Add support for agent self-restarting on Linux

[lchico]

Related issue
#77

Description

Base on the design phase, this PR implement how to handles the Wazuh agent restart process. Upon receiving a restart command, the program identifies the restart method (systemd or manual). It ensures the agent is stopped with a 30-second timeout, then restarts it. If the agent doesn’t stop gracefully, it is forcefully terminated. The process includes confirmation of the agent's successful restart.

Implementation Details:

• Once the command is received, the system will notify that the restart process is initializing before proceeding.
• Depending on how the agent was initially started, this module will use the same method for the restart, which could either be systemd or a manual method.
• If systemd was used, it will be responsible for stopping and restarting the agent, ensuring the process is killed if it hasn't restarted within 30 seconds. Any unexpected errors will be reported.
• For manual restarts, a fork is used to create a child process, which is responsible for stopping the current agent process, checking if it was closed before the timeout (also 30 seconds). If not, the agent will be killed and a new process will be started. Any unexpected errors will be reported.
• Once the agent has restarted, a success notification will be sent.

Extra changes:

• The SIGTERM signal name was not recognized, so I replaced it with the corresponding value to avoid the following error:

# apt remove wazuh-agent
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following package was automatically installed and is no longer required:
  lsb-release
Use 'apt autoremove' to remove it.
The following packages will be REMOVED:
  wazuh-agent
0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.
After this operation, 15.5 MB disk space will be freed.
Do you want to continue? [Y/n] 
(Reading database ... 9917 files and directories currently installed.)
Removing wazuh-agent (5.0.0-0) ...
Call pid 4119 with sigterm to stop the service
/var/lib/dpkg/info/wazuh-agent.prerm: 43: kill: Illegal option -S
dpkg: error processing package wazuh-agent (--remove):
 installed wazuh-agent package pre-removal script subprocess returned error exit status 2
dpkg: too many errors, stopping
Errors were encountered while processing:
 wazuh-agent
Processing was halted because there were too many errors.
E: Sub-process /usr/bin/dpkg returned an error code (1)	

• Fixed the following warning:

root@52347fca4dff:~/output# apt purge wazuh-agent
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following package was automatically installed and is no longer required:
  lsb-release
Use 'apt autoremove' to remove it.
The following packages will be REMOVED:
  wazuh-agent*
0 upgraded, 0 newly installed, 1 to remove and 11 not upgraded.
After this operation, 16.5 MB disk space will be freed.
Do you want to continue? [Y/n] 
(Reading database ... 7766 files and directories currently installed.)
Removing wazuh-agent (5.0.0-0) ...
(Reading database ... 7759 files and directories currently installed.)
Purging configuration files for wazuh-agent (5.0.0-0) ...
dpkg: warning: while removing wazuh-agent, directory '/etc/wazuh-agent' not empty so not removed
root@52347fca4dff:~/output# ls /etc/wazuh-agent
shared
root@52347fca4dff:~/output#  ls /etc/wazuh-agent/shared/
validYaml.yml

Test

Server

wazuh-agent/src/tests/mock-server#   ./mock-server --http

Add the restart command action to src/tests/mock-server/config/commands.groovy

def actions = [
    ...
    ["name": "restart", "version": "v5.0.0"],
    ...
]

Agent

Configure the agent to use the server address:

sed -i 's|server_url:.*|server_url: http://192.168.100.250:27000 |' /etc/wazuh-agent/wazuh-agent.yml

Register the agent

# sudo SPDLOG_LEVEL=TRACE /usr/share/wazuh-agent/bin/wazuh-agent --user wazuh --password topsecret --url http://192.168.100.250:27000 --name dummy --register

vagrant@ubuntu2204:~$ sudo SPDLOG_LEVEL=TRACE /usr/share/wazuh-agent/bin/wazuh-agent --user wazuh --password topsecret --url http://192.168.100.250:27000 --name dummy --register
[2025-01-22 00:20:25.075] [wazuh-agent] [debug] [DEBUG] [configuration_parser.cpp:54] [LoadLocalConfig] Loading local config file: /etc/wazuh-agent/wazuh-agent.yml.
[2025-01-22 00:20:25.076] [wazuh-agent] [debug] [DEBUG] [configuration_parser.hpp:147] [GetConfig] Requested setting not found, default value used. Key not found: path.data
Starting wazuh-agent registration
[2025-01-22 00:20:25.217] [wazuh-agent] [debug] [DEBUG] [http_client.cpp:296] [PerformHttpRequest] Request /security/user/authenticate: Status 200
[2025-01-22 00:20:25.217] [wazuh-agent] [trace] [TRACE] [http_client.cpp:297] [PerformHttpRequest] Request endpoint: /security/user/authenticate
Response: HTTP/1.1 200 OK
X-Imposter-Request: 6a273dcf-c7d0-4a47-86b6-0f049cb614d7
Server: imposter
content-length: 47

{ "data": { "token": "a1b2c3d4e5f6g7h8i9j0" } }
[2025-01-22 00:20:25.320] [wazuh-agent] [debug] [DEBUG] [http_client.cpp:296] [PerformHttpRequest] Request /agents: Status 201
[2025-01-22 00:20:25.320] [wazuh-agent] [trace] [TRACE] [http_client.cpp:297] [PerformHttpRequest] Request endpoint: /agents
Response: HTTP/1.1 201 Created
X-Imposter-Request: 9cdc2d69-3018-438b-b05a-bc89b36db9ff
Server: imposter
content-length: 0


wazuh-agent registered

Manually run the agent

root@ubuntu2204:~$ sudo /usr/share/wazuh-agent/bin/wazuh-agent
...
[2025-01-22 03:27:33.168] [wazuh-agent] [info] [INFO] [agent.cpp:170] [operator()] Restart: Initiating self-restart
[2025-01-22 03:27:33.174] [wazuh-agent] [info] [INFO] [inventory.cpp:62] [Stop] Inventory module stopping...
[2025-01-22 03:27:33.182] [wazuh-agent] [info] [INFO] [command_handler.hpp:105] [CommandsProcessingTask] Done processing command: restart(restart)
[2025-01-22 03:27:33.519] [wazuh-agent] [info] [INFO] [logcollector.cpp:96] [Stop] Logcollector module stopped.
[2025-01-22 03:27:33.540] [wazuh-agent] [info] [INFO] [inventoryImp.cpp:1165] [Scan] Evaluation finished.
[2025-01-22 03:27:33.587] [wazuh-agent] [info] [INFO] [inventory.cpp:37] [Start] Inventory module stopped.
root@ubuntu2204:/home/vagrant# [2025-01-22 03:27:34.175] [wazuh-agent] [info] [INFO] [restart_unix.cpp:66] [StopAgent] Agent gracefully stopped.
[2025-01-22 03:27:34.175] [wazuh-agent] [info] [INFO] [restart_unix.cpp:94] [RestartWithFork] Starting wazuh agent in a new process.
[2025-01-22 03:27:34.180] [wazuh-agent] [info] [INFO] [process_options_unix.cpp:24] [StartAgent] Starting wazuh-agent
[2025-01-22 03:27:34.181] [wazuh-agent] [info] [INFO] [communicator.hpp:55] [Communicator] Using insecure connection.
[2025-01-22 03:27:34.188] [wazuh-agent] [info] [INFO] [communicator.cpp:28] [SendAuthenticationRequest] Successfully authenticated with the manager.
[2025-01-22 03:27:34.189] [wazuh-agent] [info] [INFO] [inventory.cpp:18] [Start] Inventory module started.
[2025-01-22 03:27:34.189] [wazuh-agent] [info] [INFO] [inventoryImp.cpp:1170] [SyncLoop] Module started.
[2025-01-22 03:27:34.189] [wazuh-agent] [info] [INFO] [inventoryImp.cpp:1153] [Scan] Starting evaluation.
[2025-01-22 03:27:34.190] [wazuh-agent] [info] [INFO] [logcollector.cpp:32] [Start] Logcollector module started.
[2025-01-22 03:27:34.191] [wazuh-agent] [info] [INFO] [file_reader.cpp:61] [AddLocalfiles] Reading log file: /var/log/auth.log
[2025-01-22 03:27:34.199] [wazuh-agent] [info] [INFO] [command_handler.hpp:146] [CleanUpInProgressCommands] Agent restarted successfully

Using Systemd to run the agent

root@ubuntu2204:/home/vagrant# journalctl -xu wazuh-agent -f
...
Jan 22 16:31:18 ubuntu2204.localdomain env[10942]: [2025-01-22 16:31:18.237] [wazuh-agent] [info] [INFO] [agent.cpp:170] [operator()] Restart: Initiating self-restart
Jan 22 16:31:18 ubuntu2204.localdomain env[10942]: [2025-01-22 16:31:18.239] [wazuh-agent] [info] [INFO] [restart_unix.cpp:36] [RestartWithSystemd] Systemctl restarting wazuh agent service.
Jan 22 16:31:18 ubuntu2204.localdomain env[10942]: [2025-01-22 16:31:18.243] [wazuh-agent] [info] [INFO] [inventory.cpp:62] [Stop] Inventory module stopping...
Jan 22 16:31:18 ubuntu2204.localdomain systemd[1]: Stopping Wazuh agent...
░░ Subject: A stop job for unit wazuh-agent.service has begun execution
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░ 
░░ A stop job for unit wazuh-agent.service has begun execution.
░░ 
░░ The job identifier is 32220.
Jan 22 16:31:18 ubuntu2204.localdomain env[10942]: [2025-01-22 16:31:18.247] [wazuh-agent] [info] [INFO] [command_handler.hpp:105] [CommandsProcessingTask] Done processing command: restart(restart)
Jan 22 16:31:18 ubuntu2204.localdomain env[10942]: [2025-01-22 16:31:18.352] [wazuh-agent] [info] [INFO] [logcollector.cpp:96] [Stop] Logcollector module stopped.
Jan 22 16:31:18 ubuntu2204.localdomain env[10942]: [2025-01-22 16:31:18.353] [wazuh-agent] [info] [INFO] [inventoryImp.cpp:1165] [Scan] Evaluation finished.
Jan 22 16:31:18 ubuntu2204.localdomain env[10942]: [2025-01-22 16:31:18.361] [wazuh-agent] [info] [INFO] [inventory.cpp:37] [Start] Inventory module stopped.
Jan 22 16:31:18 ubuntu2204.localdomain systemd[1]: wazuh-agent.service: Deactivated successfully.
░░ Subject: Unit succeeded
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░ 
░░ The unit wazuh-agent.service has successfully entered the 'dead' state.
Jan 22 16:31:18 ubuntu2204.localdomain systemd[1]: Stopped Wazuh agent.
░░ Subject: A stop job for unit wazuh-agent.service has finished
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░ 
░░ A stop job for unit wazuh-agent.service has finished.
░░ 
░░ The job identifier is 32220 and the job result is done.
Jan 22 16:31:18 ubuntu2204.localdomain systemd[1]: Started Wazuh agent.
░░ Subject: A start job for unit wazuh-agent.service has finished successfully
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░ 
░░ A start job for unit wazuh-agent.service has finished successfully.
░░ 
░░ The job identifier is 32220.
Jan 22 16:31:18 ubuntu2204.localdomain env[10964]: [2025-01-22 16:31:18.373] [wazuh-agent] [info] [INFO] [process_options_unix.cpp:24] [StartAgent] Starting wazuh-agent
Jan 22 16:31:18 ubuntu2204.localdomain env[10964]: [2025-01-22 16:31:18.374] [wazuh-agent] [info] [INFO] [communicator.hpp:55] [Communicator] Using insecure connection.
Jan 22 16:31:18 ubuntu2204.localdomain env[10964]: [2025-01-22 16:31:18.378] [wazuh-agent] [info] [INFO] [communicator.cpp:28] [SendAuthenticationRequest] Successfully authenticated with the manager.
Jan 22 16:31:18 ubuntu2204.localdomain env[10964]: [2025-01-22 16:31:18.379] [wazuh-agent] [info] [INFO] [inventory.cpp:18] [Start] Inventory module started.
Jan 22 16:31:18 ubuntu2204.localdomain env[10964]: [2025-01-22 16:31:18.379] [wazuh-agent] [info] [INFO] [logcollector.cpp:32] [Start] Logcollector module started.
Jan 22 16:31:18 ubuntu2204.localdomain env[10964]: [2025-01-22 16:31:18.379] [wazuh-agent] [info] [INFO] [file_reader.cpp:61] [AddLocalfiles] Reading log file: /var/log/auth.log
Jan 22 16:31:18 ubuntu2204.localdomain env[10964]: [2025-01-22 16:31:18.380] [wazuh-agent] [info] [INFO] [inventoryImp.cpp:1170] [SyncLoop] Module started.
Jan 22 16:31:18 ubuntu2204.localdomain env[10964]: [2025-01-22 16:31:18.380] [wazuh-agent] [info] [INFO] [inventoryImp.cpp:1153] [Scan] Starting evaluation.
Jan 22 16:31:18 ubuntu2204.localdomain env[10964]: [2025-01-22 16:31:18.390] [wazuh-agent] [info] [INFO] [command_handler.hpp:146] [CleanUpInProgressCommands] Agent restarted successfully
...

[jr0me]

I left a few comments, mostly on formatting and style, but already LGTM

[vikman90]

Now, we've got just one process:

SessionLeader───Relay(130993)───bash───wazuh-agent───6*[{wazuh-agent}]

Thanks @lchico!