TSYS Group » Chief Operations Officer » Known Element Enterprises - Technology & Facility Services

[#422] DIAGNOSIS COMPLETE — Wazuh installation is severely broken, NOT just a repo config issue.

Findings¶

apt-get update runs CLEAN (no wazuh repo configured, so no repo error). The real problem is that all three Wazuh packages have critically corrupted installations:

dpkg -V results (all three packages):¶

• wazuh-indexer: ALL files missing — no /usr/share/wazuh-indexer/bin/, no /etc/wazuh-indexer/, no /var/lib/wazuh-indexer/. Binary systemd-entrypoint doesn't exist (systemd error 203/EXEC). Service has been FAILING since Jul 27 (5 boots).
• wazuh-manager: ALL files missing — no /var/ossec/, no /etc/init.d/wazuh-manager. Service is DISABLED.
• wazuh-dashboard: Status install reinstreq half-installed. Missing md5sums + list control files.

Additional issues:¶

• Java/OpenJDK not installed (required by wazuh-indexer)
• No Wazuh apt repo configured at all (packages.wazuh.com absent from sources)
• No config files exist anywhere (/etc/wazuh-indexer/opensearch.yml missing)
• No data directories exist (/var/lib/wazuh-indexer/, /var/ossec/ both absent)
• Disk space OK (116GB free)

Assessment:¶

This is an aborted or corrupted installation. dpkg metadata shows packages as 'installed' but actual files were never extracted or were deleted. A simple repo fix will not resolve this — the packages need full purge + reinstall.

Proposed fix (SUB-TICKET recommended):¶

1. Add official Wazuh 4.x apt repository + GPG key
2. apt purge wazuh-manager wazuh-indexer wazuh-dashboard (clean slate)
3. apt install wazuh-manager wazuh-indexer wazuh-dashboard (fresh from repo)
4. Configure indexer (certificates, cluster settings)
5. Enable + start all services
6. Verify operational (indexer health, manager status, dashboard UI)

This goes well beyond 'fix repo config' — recommending a sub-ticket for the full Wazuh rebuild. The repo config alone is straightforward, but making Wazuh operational requires a full deployment cycle.