Wazuh dashboard service fails to start properly

Inspecting wazuh dashboard logs and correcting opensearch configuration in order to increase heap size

Table of Contents

Cause for wazuh-dashboard service failing to start

Checking the service log leads to the culprit

× wazuh-dashboard.service - wazuh-dashboard  
    Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; preset: enabled)  
    Active: failed (Result: exit-code) since Sun 2025-09-07 17:27:28 CEST; 1 week 3 days ago  
  Duration: 3min 10.634s  
   Process: 418 ExecStart=/usr/share/wazuh-dashboard/bin/opensearch-dashboards (code=exited, status=1/FAILURE)  
  Main PID: 418 (code=exited, status=1/FAILURE)  
       CPU: 11.192s  
  
sep 07 17:27:22 wazuh opensearch-dashboards[418]: {"type":"log","@timestamp":"2025-09-07T15:27:22Z","tags":["error","opensearch","data"],"pid":418,"message":"[search_phase_execution_exception]: all shards failed"}  
sep 07 17:27:25 wazuh opensearch-dashboards[418]: {"type":"log","@timestamp":"2025-09-07T15:27:25Z","tags":["error","opensearch","data"],"pid":418,"message":"[search_phase_execution_exception]: all shards failed"}  
sep 07 17:27:28 wazuh opensearch-dashboards[418]: {"type":"log","@timestamp":"2025-09-07T15:27:28Z","tags":["error","opensearch","data"],"pid":418,"message":"[circuit_breaking_exception]: [parent] Data too large, data for [<http_request>] would be [1027405542/979.8mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1027403928/979.8mb], new bytes rese>  
sep 07 17:27:28 wazuh opensearch-dashboards[418]: {"type":"log","@timestamp":"2025-09-07T15:27:28Z","tags":["warning","savedobjects-service"],"pid":418,"message":"Unable to connect to OpenSearch. Error: circuit_breaking_exception: [circuit_breaking_exception] Reason: [parent] Data too large, data for [<http_request>] would be [1027405542/979.8mb], which is larger than the>  
sep 07 17:27:28 wazuh opensearch-dashboards[418]: {"type":"log","@timestamp":"2025-09-07T15:27:28Z","tags":["fatal","root"],"pid":418,"message":"ResponseError: circuit_breaking_exception: [circuit_breaking_exception] Reason: [parent] Data too large, data for [<http_request>] would be [1027405542/979.8mb], which is larger than the limit of [1020054732/972.7mb], real usage:>  
sep 07 17:27:28 wazuh opensearch-dashboards[418]: {"type":"log","@timestamp":"2025-09-07T15:27:28Z","tags":["info","plugins-system"],"pid":418,"message":"Stopping all plugins."}  
sep 07 17:27:28 wazuh opensearch-dashboards[418]:  FATAL  {"error":{"root_cause":[{"type":"circuit_breaking_exception","reason":"[parent] Data too large, data for [<http_request>] would be [1027405542/979.8mb], which is larger than the limit of [1020054732/972.7mb], real usage: [1027403928/979.8mb], new bytes reserved: [1614/1.5kb], usages [request=0/0b, fielddata=0/0b, i>  
sep 07 17:27:28 wazuh systemd[1]: wazuh-dashboard.service: Main process exited, code=exited, status=1/FAILURE  
sep 07 17:27:28 wazuh systemd[1]: wazuh-dashboard.service: Failed with result 'exit-code'.  
sep 07 17:27:28 wazuh systemd[1]: wazuh-dashboard.service: Consumed 11.192s CPU time.

It seems that the ingested data is way above the limit: 1020054732/972.7mb

After some researching the following solution is found, which consist in increasing the limit and restarting the service

Solution

Backup the file or comment the lines which will be replaced

In the file /etc/wazuh-indexer/jvm.options there are two parameters which set the initial and maximum size of total heap space

  • -Xms1024m
    • Sets initial size of heap space
  • -Xmx1024m
    • Sets total maximum size of heap space

My initial config had 1GB as initial and total heap space and i set it to 3g

root@wazuh:/etc/wazuh-indexer# grep -i xm jvm.options.bak
## -Xms4g
## -Xmx4g
# Xms represents the initial size of total heap space
# Xmx represents the maximum size of total heap space
-Xms1024m
-Xmx1024m
root@wazuh:/etc/wazuh-indexer# grep -i xm jvm.options
## -Xms4g
## -Xmx4g
# Xms represents the initial size of total heap space
# Xmx represents the maximum size of total heap space
-Xms3G
-Xmx3G

Then restart the service and check for the results

root@wazuh:/etc/wazuh-indexer# systemctl restart wazuh-dashboard
root@wazuh:/etc/wazuh-indexer# systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
     Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; preset: enabled)
     Active: active (running) since Wed 2025-09-17 19:55:42 CEST; 4s ago
   Main PID: 102910 (node)
      Tasks: 11 (limit: 7056)
     Memory: 177.5M
        CPU: 4.082s
     CGroup: /system.slice/wazuh-dashboard.service
             └─102910 /usr/share/wazuh-dashboard/node/bin/node /usr/share/wazuh-dashboard/src/cli/dist

sep 17 19:55:42 wazuh systemd[1]: Started wazuh-dashboard.service - wazuh-dashboard.

References

https://docs.opensearch.org/latest/install-and-configure/configuring-opensearch/circuit-breaker/https://forum.opensearch.org/t/recovering-the-opensearch-cluster-when-data-too-large-error-occurs/20112https://groups.google.com/g/wazuh/c/prIHE47mxX8?pli=1