJEsPCEkjxcg" : {
"name" : "indexer-1",
"ephemeral_id" : "bdycw3CFSEmOAwlZ9WiiPA",
"transport_address" : "192.168.1.198:9300",
"attributes" : {
"shard_indexing_pressure_enabled" : "true"
}
}
}
}
[root@al2-indexer ~]#Cluster health [root@al2-indexer ~]# curl -u admin:admin -k https://192.168.1.198:9200/_cluster/health?pretty
{
"cluster_name" : "wazuh-cluster",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"discovered_master" : true,
"discovered_cluster_manager" : true,
"active_primary_shards" : 7,
"active_shards" : 7,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
[root@al2-indexer ~]# |
Uninstall procedure🟢Followed this guide to proceed with the uninstall: Uninstall procedure [root@al2-indexer ~]# yum remove wazuh-indexer -y
Loaded plugins: langpacks, priorities, update-motd
Resolving Dependencies
--> Running transaction check
---> Package wazuh-indexer.x86_64 0:4.4.0-1 will be erased
--> Finished Dependency Resolution
amzn2-core/2/x86_64 | 3.7 kB 00:00:00
Dependencies Resolved
=======================================================================================================================================
Package Arch Version Repository Size
=======================================================================================================================================
Removing:
wazuh-indexer x86_64 4.4.0-1 @wazuh 644 M
Transaction Summary
=======================================================================================================================================
Remove 1 Package
Installed size: 644 M
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Stopping wazuh-indexer service... OK
Erasing : wazuh-indexer-4.4.0-1.x86_64 1/1
warning: /etc/wazuh-indexer/opensearch.yml saved as /etc/wazuh-indexer/opensearch.yml.rpmsave
Verifying : wazuh-indexer-4.4.0-1.x86_64 1/1
Removed:
wazuh-indexer.x86_64 0:4.4.0-1
Complete!
[root@al2-indexer ~]# rm -rf /var/lib/wazuh-indexer/
[root@al2-indexer ~]# rm -rf /usr/share/wazuh-indexer/
[root@al2-indexer ~]# rm -rf /etc/wazuh-indexer/Uninstall verification [root@al2-indexer ~]# systemctl status wazuh-indexer
Unit wazuh-indexer.service could not be found.
[root@al2-indexer ~]# systemctl cat wazuh-indexer.service
No files found for wazuh-indexer.service.
[root@al2-indexer ~]# rpm -qa | grep wazuh-indexer
[root@al2-indexer ~]# |
|
Regarding the 🟡 comment here: #15534 (comment) This is explained here: elastic/elasticsearch#80344 (comment), quoting:
|
E2E dataflow 🟢Once every component is deployed. It has been verified that the UI works as expected, and also alerts from the agent are reaching the UI.
|
2 tasks
Repository owner
moved this from In Review
to Done
in Release 4.4.0
Dec 7, 2022
2 tasks
3 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The following issue aims to run the specified test for the current release candidate, report the results, and open new issues for any encountered errors.
Test information
Environment
Test description
Best effort to test Wazuh indexer package. Think critically and at least review/test:
Test report procedure
All test results must have one of the following statuses:
Any failing test must be properly addressed with a new issue, detailing the error and the possible cause.
An extended report of the test results must be attached as a ZIP or TXT file. Please attach any documents, screenshots, or tables to the issue update with the results. This report can be used by the auditors to dig deeper into any possible failures and details.
Conclusions
Auditors validation
The definition of done for this one is the validation of the conclusions and the test results from all auditors.
The text was updated successfully, but these errors were encountered: