Wazuh agent disconnect and network status is "CLOSE_WAIT"

[fengbaoliu111]

Wazuh version	Component	Install type	Install method	Platform
4.4.1	Wazuh component	Agent	Packages/Sources	Ubuntu 20.04.5

The agent runs normally, but is disconnected from the manager. The network status is "CLOSE_WAIT". How to solve the problem?

[davidcr01]

Hello. The CLOSE_WAIT state means the socket is closed on the remote side, and the system is waiting for the local side to close it. I should recommend you about the 1514 port state of the Wazuh manager, ensuring that the firewall is not blocking any traffic.

Also, it would be interesting to check the Manager logs in the /var/ossec/logs/ossec.log.

I also leave you some documentation that may be useful: https://documentation.wazuh.com/current/user-manual/agent/agent-enrollment/troubleshooting.html