NGINX 502 bad gateway about wazuh-docker

Hi @RANGERBEE,

Yes, Nginx is proxying the Kibana traffic via TCP/443. Take into account that the wazuh-kibana container makes some checks before starting the service. In summary, Kibana will start after the elasticsearch service is up and running, can you please double check the requirements listed here and re-run the composer, you should get an output like the following on the Kibana container::

docker-compose logs --tail=10 kibana
Attaching to root_kibana_1
kibana_1         | Transfer complete
kibana_1         | Retrieving metadata from plugin archive
kibana_1         | Extracting plugin archive
kibana_1         | Extraction complete
kibana_1         | Optimizing and caching browser bundles...
kibana_1         | Plugin installation complete
kibana_1         | Setting API credentials into Wazuh APP
kibana_1         | {"type":"log","@timestamp":"2018-01-18T02:21:54Z","tags":["listening","info"],"pid":1,"message":"Server running at http://0.0.0.0:5601"}
kibana_1         | Importing objects
kibana_1         | {"type":"log","@timestamp":"2018-01-18T02:21:57Z","tags":["\u001b[34mwazuh\u001b[39m","monitoring","error"],"pid":1,"message":"Didn't find old wazuh-monitoring pattern. Skipping deletion."}

I hope it helps.

Best Regards.

Hey @mjflve,

Thanks for pointing me into the right direction!

Looks like my vm.max_map_count was not sticking..

I fixed it with a quick

sed -i -e "\$avm.max_map_count=262144" /etc/sysctl.conf

under root. After reboot, the map count persisted and Kibana opened right up in the browser.

Cheers.