From 0b24a51147767f621534ad375d19b6dc2abb92f9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= Date: Tue, 22 Mar 2022 11:02:27 -0300 Subject: [PATCH 1/4] Manager wazuh-init updated (rids owner) --- wazuh-manager/config/etc/cont-init.d/0-wazuh-init | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/wazuh-manager/config/etc/cont-init.d/0-wazuh-init index e3c9ebfa..21e9d208 100644 --- a/wazuh-manager/config/etc/cont-init.d/0-wazuh-init +++ b/wazuh-manager/config/etc/cont-init.d/0-wazuh-init @@ -164,6 +164,15 @@ set_custom_cluster_key() { sed -i 's/to_be_replaced_by_cluster_key<\/key>/'"${WAZUH_CLUSTER_KEY}"'<\/key>/g' ${WAZUH_INSTALL_PATH}/etc/ossec.conf } +############################################################################## +# Modify /var/ossec/queue/rids directory owner on +# container start. +############################################################################## + +set_rids_owner() { + chown -R wazuh:wazuh /var/ossec/queue/rids +} + ############################################################################## # Main function ############################################################################## From d46c763939790cb8fff92adcd53c0aaea2b81082 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= Date: Tue, 22 Mar 2022 11:57:37 -0300 Subject: [PATCH 2/4] set_rids_owner call added --- wazuh-manager/config/etc/cont-init.d/0-wazuh-init | 2 ++ 1 file changed, 2 insertions(+) diff --git a/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/wazuh-manager/config/etc/cont-init.d/0-wazuh-init index 21e9d208..06408a2e 100644 --- a/wazuh-manager/config/etc/cont-init.d/0-wazuh-init +++ b/wazuh-manager/config/etc/cont-init.d/0-wazuh-init @@ -211,6 +211,8 @@ main() { # Delete temporary data folder rm -rf ${WAZUH_INSTALL_PATH}/data_tmp + # Set rids directory owner + set_rids_owner } main From 1c76d93b17b02f0f5b3f10f81879cd3200faf62a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= Date: Tue, 22 Mar 2022 12:47:15 -0300 Subject: [PATCH 3/4] Migration document added --- Migration-to-indexer-dashboard.md | 68 +++++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 Migration-to-indexer-dashboard.md diff --git a/Migration-to-indexer-dashboard.md b/Migration-to-indexer-dashboard.md new file mode 100644 index 00000000..ae318b67 --- /dev/null +++ b/Migration-to-indexer-dashboard.md @@ -0,0 +1,68 @@ +# Opendistro data migration to Wazuh indexer on docker. +This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments. +The example is migrating from v4.2.5 to v4.3.0. + +## Procedure +Assuming that you have a v4.2.5 production deployment, perform the following steps. + +**1. Stop 4.2.5 environment** +`docker-compose -f production-cluster.yml stop` + +**2. List Elastic volumesStop 4.2.5 environment** +`docker volume ls --filter name='wazuh-docker_elastic-data'` + +**3. Inspect Elastic volume** +`docker volume inspect wazuh-docker_elastic-data-1` + +**4. Run the volume create command:** create 3 new Indexer volumes using the `com.docker.compose.version` label value from the previous command. +``` +docker volume create \ + --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=wazuh-indexer-data-1 \ + wazuh-docker_wazuh-indexer-data-1 +``` +``` +docker volume create \ + --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=wazuh-indexer-data-2 \ + wazuh-docker_wazuh-indexer-data-2 +``` +``` +docker volume create \ + --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=wazuh-indexer-data-3 \ + wazuh-docker_wazuh-indexer-data-3 +``` + +**5. Copy the volume content from Elastic to Wazuh indexer volumes.** +``` +docker container run --rm -it \ + -v wazuh-docker_elastic-data-1:/from \ + -v wazuh-docker_wazuh-indexer-data-1:/to \ + alpine ash -c "cd /from ; cp -av . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_elastic-data-2:/from \ + -v wazuh-docker_wazuh-indexer-data-2:/to \ + alpine ash -c "cd /from ; cp -av . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_elastic-data-3:/from \ + -v wazuh-docker_wazuh-indexer-data-3:/to \ + alpine ash -c "cd /from ; cp -av . /to" +``` + +**6. Delete the 4.2.5 environment.** +`docker-compose -f production-cluster.yml down` + +**7. Start the 4.3 environment.** +```` +git checkout 4.3 +docker-compose -f production-cluster.yml up -d +``` +**8. Check the access to Wazuh dashboard**: go to the Wazuh Dashboard WebUI and check if everything is working. \ No newline at end of file From 610c62b866ee004b58a19917c06b1b91ca31580f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= Date: Tue, 22 Mar 2022 12:47:57 -0300 Subject: [PATCH 4/4] Migration document added --- Migration-to-indexer-dashboard.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Migration-to-indexer-dashboard.md b/Migration-to-indexer-dashboard.md index ae318b67..cc38fb9c 100644 --- a/Migration-to-indexer-dashboard.md +++ b/Migration-to-indexer-dashboard.md @@ -61,8 +61,9 @@ docker container run --rm -it \ `docker-compose -f production-cluster.yml down` **7. Start the 4.3 environment.** -```` +``` git checkout 4.3 docker-compose -f production-cluster.yml up -d ``` + **8. Check the access to Wazuh dashboard**: go to the Wazuh Dashboard WebUI and check if everything is working. \ No newline at end of file