You need to enable JavaScript to run this app.
优惠活动
大模型
产品
解决方案
定价
更多

Wazuh 4.2.5版本K8s环境下Agent持续重启问题排查求助

Wazuh 4.2.5版本K8s环境下Agent持续重启问题排查求助

大家好,我这边碰到个头疼的问题想请教下社区的朋友们:

我的环境情况是:Wazuh Manager正在连接并配置K8s Pod中的几千个Agent。

最近遇到的问题:
升级到4.2.5版本后,所有Agent都会在配置过程中几乎同时关机,随后又重启。日志里这个循环反复出现,还能看到HC_SHUTDOWN和HC_STARTUP事件被记录。除此之外,日志里还有找不到ar.conf、strchr ' ' invalid之类的报错信息。我们的配置并没有频繁变更,实在搞不懂哪里出问题了。

有没有朋友能指点下,我该从哪些方向入手排查这个问题?

附相关日志片段:

2023/07/10 14:42:24 wazuh-agentd: INFO: Agent is restarting due to shared configuration changes.

2023/07/10 14:42:24 wazuh-modulesd:syscollector: INFO: Stop received for Syscollector.

2023/07/10 14:42:24 wazuh-logcollector: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...

2023/07/10 14:42:24 wazuh-syscheckd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...

2023/07/10 14:42:24 wazuh-agentd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...

2023/07/10 14:42:24 wazuh-execd: INFO: (1314): Shutdown received. Deleting responses.

2023/07/10 14:42:24 wazuh-execd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...

2023/07/10 14:42:24 wazuh-agentd: WARNING: The <server-ip> tag is deprecated, please use <server><address> instead.

2023/07/10 14:42:24 wazuh-agentd: WARNING: The <protocol> tag is deprecated, please use <server><protocol> instead.

2023/07/10 14:42:25 wazuh-execd: INFO: (1350): Active response disabled.

2023/07/10 14:42:25 wazuh-execd: INFO: Started (pid: 291).

2023/07/10 14:42:26 wazuh-agentd: WARNING: The <server-ip> tag is deprecated, please use <server><address> instead.

2023/07/10 14:42:26 wazuh-agentd: WARNING: The <protocol> tag is deprecated, please use <server><protocol> instead.

2023/07/10 14:42:26 wazuh-agentd: INFO: (1410): Reading authentication keys file.

2023/07/10 14:42:26 wazuh-agentd: INFO: Using notify time: 10 and max time to reconnect: 60

2023/07/10 14:42:26 wazuh-agentd: INFO: Version detected -> Linux |v5-sts-replica-set-xk79l |5.10.173-154.642.amzn2.x86_64 |#1 SMP Wed Mar 15 00:26:42 UTC 2023 |x86_64 [Ubuntu|ubuntu: 20.04.6 LTS (Focal Fossa)] - Wazuh v4.2.5

2023/07/10 14:42:26 wazuh-agentd: INFO: Started (pid: 302).

2023/07/10 14:42:26 wazuh-agentd: INFO: Server IP Address: <masked>

2023/07/10 14:42:26 wazuh-agentd: ERROR: (1210): Queue 'queue/alerts/execq' not accessible: 'No such file or directory'

2023/07/10 14:42:26 wazuh-agentd: INFO: Unable to connect to the active response queue (disabled).

2023/07/10 14:42:26 wazuh-agentd: INFO: Using AES as encryption method.

2023/07/10 14:42:26 wazuh-agentd: INFO: Trying to connect to server (10.127.99.6:1514/udp).

2023/07/10 14:42:27 wazuh-syscheckd: INFO: (6001): File integrity monitoring disabled.

2023/07/10 14:42:27 wazuh-syscheckd: WARNING: The check_unixaudit option is deprecated in favor of the SCA module.

2023/07/10 14:42:27 rootcheck: INFO: Rootcheck disabled.

2023/07/10 14:42:28 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/ossec/logs/alerts/alerts.log'.

2023/07/10 14:42:28 wazuh-logcollector: INFO: Started (pid: 327).

2023/07/10 14:42:29 wazuh-modulesd: INFO: Started (pid: 344).

2023/07/10 14:42:29 wazuh-modulesd:agent-upgrade: INFO: (8153): Module Agent Upgrade started.

2023/07/10 14:42:29 wazuh-modulesd:oscap: INFO: Module disabled. Exiting...

2023/07/10 14:42:29 wazuh-modulesd:syscollector: INFO: Module disabled. Exiting...

2023/07/10 14:42:29 wazuh-modulesd:osquery: INFO: Module disabled. Exiting...

2023/07/10 14:42:29 wazuh-modulesd:docker-listener: INFO: Module disabled. Exiting...

2023/07/10 14:42:29 wazuh-modulesd:ciscat: INFO: Module disabled. Exiting...

2023/07/10 14:42:29 wazuh-modulesd:aws-s3: INFO: Module AWS is disabled. Exiting...

2023/07/10 14:42:29 wazuh-modulesd:control: INFO: Starting control thread.

备注:内容来源于stack exchange,提问作者David Boshton

相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级,最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分), 限时 9.9 元起

最近更新时间:2026.04.22 07:13:14