Re: wazuh-keystore: "No such file or directory"

 ---- On Sun, 11 May 2025 09:14:45 -0700  Andrea Venturoli <ml@netfence.it> wrote --- 
 > Hello.
 > 

Hello Andrea

 > I've installed wazuh-agent.
 > Now I think I need to use wazuh-keystore in order to enable 
 > vulnerability detection.
 > Alas any time I call "/var/ossec/bin/wazuh-keystore", with whatever 
 > arguments, I get "No such file or directory" and nothing else happens.
 > 
 > I've tryied running it under truss and it ends in:
 > > getcontext(0x820220510)                 = 0 (0x0)
 > > sysarch(AMD64_GET_XFPUSTATE,0x8202204d8)     = 0 (0x0)
 > > mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 35059245056 (0x829b1a000)
 > > mprotect(0x217000,4096,PROT_READ)         = 0 (0x0)
 > > readlink("/proc/self/exe",0x820221220,1025)     ERR#2 'No such file or directory'
 > > fstatat(AT_FDCWD,"/usr/share/nls/C/libc.cat",0x820221060,0x0) ERR#2 'No such file or directory'
 > > fstatat(AT_FDCWD,"/usr/share/nls/libc/C",0x820221060,0x0) ERR#2 'No such file or directory'
 > > fstatat(AT_FDCWD,"/usr/local/share/nls/C/libc.cat",0x820221060,0x0) ERR#2 'No such file or directory'
 > > fstatat(AT_FDCWD,"/usr/local/share/nls/libc/C",0x820221060,0x0) ERR#2 'No such file or directory'
 > > No such file or directorywrite(2,"No such file or directory",25)         = 25 (0x19)
 > 
 > Is it possible that the problem is "/proc/self/exe"? AFAIK this is only 
 > valid for Linux, not for FreeBSD (which uses "/proc/curproc"). Right?
 > Is this it or am I barking up the wrong tree?

Try to use the following:

export WAZUH_HOME=/var/ossec && /var/ossec/bin/wazuh-keystore -h

It could be an issue with wazuh home directory autodetection into wazuh-keystrore app. I'll try to look into it anyway. 

If you want enable wazuh vulnerabilities detection on FreeBSD it depends of another things like a database of vulnerabilities file generated from wazuh project and if I am not mistaken it doesn't exist right now

Look at https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/how-it-works.html#compatibility-matrix

 > 
 > Am I supposed to use a different tool, instead of 
 > /var/ossec/bin/wazuh-keystore?
 > 
 >   bye & Thanks
 >     av.
 > 

Greetings