Job for wazuh-agent.service failed because message was found during agent testing

[pro-akim]

Target version	Related issue	Related PR/dev branch
4.9.0	wazuh/wazuh#23748	#5689

The message:

It does not interfere with the tests themselves, but its nature should be investigated.
�[0;33m    Job for wazuh-agent.service failed because the control process exited with error code.�[0m
�[0;33m    See "systemctl status wazuh-agent.service" and "journalctl -xeu wazuh-agent.service" for details.�[0m

It was found during agent testing in deployability tests (install process).

It does not interfere with the tests themselves, but its nature should be investigated.

[hossam1522]

The problem could be replicated on Ubuntu 24.04 on both amd64 and arm64 architecture. The error seems to be consistent. An attempt will be made to replicate the test locally using an Ubuntu 24.04 machine and doing the installation test manually based on the automated test (https://github.com/wazuh/wazuh-qa/blob/4.9.1/deployability/modules/testing/tests/test_agent/test_install.py) to see if anything comes up.

[hossam1522]

I have managed to reproduce the error locally by using the following script on an Ubuntu 24.04 machine in Vagrant

#!/bin/bash

wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.9.0-1_amd64.deb && sudo WAZUH_MANAGER='MANAGER_IP' WAZUH_AGENT_NAME='Prueba' dpkg -i ./wazuh-agent_4.9.0-1_amd64.deb
systemctl daemon-reload
systemctl enable wazuh-agent
systemctl start wazuh-agent
systemctl status wazuh-agent

And if I do systemctl status wazuh-agent after starting the service, I get the following output:

root@ubuntu24:/home/vagrant# systemctl status wazuh-agent
× wazuh-agent.service - Wazuh agent
     Loaded: loaded (/usr/lib/systemd/system/wazuh-agent.service; enabled; preset: enabled)
     Active: failed (Result: exit-code) since Fri 2024-09-20 14:59:48 UTC; 2s ago
    Process: 3450 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=1/FAILURE)
        CPU: 20ms

Sep 20 14:59:48 ubuntu24 systemd[1]: Starting wazuh-agent.service - Wazuh agent...
Sep 20 14:59:48 ubuntu24 env[3458]: 2024/09/20 14:59:48 wazuh-agentd: ERROR: (4112): Invalid server address found: 'MANAGER_IP'
Sep 20 14:59:48 ubuntu24 env[3458]: 2024/09/20 14:59:48 wazuh-agentd: ERROR: (1215): No client configured. Exiting.
Sep 20 14:59:48 ubuntu24 env[3450]: wazuh-agentd: Configuration error. Exiting
Sep 20 14:59:48 ubuntu24 systemd[1]: wazuh-agent.service: Control process exited, code=exited, status=1/FAILURE
Sep 20 14:59:48 ubuntu24 systemd[1]: wazuh-agent.service: Failed with result 'exit-code'.
Sep 20 14:59:48 ubuntu24 systemd[1]: Failed to start wazuh-agent.service - Wazuh agent.

I tried to restart the service, but the same error was displayed. As you can see, the error is caused by the lack of a manager IP in the agent configuration. After deploying a manager and setting its ip in the configuration, when starting the service everything works perfectly again:

root@ubuntu24:/home/vagrant# sed -i 's/<address>MANAGER_IP<\/address>/<address>172.16.1.20<\/address>/g' /var/ossec/etc/ossec.conf
root@ubuntu24:/home/vagrant# systemctl start wazuh-agent
root@ubuntu24:/home/vagrant# systemctl status wazuh-agent
● wazuh-agent.service - Wazuh agent
     Loaded: loaded (/usr/lib/systemd/system/wazuh-agent.service; enabled; preset: enabled)
     Active: active (running) since Fri 2024-09-20 15:32:14 UTC; 3s ago
    Process: 3522 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=0/SUCCESS)
      Tasks: 29 (limit: 4613)
     Memory: 15.6M (peak: 18.3M)
        CPU: 334ms
     CGroup: /system.slice/wazuh-agent.service
             ├─3544 /var/ossec/bin/wazuh-execd
             ├─3555 /var/ossec/bin/wazuh-agentd
             ├─3568 /var/ossec/bin/wazuh-syscheckd
             ├─3578 /var/ossec/bin/wazuh-logcollector
             └─3592 /var/ossec/bin/wazuh-modulesd

Sep 20 15:32:09 ubuntu24 systemd[1]: Starting wazuh-agent.service - Wazuh agent...
Sep 20 15:32:09 ubuntu24 env[3522]: Starting Wazuh v4.9.0...
Sep 20 15:32:10 ubuntu24 env[3522]: Started wazuh-execd...
Sep 20 15:32:11 ubuntu24 env[3522]: Started wazuh-agentd...
Sep 20 15:32:11 ubuntu24 env[3522]: Started wazuh-syscheckd...
Sep 20 15:32:11 ubuntu24 env[3522]: Started wazuh-logcollector...
Sep 20 15:32:12 ubuntu24 env[3522]: Started wazuh-modulesd...
Sep 20 15:32:14 ubuntu24 env[3522]: Completed.
Sep 20 15:32:14 ubuntu24 systemd[1]: Started wazuh-agent.service - Wazuh agent.

This is exactly what is done in the registration test (https://github.com/wazuh/wazuh-qa/blob/4.9.1/deployability/modules/testing/tests/test_agent/test_registration.py), where the manager ip is added and the service is restarted, which starts without any problem.

[hossam1522]

A new branch has been created to solve the problem:

• 4.10.0...bug/5741-error-at-agent-start

A test has been executed. As can be seen in the logs, everything works perfectly and the warning reported in the issue no longer appears:

• agent.log

A pull request has been created:

• Changed wazuh-agent service start from install test to registration test #5762

[joaquinsgi]

LGTM!