FIM and Syscollector IT fails for Windows agent due to error deleting old db

[Rebits]

Wazuh version	Component	Install type	Install method	Platform
4.8.0-beta4	FIM/Sycollector	Agent	Packages	Windows Server 2016

Description

FIM and syscollector integration tests fail for Windows agents due to an unexpected error deleting old db.

2024/03/12 18:19:48 wazuh-agent[2908] logging_helper.c:53 at loggingFunction(): CRITICAL: Error, id: dbEngine: Error deleting old db.

The roster of IT failures includes:

• test_file_limit_full
• test_file_limit_no_limit
• test_syscollector_configuration

Related Issues

• Wazuh stops when an invalid Syscollector configuration is applied #18968
• Syscollector tests fail with invalid configuration wazuh-qa#4556
• Release 4.6.0 - Alpha 1 - Integration tests #18941

Evidences

• Syscollector IT Windows Agent: https://s3.amazonaws.com/ci.wazuh.com/data/Test_integration/B46645/agent_windows_html_report_Test_integration_B46645.zip
• FIM IT Windows Agent: https://s3.amazonaws.com/ci.wazuh.com/data/Test_integration/B46654/agent_windows_html_report_Test_integration_B46654.zip

[Dwordcito]

TIMEBOX RCA 19/03/2024

[MiguelazoDS]

The issue may be related to this

https://en.cppreference.com/w/cpp/io/c/remove

If the file is currently open by any process, the behavior of this function is implementation-defined. POSIX systems unlink the file name (directory entry), but the filesystem space used by the file is not reclaimed while it is open in any process and while other hard links to the file exist. Windows does not allow the file to be deleted in such cases.

[Dwordcito]

@MiguelazoDS this is a flaky test ??? Is reproducible in previous versions?

[MiguelazoDS]

@Dwordcito This was executed with Jenkins, I'm trying to reproduce it locally to discard that possibility, but if I have to guess, I don't think it's a flaky test. I have to take a deeper look at these tests but some handle must be preventing the delete operation for Windows

[MiguelazoDS]

Update 04/04

Unable to reproduce the Syscollector errors

syscollector.tar.gz

Unable to reproduce the FIM errors

fim.tar.gz

Conclusion

I was not able to reproduce this behavior by running the tests several times, and this seems to be an old issue addressed here for 4.6.0 #18968

@Rebits are you able to reproduce this locally?

A new run on the environment that triggered the failing test must be performed.

[Dwordcito]

Moved to 4.8.2, this part of the code has not changed in 4.8.0, is a pre-existing issue.

[sebasfalcone]

We conclude that this issue has to do with the test itself and not with the product, as stated here:

• Wazuh stops when an invalid Syscollector configuration is applied #18968 (comment)

And also concluded here:

• Wazuh stops when an invalid Syscollector configuration is applied #18968 (comment)

The issue may be addressed here:

• Refactor and migrate FIM integration tests from QA repository to Core repository #17881