AR IT: Nightly report - Failed test_execd_restart

[Rebits]

Related issue
#2770
#3022

Date	Commit	Build
2022-04-06	99be0c9	https://ci.wazuh.info/job/test_nightly/
2022-06-28	4a0c134	https://ci.wazuh.info/job/test_nightly/1077//

Tier 0

test_execd_restart

• Build: https://ci.wazuh.info/job/Test_integration/24788/console

• Cases

FAILED test_active_response/test_execd/test_execd_restart.py::test_execd_restart[get_configuration0]

• Description

Windows agent does not restart after AR.

2022/04/07 08:14:25 wazuh-agent[3860] receiver-win.c:132 at receiver_thread(): DEBUG: Received message: '#!-execd {"version":1,"origin":{"name":"","module":"wazuh-analysisd"},"command":"restart-wazuh0","parameters":{"extra_args":[],"alert":{"rule":{"level":5,"description":"Test.","id":554}}}}'
2022/04/07 08:14:25 wazuh-agent[3860] agent_op.c:237 at os_read_agent_profile(): DEBUG: os_read_agent_profile() = [-]
2022/04/07 08:14:25 wazuh-agent[3860] config.c:407 at ReadConfig(): DEBUG: agent_config element does not have any attributes.
2022/04/07 08:14:25 wazuh-agent[3860] syscheck.c:118 at Start_win32_Syscheck(): INFO: (6678): No directory provided for syscheck to monitor.
2022/04/07 08:14:25 wazuh-agent[3860] syscheck.c:138 at Start_win32_Syscheck(): INFO: (6001): File integrity monitoring disabled.
2022/04/07 08:14:25 wazuh-agent[3860] agent_op.c:218 at os_read_agent_profile(): DEBUG: Calling os_read_agent_profile().
2022/04/07 08:14:25 wazuh-agent[3860] agent_op.c:237 at os_read_agent_profile(): DEBUG: os_read_agent_profile() = [-]
2022/04/07 08:14:25 wazuh-agent[3860] config.c:407 at ReadConfig(): DEBUG: agent_config element does not have any attributes.
2022/04/07 08:14:25 rootcheck[3860] rootcheck.c:202 at rootcheck_init(): INFO: Rootcheck disabled.
2022/04/07 08:14:25 wazuh-agent[3860] syscheck.c:204 at Start_win32_Syscheck(): DEBUG: (6357): Maximum disk quota size limit configured to '1048576 KB'.
2022/04/07 08:14:25 wazuh-agent[3860] syscheck.c:259 at Start_win32_Syscheck(): INFO: Started (pid: 3860).
2022/04/07 08:14:25 wazuh-agent[3860] config.c:407 at ReadConfig(): DEBUG: agent_config element does not have any attributes.
2022/04/07 08:14:25 wazuh-agent[3860] receiver-win.c:132 at receiver_thread(): DEBUG: Received message: '#!-agent ack '
2022/04/07 08:14:25 wazuh-agent[3860] exec.c:65 at ReadExecConfig(): ERROR: (1313): Invalid active response config: 'shared/ar.conf'.
2022/04/07 08:14:25 wazuh-agent[3860] exec.c:105 at ReadExecConfig(): INFO: Active response command not present: 'active-response/bin/restart-wazuh'. Not using it on this system.
2022/04/07 08:14:25 sca[3860] wm_sca.c:153 at wm_sca_main(): INFO: Module disabled. Exiting.

NOTE: Reported by Nightly 2022-04-21, 2022-04-29, 2022-05-12, 2022-05-18

[Rebits]

07/04/2022

Detected error in Windows agent wazuh/wazuh#13077 (comment)

[Rebits]

03/05/2022

Regarding message:

2022/04/07 08:14:25 wazuh-agent[3860] exec.c:65 at ReadExecConfig(): ERROR: (1313): Invalid active response config: 'shared/ar.conf'.

The content of ar.conf is the following:

restart-wazuh0 - restart-wazuh - 0
restart-wazuh0 - restart-wazuh.exe - 0
firewall-drop0 - firewall-drop - 0
firewall-drop5 - firewall-drop - 5

---

It seems that the test or Wazuh is Unstable. It erratically passes.

PS C:\tmp\Test_integration_B25931_20220503091850> python -m pytest tests\integration\test_active_response\ --pdb
================================================= test session starts ================================================
platform win32 -- Python 3.7.4, pytest-6.2.2, py-1.10.0, pluggy-0.13.0
rootdir: C:\tmp\Test_integration_B25931_20220503091850\tests\integration, configfile: pytest.ini
plugins: html-3.1.1, metadata-1.8.0, testinfra-5.0.0
collected 10 items / 8 deselected / 2 selected

tests\integration\test_active_response\test_execd\test_execd_restart.py ..                                       [100%

================================================== warnings summary ==================================================
..\..\Python37\lib\site-packages\win32\lib\pywintypes.py:2
  C:\Python37\lib\site-packages\win32\lib\pywintypes.py:2: DeprecationWarning: the imp module is deprecated in favour
 importlib; see the module's documentation for alternative uses
    import imp, sys, os

-- Docs: https://docs.pytest.org/en/stable/warnings.html
===================================== 2 passed, 8 deselected, 1 warning in 26.59s ====================================

[Deblintrake09]

Update 2022/07/28

Launching tests from Jenkins Instance, first run fails, but al subsequent launches pass.
Machine Report first run fails 🟢

[Deblintrake09]

Update 2022/08/10

• There was a bug on the windows agent when it was stopped. It caused the fails in this tests. It was fixed by Wazuh/Wazuh PR #14486 for 4.4.
• Manual test on the Fix done on QA testing - Invalid calling convention for stop functions #3159
• Waiting for merge to close this.

[Deblintrake09]

Testing done

Version	Commit	Results	Notes
4.4	911cc80	🟢🟢🟢🔵
master	f1a77b6	🟢🟢🟢🟢🟢