API connection - ERROR: Error connecting to API: Error: 2001 - Unexpected end of JSON input

[Dghizoni]

Hi,

After installing an agent on my Active Directory, I started receiving the error 2001 - Unexpected end of JSON input when attempting to connect to the Wazuh API. The API was functioning correctly before the agent installation, and no additional configuration was made after the installation.

The error is shown in the API connection check interface as illustrated in the screenshot below:

Additional information:

The installation of the agent on Active Directory was the only change made before the issue appeared.
No configurations were changed in the API or Wazuh settings.

[Dghizoni]

This is the log when i start the manager

● wazuh-dashboard.service - wazuh-dashboard
Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: enabled)
Active: active (running) since Wed 2024-08-21 14:59:09 UTC; 10s ago
Main PID: 3391 (node)
Tasks: 11 (limit: 4557)
Memory: 206.4M
CPU: 8.528s
CGroup: /system.slice/wazuh-dashboard.service
└─3391 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist -c /etc/wazuh-dashboard/opensearch_d>

ago 21 14:59:14 awaz2xo2p opensearch-dashboards[3391]: {"type":"log","@timestamp":"2024-08-21T14:59:14Z","tags":["info","plugins-service"],"pid":3391,"message":"Plugin "dataSource" is disabled."}
ago 21 14:59:14 awaz2xo2p opensearch-dashboards[3391]: {"type":"log","@timestamp":"2024-08-21T14:59:14Z","tags":["info","plugins-service"],"pid":3391,"message":"Plugin "visTypeXy" is disabled."}
ago 21 14:59:15 awaz2xo2p opensearch-dashboards[3391]: {"type":"log","@timestamp":"2024-08-21T14:59:15Z","tags":["info","plugins-system"],"pid":3391,"message":"Setting up [44] plugins: [usageCollection,opense>
ago 21 14:59:15 awaz2xo2p opensearch-dashboards[3391]: {"type":"log","@timestamp":"2024-08-21T14:59:15Z","tags":["info","savedobjects-service"],"pid":3391,"message":"Waiting until all OpenSearch nodes are com>
ago 21 14:59:15 awaz2xo2p opensearch-dashboards[3391]: {"type":"log","@timestamp":"2024-08-21T14:59:15Z","tags":["info","savedobjects-service"],"pid":3391,"message":"Starting saved objects migrations"}
ago 21 14:59:15 awaz2xo2p opensearch-dashboards[3391]: {"type":"log","@timestamp":"2024-08-21T14:59:15Z","tags":["info","plugins-system"],"pid":3391,"message":"Starting [44] plugins: [usageCollection,opensear>
ago 21 14:59:16 awaz2xo2p opensearch-dashboards[3391]: {"type":"log","@timestamp":"2024-08-21T14:59:16Z","tags":["error","plugins","wazuh","initialize"],"pid":3391,"message":"Unexpected end of JSON input"}
ago 21 14:59:16 awaz2xo2p opensearch-dashboards[3391]: {"type":"log","@timestamp":"2024-08-21T14:59:16Z","tags":["listening","info"],"pid":3391,"message":"Server running at https://10.247.0.161:443"}
ago 21 14:59:16 awaz2xo2p opensearch-dashboards[3391]: {"type":"log","@timestamp":"2024-08-21T14:59:16Z","tags":["info","http","server","OpenSearchDashboards"],"pid":3391,"message":"http server running at htt>
ago 21 14:59:16 awaz2xo2p opensearch-dashboards[3391]: {"type":"log","@timestamp":"2024-08-21T14:59:16Z","tags":["error","plugins","wazuh","monitoring"],"pid":3391,"message":"{\n error: 'no credentials',\n >

[JasonB73]

Any fixes for this yet? I have a Docker single node. been running for 3 weeks and now I can't login.
[API connection] Error connecting to API: Error: 2001 - Unexpected end of JSON input
I tried this below but systemctl command not found in docker container console so I'm still searching for a fix.

Stop Wazuh dashboard service:  systemctl stop wazuh-dashboard.
Delete the file: rm  /usr/share/wazuh-dashboard/data/wazuh/config/wazuh-registry.json
Start Wazuh dashboard service: systemctl start wazuh-dashboard
Delete Browser's cache, local storage, etc
Try to access the Wazuh Dashboard again.

Thanks

[Desvelao]

Hi @Dghizoni and @JasonB73, typically the 2001 - Unexpected end of JSON is related to getting the Wazuh server API host entries. In plugins prior to 4.9.0, that data was stored in wazuh-registry.json file and its content should be a JSON. The error indicates the content of the file could not be parsed.

Before taking some action, my recommendation is reviewing the content of the wazuh-registry.json file that should be located at /usr/share/wazuh-dashboard/data/wazuh/config/wazuh-registry.json. If this is not a JSON or has some syntax issues, then you will need to fix it or remove the file so a new one can be created when Wazuh dashboard (service or container) starts.

If you want to remove the wazuh-registry.json file:

• Wazuh dashboard package using the service manager:

1. Stop the wazuh-dashboard service:

systemctl stop wazuh-dashboard

2. Remove the wazuh-registry.json file:

rm /usr/share/wazuh-dashboard/data/wazuh/config/wazuh-registry.json

3. Restart the wazuh-dashboard service:

systemctl restart wazuh-dashboard

• Wazuh dashboard (Docker container)

0. Review the volumes that are mounted and ensure the file is not mounted directly or through some directory mount. You could need to remove/clean the mounted volume related to the wazuh-registry-json file.

1. Access to the Docker container of the Wazuh dashboard:

docker exec -it <container_id_or_name> bash

2. Remove the wazuh-registry.json file

Before removing the file, you could be interested to see the file content or take a backup. The file should have a content that could not be parsed taking into account that should be a JSON. If the file is not a JSON, then you could try to remove the file and restart the Wazuh dashboard container.

rm /usr/share/wazuh-dashboard/data/wazuh/config/wazuh-registry.json

3. Restart the Docker container of the Wazuh dashboard:

docker restart <container_id_or_name>

or use the docker compose/docker-compose management to restart the container.