Wazuh: daemon ossec-integratord exit in 1 hour after start

[godunko-v]

Hello. Can you help with ossec-integratord crash?

|Wazuh version|Component|Install type|Install method|Platform|
|---|---|---|---|---|
| 3.12.0-2 | ossec-integratord | Manager | Packages | Ubuntu 18.04.4 LTS |

I use integration for pagerduty with simple manager config:

  <integration>
    <name>pagerduty</name>
    <api_key>API KEY</api_key> <!-- Replace with your PagerDuty API key -->
    <level>8</level>
  </integration>

It works for some time, but after (approximately 1 hour) ossec-integratord daemon stopped.
When I check status using /var/ossec/bin/ossec-control status it says:

wazuh-clusterd not running...
wazuh-modulesd is running...
ossec-monitord is running...
ossec-logcollector is running...
ossec-remoted is running...
ossec-syscheckd is running...
ossec-analysisd is running...
ossec-maild not running...
ossec-execd is running...
wazuh-db is running...
ossec-authd not running...
ossec-agentlessd not running...
ossec-integratord: Process 6485 not used by Wazuh, removing.
ossec-dbd not running...
ossec-csyslogd not running...

I was set internal debug options integrator.debug=2 and that what I find in _/var/ossec/logs/ossec.log_ after systemc restart wazuh-manager:

2020/04/03 10:01:06 ossec-integratord[6485] integrator.c:116 at OS_IntegratorD(): INFO: Enabling integration for: 'pagerduty'.
2020/04/03 10:01:06 ossec-integratord[6485] integrator.c:126 at OS_IntegratorD(): DEBUG: jqueue_next()
2020/04/03 10:01:06 ossec-integratord[6485] intgcom.c:76 at intgcom_main(): DEBUG: Local requests thread ready
...
...
2020/04/03 10:01:12 ossec-integratord[6485] integrator.c:126 at OS_IntegratorD(): DEBUG: jqueue_next()
2020/04/03 10:01:12 ossec-integratord[6485] integrator.c:131 at OS_IntegratorD(): DEBUG: sending new alert.
2020/04/03 10:01:12 ossec-integratord[6485] integrator.c:177 at OS_IntegratorD(): DEBUG: skipping: alert level is too low
2020/04/03 10:01:12 ossec-integratord[6485] integrator.c:177 at OS_IntegratorD(): DEBUG: skipping: alert level is too low
2020/04/03 10:01:12 ossec-integratord[6485] integrator.c:126 at OS_IntegratorD(): DEBUG: jqueue_next()
2020/04/03 10:01:13 ossec-integratord[6485] integrator.c:126 at OS_IntegratorD(): DEBUG: jqueue_next()
...
...
2020/04/03 10:49:20 ossec-integratord[6485] integrator.c:126 at OS_IntegratorD(): DEBUG: jqueue_next()
2020/04/03 10:49:20 ossec-integratord[6485] integrator.c:131 at OS_IntegratorD(): DEBUG: sending new alert.
2020/04/03 10:49:20 ossec-integratord[6485] integrator.c:177 at OS_IntegratorD(): DEBUG: skipping: alert level is too low

Again 40min after systemctl restart wazuh-manager (11:54:40 - 12:34:59)

2020/04/03 11:54:40 ossec-integratord[10387] sig_op.c:49 at HandleSIG(): INFO: (1225): SIGNAL [(15)-(Terminated)] Received. Exit Cleaning...
2020/04/03 11:54:40 ossec-integratord[13096] main.c:103 at main(): DEBUG: Starting ...
2020/04/03 11:54:41 ossec-integratord[13142] main.c:103 at main(): DEBUG: Starting ...
2020/04/03 11:54:41 ossec-integratord[13142] pthreads_op.c:45 at CreateThreadJoinable(): DEBUG: Thread stack size set to: 8192 KiB
2020/04/03 11:54:41 ossec-integratord[13142] main.c:162 at main(): DEBUG: Chrooted to directory: /var/ossec, using user: ossecm
2020/04/03 11:54:41 ossec-integratord[13142] intgcom.c:76 at intgcom_main(): DEBUG: Local requests thread ready
2020/04/03 11:54:41 ossec-integratord[13142] main.c:172 at main(): INFO: Started (pid: 13144).
2020/04/03 11:54:41 ossec-integratord[13142] integrator.c:51 at OS_IntegratorD(): DEBUG: JSON file queue connected.
2020/04/03 11:54:41 ossec-integratord[13142] integrator.c:116 at OS_IntegratorD(): INFO: Enabling integration for: 'pagerduty'.
2020/04/03 11:54:41 ossec-integratord[13142] integrator.c:116 at OS_IntegratorD(): INFO: Enabling integration for: 'pagerduty'.
2020/04/03 11:54:41 ossec-integratord[13142] integrator.c:126 at OS_IntegratorD(): DEBUG: jqueue_next()

...
...
2020/04/03 12:34:57 ossec-integratord[13142] integrator.c:126 at OS_IntegratorD(): DEBUG: jqueue_next()
2020/04/03 12:34:58 ossec-integratord[13142] integrator.c:126 at OS_IntegratorD(): DEBUG: jqueue_next()
2020/04/03 12:34:59 ossec-integratord[13142] integrator.c:126 at OS_IntegratorD(): DEBUG: jqueue_next()
2020/04/03 12:34:59 ossec-integratord[13142] integrator.c:131 at OS_IntegratorD(): DEBUG: sending new alert.
2020/04/03 12:34:59 ossec-integratord[13142] integrator.c:177 at OS_IntegratorD(): DEBUG: skipping: alert level is too low

As we can see ossec-integratord stopt to work in 50min after manager restart...
In syslog we can see next log:

Apr  3 12:34:59 wazuh-manager kernel: [5617839.405978] ossec-integrato[13144]: segfault at 20 ip 0000000000407dbe sp 00007ffc91470a50 error 4 in ossec-integratord[400000+c0000]

I have no idea what to do, please help!

[vikman90]

Hi @godunko-v,

Thank you for letting us know about this problem. This issue is known (#4370). We did not manage to reproduce that, but I've tried it again and got it.

I confirm that it's due to a bug that we must fix. Please let me close this issue as it's a duplicate and let's continue working in #4370.

Thank you again.
Best regards.

[vikman90]

@godunko-v FYI, this bug has just been patched for the next version 3.12.1.

Best regards.

[godunko-v]

@vikman90 awesome!!!
Thanks a lot!