WaAgent fails to install

[TheKrisSodroski]

Great project! Was able to get OPNsense running correctly with this repos help!

Next thing I'm trying to do is get syslogs to be monitored by azure.

After following these directions, it seems the waagent fails to install correctly, and thus, won't run. UI gets stuck on "transitioning" as well.

[ExtensionOperationError] Non-zero exit code: 51, /var/lib/waagent/Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-1.31.1/./shim.sh -install [stdout] Python 3.11.9 2024/07/12 10:33:55 Azure Monitoring Agent for Linux started to handle. 2024/07/12 10:33:55 [Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-1.31.1] cwd is /var/lib/waagent/Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-1.31.1 2024/07/12 10:33:55 [Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-1.31.1] Change log file to /var/log/azure/Microsoft.Azure.Monitor.AzureMonitorLinuxAgent/extension.log 2024/07/12 10:33:55 [Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-1.31.1] sequence number is 0 2024/07/12 10:33:55 [Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-1.31.1] setting file path is/var/lib/waagent/Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-1.31.1/config/0.settings 2024/07/12 10:33:55 [Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-1.31.1] JSON config: 2024/07/12 10:33:55 ERROR:[Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-1.31.1] JSON exception decoding 2024/07/12 10:33:55 ERROR:[Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-1.31.1] JSON error processing settings file: 2024/07/12 10:33:55 ERROR:Indeterminate operating system 2024/07/12 10:33:55 ERROR:[Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-1.31.1] Indeterminate operating system 2024/07/12 10:33:55 [Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-1.31.1] Install,failed,51,Indeterminate operating system Failed to check disk usage. [stderr] /var/lib/waagent/Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-1.31.1/./agent.py:38: DeprecationWarning: 'crypt' is deprecated and slated for removal in Python 3.13 import crypt

I assume this is a waagent issue and not an opnsense issue. Any thoughts, suggestions are much appreciated.

[TheKrisSodroski]

Small update:

To work around this issue, you can setup another VM running ubuntu in azure, and enable UDP rsyslog on that machine. Then use OPNSense's rsyslog in System -> Settings -> Logging -> Remote. Map to UDP (couldn't get TCP to work) to this other VM.

The azure waagent will install correctly in the base ubuntu image without issue.

In order to get the logs to actually start sending from OPNsense, you'll need to SSH into the machine and remove all files from var/log. Without this, OPNsense will continue to send logs only to file. I also disabled local logging. Not s ure if a system reboot would make these steps redundant.

[aleixsr]

Do you have plans to solve it?

[dmauser]

@Welasco FYI

[Welasco]

Just and update here.

This problem is related to Log Analytics agent, it's an Azure Extension that will leverage waagent to be installed.
For some reason, this Extension doesn't work with FreeBSD or specific to some hardening from OPNSense bootstrap script.

I'll test to check if it works with a vanilla FreeBSD installation and see if there are any work around to make it work after OPNSense gets installed.

My recommendation is to have a Linux Syslog collector with the agent installed and push the data to your Log Analytics workspace, there is a lot of incompatibilities issues with FreeBSD and there is a big chance that will never be fixed or considered to be fixed.