My setup:
Wazuh manager is connecting to and configuring a few thousand agents living in k8s pods.
The issue:
On upgrade to 4.2.5, the agents all shutdown at very similar times during configuration, and then restart. Some of the logging is below -- also includes complaints about missing ar.conf and strchr ' ' invalid, amongst other things. Trying to work out what we've done wrong here. The configuration isn't constantly changing, however this loop appears over and over again in the log and we get the HC_SHUTDOWN and HC_STARTUP events logged.
Any one have any ideas where to start looking?
2023/07/10 14:42:24 wazuh-agentd: INFO: Agent is restarting due to shared configuration changes.
2023/07/10 14:42:24 wazuh-modulesd:syscollector: INFO: Stop received for Syscollector.
2023/07/10 14:42:24 wazuh-logcollector: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2023/07/10 14:42:24 wazuh-syscheckd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2023/07/10 14:42:24 wazuh-agentd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2023/07/10 14:42:24 wazuh-execd: INFO: (1314): Shutdown received. Deleting responses.
2023/07/10 14:42:24 wazuh-execd: INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2023/07/10 14:42:24 wazuh-agentd: WARNING: The <server-ip> tag is deprecated, please use <server><address> instead.
2023/07/10 14:42:24 wazuh-agentd: WARNING: The <protocol> tag is deprecated, please use <server><protocol> instead.
2023/07/10 14:42:25 wazuh-execd: INFO: (1350): Active response disabled.
2023/07/10 14:42:25 wazuh-execd: INFO: Started (pid: 291).
2023/07/10 14:42:26 wazuh-agentd: WARNING: The <server-ip> tag is deprecated, please use <server><address> instead.
2023/07/10 14:42:26 wazuh-agentd: WARNING: The <protocol> tag is deprecated, please use <server><protocol> instead.
2023/07/10 14:42:26 wazuh-agentd: INFO: (1410): Reading authentication keys file.
2023/07/10 14:42:26 wazuh-agentd: INFO: Using notify time: 10 and max time to reconnect: 60
2023/07/10 14:42:26 wazuh-agentd: INFO: Version detected -> Linux |v5-sts-replica-set-xk79l |5.10.173-154.642.amzn2.x86_64 |#1 SMP Wed Mar 15 00:26:42 UTC 2023 |x86_64 [Ubuntu|ubuntu: 20.04.6 LTS (Focal Fossa)] - Wazuh v4.2.5
2023/07/10 14:42:26 wazuh-agentd: INFO: Started (pid: 302).
2023/07/10 14:42:26 wazuh-agentd: INFO: Server IP Address: <masked>
2023/07/10 14:42:26 wazuh-agentd: ERROR: (1210): Queue 'queue/alerts/execq' not accessible: 'No such file or directory'
2023/07/10 14:42:26 wazuh-agentd: INFO: Unable to connect to the active response queue (disabled).
2023/07/10 14:42:26 wazuh-agentd: INFO: Using AES as encryption method.
2023/07/10 14:42:26 wazuh-agentd: INFO: Trying to connect to server (10.127.99.6:1514/udp).
2023/07/10 14:42:27 wazuh-syscheckd: INFO: (6001): File integrity monitoring disabled.
2023/07/10 14:42:27 wazuh-syscheckd: WARNING: The check_unixaudit option is deprecated in favor of the SCA module.
2023/07/10 14:42:27 rootcheck: INFO: Rootcheck disabled.
2023/07/10 14:42:28 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/ossec/logs/alerts/alerts.log'.
2023/07/10 14:42:28 wazuh-logcollector: INFO: Started (pid: 327).
2023/07/10 14:42:29 wazuh-modulesd: INFO: Started (pid: 344).
2023/07/10 14:42:29 wazuh-modulesd:agent-upgrade: INFO: (8153): Module Agent Upgrade started.
2023/07/10 14:42:29 wazuh-modulesd:oscap: INFO: Module disabled. Exiting...
2023/07/10 14:42:29 wazuh-modulesd:syscollector: INFO: Module disabled. Exiting...
2023/07/10 14:42:29 wazuh-modulesd:osquery: INFO: Module disabled. Exiting...
2023/07/10 14:42:29 wazuh-modulesd:docker-listener: INFO: Module disabled. Exiting...
2023/07/10 14:42:29 wazuh-modulesd:ciscat: INFO: Module disabled. Exiting...
2023/07/10 14:42:29 wazuh-modulesd:aws-s3: INFO: Module AWS is disabled. Exiting...
2023/07/10 14:42:29 wazuh-modulesd:control: INFO: Starting control thread.
