Recurring Issues with Keeping a Persistent Wazuh Instance

[TopHatProductions115new]

I've been attempting to use Wazuh for a while. But, I've never been able to keep a single instance functional for long-term use.

With each attempt, I used the installation guide listed here (for the latest version available at the time):

• https://documentation.wazuh.com/current/deployment-options/docker/wazuh-container.html

I made any configuration changes that I needed (change password, apply certificates, etc.) to complete the initial setup. After setup, I can see connected agents and their metrics, security suggestions, etc. After having checked container logs (through Portainer), everything seems to be fine.

I then check back for the next few days, and nothing appears to be wrong. I change no settings after initial setup.

But when I come back weeks (or even months) later, the service either no longer starts or doesn't accept my username/password.

My latest attempt was with Wazuh 4.8.0. While I would like to move to 4.9.X, I'm wondering if I'll run into this same issue again.

The host that the containers are running on:

• OS: Artix OpenRC
• CPU: 16 vCPUs (Intel Xeon E7-8870)
• RAM: 96GB DDR3 ECC (usually sits ~60% usage)
• HDD: 5TB (~10% full)

For this attempt, I saw the following from the container logs for the Indexer:

and this from the Dashboard's container logs:

After a quick search online (for the first screenshot), I saw some posts stating that it may be a JVM memory issue (potentially running out of memory?) -- which led me to these:

• https://documentation.wazuh.com/current/user-manual/wazuh-indexer/wazuh-indexer-tuning.html
• https://www.reddit.com/r/Wazuh/comments/154ljfu/comment/jsphblb/

Am I on the right track? Is my instance configured incorrectly? How should I proceed?

[TopHatProductions115new]

Currently testing the following change(s):

Default settings are way lower for JVM, iirc. Is it less than 1GB for many systems? I could be wrong...

[TopHatProductions115new]

The previous changes appear to have worked. I'll leave this here, in case anyone else needs it.