Unexpected errors and warnings in the vulnerability detection E2E tests #5698
Comments
|
We can check that all these warnings/errors can be splitter to: Unexpected connection error of
|
|
|
On hold due to no macOS are available: wazuh/wazuh#25345 |
|
In order to test this development along with #5699 it was created the branch I am currently testing over 4.9.0-rc2. |
|
A new build was launched to include newer changes in #5699 (comment) |
ConclusionThe current approach results in constant updates of non-critical warnings in the expected list. To address this, we've decided to remove warning messages from the unexpected lists, reducing false positive errors related to manager connections, networking, and similar issues. Additionally, a delay was introduced between the startup of the manager and the agents. This ensures the manager has time to fully initialize before the agents start, thereby preventing potential connection errors. |
|
LGTM |
|
Waiting until #5715 to tests changes in the same build |
Report analysisThe evidence can be found at #5698 (comment) Cluster connection error before the test startedWe can notice in the manager2 errors in authd and db daemons related to the registrations of some agents: This behavior has led to agent2 not being registered, making failing the initial tests. However, we can see that the agent in the rest of the tests registers with the manager and its vulnerabilities are being detected correctly. These errors appear before the tests start, during the provision stages. A similar error was reported in wazuh/wazuh#20915, wazuh/wazuh#22855 and wazuh/wazuh#16464. This race condition was [discarded](see wazuh/wazuh#22855 (comment)) due to the low impact (agent finally registered). Regarding Vulnerability E2E, it was created an issue to mitigate this issue #5746 Missing vulnerabilitiesKnown issues specified in wazuh/wazuh#25506 |
|
#5746 should not be necessary, since what is intended to be fixed in the new issue are the same connection errors reported in the main comment, so this should be fixed in this issue itself. |
|
In the provisioning trace, we can see the following error that could specifically explain the errors regarding the cluster It seems that the retry in the provisioning could lead to an unstable state where is more probable that unexpected errors or warnings like the specified in the issue occur. I suggest including a retry logic in this task. |
|
Build after applying changes in provisioning methods: https://ci.wazuh.info/job/Test_e2e_system/384 |
Description
Unexpected errors and warnings were reported in wazuh/wazuh#25363. It's necessary to perform a thorough research of them and include in case of they are expected in the errors to ignore dictionary in the vulnerability tests.
Evidences
Report: wazuh/wazuh#25363 (comment)
{ "manager1": { "ERROR": [], "CRITICAL": [], "WARNING": [ "2024/08/25 19:48:46 wazuh-authd: WARNING: Duplicate name 'agent5', rejecting enrollment. Agent '002' has not been disconnected long enough to be replaced." ] }, "manager2": { "ERROR": [ "2024/08/25 19:48:44 wazuh-authd: ERROR: Could not send message through the cluster after '10' attempts." ], "CRITICAL": [], "WARNING": [ "2024/08/25 19:48:35 wazuh-authd: WARNING: Could not connect to socket 'queue/cluster/c-internal.sock': Connection refused (111).", "2024/08/25 19:48:36 wazuh-authd: WARNING: Could not connect to socket 'queue/cluster/c-internal.sock': Connection refused (111).", "2024/08/25 19:48:37 wazuh-authd: WARNING: Could not connect to socket 'queue/cluster/c-internal.sock': Connection refused (111).", "2024/08/25 19:48:38 wazuh-authd: WARNING: Could not connect to socket 'queue/cluster/c-internal.sock': Connection refused (111).", "2024/08/25 19:48:39 wazuh-authd: WARNING: Could not connect to socket 'queue/cluster/c-internal.sock': Connection refused (111).", "2024/08/25 19:48:40 wazuh-authd: WARNING: Could not connect to socket 'queue/cluster/c-internal.sock': Connection refused (111).", "2024/08/25 19:48:41 wazuh-authd: WARNING: Could not connect to socket 'queue/cluster/c-internal.sock': Connection refused (111).", "2024/08/25 19:48:42 wazuh-authd: WARNING: Could not connect to socket 'queue/cluster/c-internal.sock': Connection refused (111).", "2024/08/25 19:48:43 wazuh-authd: WARNING: Could not connect to socket 'queue/cluster/c-internal.sock': Connection refused (111).", "2024/08/25 19:48:44 wazuh-authd: WARNING: Could not connect to socket 'queue/cluster/c-internal.sock': Connection refused (111).", "2024/08/25 19:48:44 wazuh-authd: WARNING: Could not connect to socket 'queue/cluster/c-internal.sock': Connection refused (111).", "2024/08/25 19:48:45 wazuh-authd: WARNING: Could not connect to socket 'queue/cluster/c-internal.sock': Connection refused (111).", "2024/08/25 19:48:46 wazuh-authd: WARNING: 9008: Duplicate name" ] }, "agent1": { "ERROR": [], "CRITICAL": [], "WARNING": [] }, "agent3": { "ERROR": [], "CRITICAL": [], "WARNING": [] }, "agent4": { "ERROR": [], "CRITICAL": [], "WARNING": [ "2024/08/25 19:38:26 wazuh-agentd: WARNING: Couldn't connect to server '172.31.0.85': 'Agent version must be lower or equal to manager version'" ] }, "agent5": { "ERROR": [ "2024/08/25 19:47:48 wazuh-agentd: ERROR: (1208): Unable to connect to enrollment service at '[172.31.9.129]:1515'", "2024/08/25 19:48:13 wazuh-agentd: ERROR: (1208): Unable to connect to enrollment service at '[172.31.9.129]:1515'", "2024/08/25 19:48:46 wazuh-agentd: ERROR: Duplicate name (from manager)", "2024/08/25 19:48:46 wazuh-agentd: ERROR: Unable to add agent (from manager)" ], "CRITICAL": [], "WARNING": [] }, "agent6": { "ERROR": [], "CRITICAL": [], "WARNING": [] }, "agent2": { "ERROR": [ "2024/08/25 19:48:00 wazuh-agent: ERROR: (1208): Unable to connect to enrollment service at '[172.31.9.129]:1515'\r", "2024/08/25 19:48:44 wazuh-agent: ERROR: Cannot comunicate with master (from manager)\r", "2024/08/25 19:48:44 wazuh-agent: ERROR: Unable to add agent (from manager)\r" ], "CRITICAL": [], "WARNING": [] } }Tasks
Report unexpected errors to developer teams with a replication guideNot needed, those warnings were expectedThe text was updated successfully, but these errors were encountered: