Troubleshooting

Monitoring

  • Check service status:

sudo systemctl status wazuh-dfn

  • View logs:

sudo tail -f /opt/wazuh-dfn/logs/wazuh-dfn.log

Troubleshooting

  1. Check virtualenv activation:

source /opt/wazuh-dfn/venv/bin/activate
python -V  # Should show Python 3.12.x

  1. Verify Wazuh alert file permissions:

sudo ls -l /var/ossec/logs/alerts/alerts.json

  1. Check Kafka connectivity:

telnet incubator-stream.soc.dfn.de 443

  1. Validate certificate permissions:

ls -l /opt/wazuh-dfn/certs/

  1. Review logs for specific error messages:

sudo tail -n 100 /opt/wazuh-dfn/logs/wazuh-dfn.log