Installation error

[carleslobon]

I've tried to install wazuh with this command that I got from the official documentation. However, the following error appeared and the installation finished:
curl -sO https://packages.wazuh.com/4.10/wazuh-install.sh && sudo bash ./wazuh-install.sh -a
19/02/2025 09:38:01 INFO: Starting Wazuh installation assistant. Wazuh version: 4.10.1
19/02/2025 09:38:01 INFO: Verbose logging redirected to /var/log/wazuh-install.log
19/02/2025 09:38:07 INFO: Verifying that your system meets the recommended minimum hardware requirements.
19/02/2025 09:38:07 INFO: Wazuh web interface port will be 443.
19/02/2025 09:38:17 INFO: Wazuh repository added.
19/02/2025 09:38:17 INFO: --- Configuration files ---
19/02/2025 09:38:17 INFO: Generating configuration files.
19/02/2025 09:38:17 INFO: Generating the root certificate.
19/02/2025 09:38:17 INFO: Generating Admin certificates.
19/02/2025 09:38:17 INFO: Generating Wazuh indexer certificates.
19/02/2025 09:38:17 INFO: Generating Filebeat certificates.
19/02/2025 09:38:18 INFO: Generating Wazuh dashboard certificates.
19/02/2025 09:38:18 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
19/02/2025 09:38:18 INFO: --- Wazuh indexer ---
19/02/2025 09:38:18 INFO: Starting Wazuh indexer installation.
19/02/2025 09:43:12 INFO: Wazuh indexer installation finished.
19/02/2025 09:43:12 INFO: Wazuh indexer post-install configuration finished.
19/02/2025 09:43:12 INFO: Starting service wazuh-indexer.
19/02/2025 09:43:21 INFO: wazuh-indexer service started.
19/02/2025 09:43:21 INFO: Initializing Wazuh indexer cluster security settings.
19/02/2025 09:43:24 INFO: Wazuh indexer cluster security configuration initialized.
19/02/2025 09:43:24 INFO: Wazuh indexer cluster initialized.
19/02/2025 09:43:24 INFO: --- Wazuh server ---
19/02/2025 09:43:24 INFO: Starting the Wazuh manager installation.
19/02/2025 09:46:25 INFO: Wazuh manager installation finished.
19/02/2025 09:46:25 INFO: Wazuh manager vulnerability detection configuration finished.
19/02/2025 09:46:25 INFO: Starting service wazuh-manager.
19/02/2025 09:46:41 INFO: wazuh-manager service started.
19/02/2025 09:46:41 INFO: Starting Filebeat installation.
19/02/2025 09:47:27 INFO: Filebeat installation finished.
19/02/2025 09:47:29 INFO: Filebeat post-install configuration finished.
19/02/2025 09:47:29 INFO: Starting service filebeat.
19/02/2025 09:47:30 INFO: filebeat service started.
19/02/2025 09:47:30 INFO: --- Wazuh dashboard ---
19/02/2025 09:47:30 INFO: Starting Wazuh dashboard installation.
^[OR19/02/2025 09:51:33 INFO: Wazuh dashboard installation finished.
19/02/2025 09:51:33 INFO: Wazuh dashboard post-install configuration finished.
19/02/2025 09:51:33 INFO: Starting service wazuh-dashboard.
19/02/2025 09:51:34 INFO: wazuh-dashboard service started.
19/02/2025 09:51:36 INFO: Updating the internal users.
19/02/2025 09:51:42 INFO: A backup of the internal users has been saved in the /etc/wazuh-indexer/internalusers-backup folder.
19/02/2025 09:51:55 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password.
19/02/2025 09:52:37 ERROR: Could not load the changes.

[Desvelao]

Research

Reviewing the source code for the installation script for 4.10.x (https://packages.wazuh.com/4.10/wazuh-install.sh), the error seems to be coming from this piece of code:

eval "OPENSEARCH_CONF_DIR=/etc/wazuh-indexer /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/backup/internal_users.yml -t internalusers -p 9200 -nhnv -cacert ${capem} -cert ${adminpem} -key ${adminkey} -icl -h ${IP} ${debug}"
    if [  "${PIPESTATUS[0]}" != 0  ]; then
        common_logger -e "Could not load the changes."
        exit 1;
    fi

The error log seems to be emitted by the following line:

common_logger -e "Could not load the changes."

And this log is emitted if the condition is fulfilled. The condition seems to check the exit code of the previous command:

eval "OPENSEARCH_CONF_DIR=/etc/wazuh-indexer /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/backup/internal_users.yml -t internalusers -p 9200 -nhnv -cacert 

that tries to update the internal users of the Wazuh indexer, so I guess it could have some problem in that action:

• Issues reading or parsing the internal_users.yml file.
• Problems with certificate-based authentication (if any of the certificate file variables like ${capem}, ${adminpem}, or ${adminkey} are incorrect).
• Connectivity issues with the Wazun indexer service at ${IP}.
• Misconfigurations or internal errors within the securityadmin.sh script itself.

Could you solve the problem?

If you need more assistance, provide the /var/log/wazuh-install.log that is generated by the wazuh-install.sh script. Additionally, consider to run the script in verbose mode using the -v option:

curl -sO https://packages.wazuh.com/4.10/wazuh-install.sh && sudo bash ./wazuh-install.sh -a -v

Lab

I tried the script in a fresh installation and I could not replicate the problem:

curl -sO https://packages.wazuh.com/4.10/wazuh-install.sh && sudo bash ./wazuh-install.sh -a
19/05/2025 09:53:23 INFO: Starting Wazuh installation assistant. Wazuh version: 4.10.1
19/05/2025 09:53:23 INFO: Verbose logging redirected to /var/log/wazuh-install.log
19/05/2025 09:53:23 INFO: Verifying that your system meets the recommended minimum hardware requirements.
19/05/2025 09:53:23 INFO: Wazuh web interface port will be 443.
19/05/2025 09:53:23 INFO: --- Dependencies ---
19/05/2025 09:53:23 INFO: Installing lsof.
19/05/2025 09:53:45 INFO: Wazuh repository added.
19/05/2025 09:53:45 INFO: --- Configuration files ---
19/05/2025 09:53:45 INFO: Generating configuration files.
19/05/2025 09:53:45 INFO: Generating the root certificate.
19/05/2025 09:53:45 INFO: Generating Admin certificates.
19/05/2025 09:53:45 INFO: Generating Wazuh indexer certificates.
19/05/2025 09:53:45 INFO: Generating Filebeat certificates.
19/05/2025 09:53:45 INFO: Generating Wazuh dashboard certificates.
19/05/2025 09:53:46 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
19/05/2025 09:53:46 INFO: --- Wazuh indexer ---
19/05/2025 09:53:46 INFO: Starting Wazuh indexer installation.
19/05/2025 09:55:30 INFO: Wazuh indexer installation finished.
19/05/2025 09:55:30 INFO: Wazuh indexer post-install configuration finished.
19/05/2025 09:55:30 INFO: Starting service wazuh-indexer.
19/05/2025 09:56:01 INFO: wazuh-indexer service started.
19/05/2025 09:56:01 INFO: Initializing Wazuh indexer cluster security settings.
19/05/2025 09:56:05 INFO: Wazuh indexer cluster security configuration initialized.
19/05/2025 09:56:05 INFO: Wazuh indexer cluster initialized.
19/05/2025 09:56:05 INFO: --- Wazuh server ---
19/05/2025 09:56:05 INFO: Starting the Wazuh manager installation.
19/05/2025 09:58:09 INFO: Wazuh manager installation finished.
19/05/2025 09:58:09 INFO: Wazuh manager vulnerability detection configuration finished.
19/05/2025 09:58:09 INFO: Starting service wazuh-manager.
19/05/2025 09:58:21 INFO: wazuh-manager service started.
19/05/2025 09:58:21 INFO: Starting Filebeat installation.
19/05/2025 09:58:40 INFO: Filebeat installation finished.
19/05/2025 09:58:44 INFO: Filebeat post-install configuration finished.
19/05/2025 09:58:44 INFO: Starting service filebeat.
19/05/2025 09:58:45 INFO: filebeat service started.
19/05/2025 09:58:45 INFO: --- Wazuh dashboard ---
19/05/2025 09:58:45 INFO: Starting Wazuh dashboard installation.
19/05/2025 10:01:43 INFO: Wazuh dashboard installation finished.
19/05/2025 10:01:45 INFO: Wazuh dashboard post-install configuration finished.
19/05/2025 10:01:45 INFO: Starting service wazuh-dashboard.
19/05/2025 10:01:47 INFO: wazuh-dashboard service started.
19/05/2025 10:01:47 INFO: Updating the internal users.
19/05/2025 10:02:33 INFO: A backup of the internal users has been saved in the /etc/wazuh-indexer/internalusers-backup folder.
19/05/2025 10:03:50 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password.
19/05/2025 10:05:25 INFO: Initializing Wazuh dashboard web application.
19/05/2025 10:05:25 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:05:41 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:05:56 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:06:12 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:06:27 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:06:42 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:06:57 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:07:12 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:07:27 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:07:42 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:07:58 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:08:14 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:08:29 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:08:44 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:09:01 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:09:19 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:09:34 INFO: Wazuh dashboard web application not yet initialized. Waiting...
19/05/2025 10:09:49 INFO: Wazuh dashboard web application initialized.
19/05/2025 10:09:49 INFO: --- Summary ---
19/05/2025 10:09:49 INFO: You can access the web interface https://<wazuh-dashboard-ip>:443
    User: admin
    Password: *******************************
19/05/2025 10:09:49 INFO: --- Dependencies ---
19/05/2025 10:09:49 INFO: Removing lsof.
19/05/2025 10:09:51 INFO: Installation finished.