Cant use AWS integration with the container about wazuh-docker

[snaow]

Hi,

The AWS integration is getting the value of /proc/sys/net/core/rmem_max in order to get the maximum socket buffer size.
rmem_max is kernel parameter that controls the maxium size of receive buffers used by sockets.

The source code lines involved are:

• https://github.com/wazuh/wazuh/blob/3.6.1/wodles/aws/aws-s3.py#L782

---

We will fix this for next versions, in case you want to make it work now, you can apply the following hot fix:

Get your current rmem_max value from your docker host:

[root@localhost vagrant]# cat /proc/sys/net/core/rmem_max
212992

Modify the source code to hardcode this parameter:

• vi /var/ossec/wodles/aws/aws-s3
• Replace the following content:

with open('/proc/sys/net/core/rmem_max', 'r') as kernel_param:
    max_queue_buffer = int(kernel_param.read().strip())

By:

max_queue_buffer = int(212992)`

• Save changes

That's should be all, let us know how it goes.

Regards,
Pedro.

[SitoRBJ]

Hello @fillipejs and @snaow,

We are sorry for the delay.

The variable that caused problems in this section,

https://github.com/wazuh/wazuh/blob/master/wodles/aws/aws-s3.py#L782-L783

is no longer used.

The following PR fixes the AWS integration used in Docker: #1880

We are working on an alternative solution until the PR is accepted.

We will keep you informed. Thank you very much for your patience.

Best regards,

Alfonso Ruiz-Bravo

[SitoRBJ]

Hello @fillipejs and @snaow,

We have created a branch dedicated to integration with AWS. This is a temporary solution, until the corrected code is accepted and merged.

Branch: https://github.com/wazuh/wazuh-docker/tree/aws-integration-compatibility

Use: https://github.com/wazuh/wazuh-docker/blob/aws-integration-compatibility/Use.txt

We hope we have been helpful.

Thank you for your attention and for your patience.

Best regards,

Alfonso Ruiz-Bravo

[SitoRBJ]

Hello @fillipejs and @snaow,

The PR #69 solves the problem. This is a temporary solution, until the corrected code is accepted and merged.

Thank you for your attention and for your patience.

Regards,

Alfonso Ruiz-Bravo

[jesuslinares]

We will continue this issue here: #68.

Thanks.