u/LetDry7592

Hello,

After installing Wazuh Agent on Windows, I discovered a folder:

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OSSEC

This folder contains shortcuts (.lnk) to the Wazuh interface.

My questions:

1. Is this a normal behavior of the Wazuh installer? (MSI or NSIS)
2. Are these shortcuts created automatically during installation?
3. Is there official Wazuh documentation that confirms this behavior?

Thank you for your help!

Hi everyone,

I'm running a 3-node Wazuh indexer cluster. When I shut down one indexer node, the OpenSearch cluster stays healthy (green/yellow) and the API responds fine via curl from the remaining nodes. However, the Wazuh Dashboard completely crashes with a `securityDashboard` plugin error (setup lifecycle failure / Request Timeout after 30000ms).

All three indexer IPs are listed in `opensearch.hosts` in `opensearch_dashboards.yml`. If I comment out the dead node's IP, the dashboard starts fine — but obviously that defeats the purpose of HA.

I also noticed this matches the open bug opensearch-project/OpenSearch-Dashboards#9825.

My questions:

- Has anyone found a native dashboard parameter to handle this gracefully?

- Is putting an Nginx reverse proxy in front of the indexers the only real workaround?

- Any ETA on a fix from the Wazuh/OpenSearch side?