So, recently i wanted to use wazuh to monitor my systems. So, i tried to install it but for some reason i was greeted with an error. about the wazuh-indexer installation. I checked the /var/log/wazuh-install.log and there i saw that the error was saying that the /var/ossec/etc/ossec.conf file didn't exist and it failed and started removing stuff.Note that i was using the wazuh installation assistant and run sudo ./wazuh-install.sh -a -i -o i ran the "-o" parameter to fix the problem saying that i already have wazuh stuff. installed i tried running -u but it did not solve anything and dpkg is complaining about the wazuh packages being broken.
This is the logs for indexer and before it uninstalls the indexer because of failiure
19/11/2023 17:05:50 INFO: --- Wazuh indexer --- 19/11/2023 17:05:50 INFO: Starting Wazuh indexer installation. Reading package lists... Building dependency tree... Reading state information... wazuh-indexer is already the newest version (4.5.4-1). 0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded. 2 not fully installed or removed. After this operation, 0 B of additional disk space will be used. Setting up wazuh-indexer (4.5.4-1) ...^M /var/lib/dpkg/info/wazuh-indexer.postinst: 121: /usr/share/wazuh-indexer/bin/opensearch-keystore: not found^M dpkg: error processing package wazuh-indexer (--configure):^M installed wazuh-indexer package post-installation script subprocess returned error exit status 127^M Setting up wazuh-manager (4.6.0-1) ...^M /var/lib/dpkg/info/wazuh-manager.postinst: 38: cannot create /var/ossec/etc/ossec.conf: Directory nonexistent^M dpkg: error processing package wazuh-manager (--configure):^M installed wazuh-manager package post-installation script subprocess returned error exit status 2^M Processing triggers for libc-bin (2.35-0ubuntu3.4) ...^M Errors were encountered while processing:^M wazuh-indexer^M wazuh-manager^M needrestart is being skipped since dpkg has failed E: Sub-process /usr/bin/dpkg returned an error code (1) 19/11/2023 17:05:54 ERROR: Wazuh indexer installation failed.
I would need a little more context, such as the OS version, if you are virtualizing or installing Wazuh on a host.
In order to install wazuh correctly, I would recommend following the following steps:
Install wazuh on a clean host
If you already have an unfinished installation, delete it.
Perform an installation with the Wazuh assistant.