Wazuh 4.2.5版本K8s环境下Agent持续重启问题排查求助
Wazuh 4.2.5版本K8s环境下Agent持续重启问题排查求助
大家好,我这边碰到个头疼的问题想请教下社区的朋友们:
我的环境情况是:Wazuh Manager正在连接并配置K8s Pod中的几千个Agent。
最近遇到的问题:
升级到4.2.5版本后,所有Agent都会在配置过程中几乎同时关机,随后又重启。日志里这个循环反复出现,还能看到HC_SHUTDOWN和HC_STARTUP事件被记录。除此之外,日志里还有找不到ar.conf、strchr ' ' invalid之类的报错信息。我们的配置并没有频繁变更,实在搞不懂哪里出问题了。
有没有朋友能指点下,我该从哪些方向入手排查这个问题?
附相关日志片段:
2023/07/10 14:42:24 wazuh-agentd: INFO: Agent is restarting due to shared configuration changes. 2023/07/10 14:42:24 wazuh-modulesd:syscollector: INFO: Stop received for Syscollector. 2023/07/10 14:42:24 wazuh-logcollector: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning... 2023/07/10 14:42:24 wazuh-syscheckd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning... 2023/07/10 14:42:24 wazuh-agentd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning... 2023/07/10 14:42:24 wazuh-execd: INFO: (1314): Shutdown received. Deleting responses. 2023/07/10 14:42:24 wazuh-execd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning... 2023/07/10 14:42:24 wazuh-agentd: WARNING: The <server-ip> tag is deprecated, please use <server><address> instead. 2023/07/10 14:42:24 wazuh-agentd: WARNING: The <protocol> tag is deprecated, please use <server><protocol> instead. 2023/07/10 14:42:25 wazuh-execd: INFO: (1350): Active response disabled. 2023/07/10 14:42:25 wazuh-execd: INFO: Started (pid: 291). 2023/07/10 14:42:26 wazuh-agentd: WARNING: The <server-ip> tag is deprecated, please use <server><address> instead. 2023/07/10 14:42:26 wazuh-agentd: WARNING: The <protocol> tag is deprecated, please use <server><protocol> instead. 2023/07/10 14:42:26 wazuh-agentd: INFO: (1410): Reading authentication keys file. 2023/07/10 14:42:26 wazuh-agentd: INFO: Using notify time: 10 and max time to reconnect: 60 2023/07/10 14:42:26 wazuh-agentd: INFO: Version detected -> Linux |v5-sts-replica-set-xk79l |5.10.173-154.642.amzn2.x86_64 |#1 SMP Wed Mar 15 00:26:42 UTC 2023 |x86_64 [Ubuntu|ubuntu: 20.04.6 LTS (Focal Fossa)] - Wazuh v4.2.5 2023/07/10 14:42:26 wazuh-agentd: INFO: Started (pid: 302). 2023/07/10 14:42:26 wazuh-agentd: INFO: Server IP Address: <masked> 2023/07/10 14:42:26 wazuh-agentd: ERROR: (1210): Queue 'queue/alerts/execq' not accessible: 'No such file or directory' 2023/07/10 14:42:26 wazuh-agentd: INFO: Unable to connect to the active response queue (disabled). 2023/07/10 14:42:26 wazuh-agentd: INFO: Using AES as encryption method. 2023/07/10 14:42:26 wazuh-agentd: INFO: Trying to connect to server (10.127.99.6:1514/udp). 2023/07/10 14:42:27 wazuh-syscheckd: INFO: (6001): File integrity monitoring disabled. 2023/07/10 14:42:27 wazuh-syscheckd: WARNING: The check_unixaudit option is deprecated in favor of the SCA module. 2023/07/10 14:42:27 rootcheck: INFO: Rootcheck disabled. 2023/07/10 14:42:28 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/ossec/logs/alerts/alerts.log'. 2023/07/10 14:42:28 wazuh-logcollector: INFO: Started (pid: 327). 2023/07/10 14:42:29 wazuh-modulesd: INFO: Started (pid: 344). 2023/07/10 14:42:29 wazuh-modulesd:agent-upgrade: INFO: (8153): Module Agent Upgrade started. 2023/07/10 14:42:29 wazuh-modulesd:oscap: INFO: Module disabled. Exiting... 2023/07/10 14:42:29 wazuh-modulesd:syscollector: INFO: Module disabled. Exiting... 2023/07/10 14:42:29 wazuh-modulesd:osquery: INFO: Module disabled. Exiting... 2023/07/10 14:42:29 wazuh-modulesd:docker-listener: INFO: Module disabled. Exiting... 2023/07/10 14:42:29 wazuh-modulesd:ciscat: INFO: Module disabled. Exiting... 2023/07/10 14:42:29 wazuh-modulesd:aws-s3: INFO: Module AWS is disabled. Exiting... 2023/07/10 14:42:29 wazuh-modulesd:control: INFO: Starting control thread.
备注:内容来源于stack exchange,提问作者David Boshton
相关产品推荐
相关产品推荐

