How to check in one minute
From the dashboard host, time the Wazuh API directly (use the URL and port from the dashboard's API connection):
curl -sk -o /dev/null -w 'HTTP %{http_code} in %{time_total}s\n' https://WAZUH_API:55000/- Answers in well under a second (a
401is fine, it means no credentials were sent): the API is up. The timeout comes from one slow call; see step 2. - Hangs: something between the dashboard and the API drops packets, or the API is stuck. Check firewalls and the API process.
- Connection refused immediately: the API is down or on another port. That is a different problem and normally a different message.
2. Find the slow call. On the manager, the API log records each request with its duration:
tail -n 50 /var/ossec/logs/api.logEach line ends like "GET /manager/stats/analysisd" ... done in 0.029s: 200. Reproduce the page that fails, then list the slowest requests:
sed -n 's/.*INFO: [^ ]* [^ ]* "\([A-Z]* [^"]*\)".* done in \([0-9.]*\)s.*/\2 \1/p' /var/ossec/logs/api.log | sort -rn | head -n 10It prints the duration in seconds, then the request, slowest first.
Why it happens
In wazuh-dashboard-plugins 4.14.7, the app's request service (plugins/main/public/react-services/wz-request.ts) sets timeout = configuration.timeout, falling back to 20000. The setting is defined in wazuh-core/common/constants.ts as Request timeout: "Maximum time, in milliseconds, the app will wait for an API response", default 20000, minimum 1500.
The text itself is the HTTP client's (axios) timeout message. We ran the axios build shipped in the 4.14.7 dashboard container (1.12.2) with the same 20000 ms timeout:
| Target (from inside the dashboard container) | Result |
|---|---|
| a port that accepts the connection and never answers | ECONNABORTED, "timeout of 20000ms exceeded", after 20,030 ms |
| a closed port | ECONNREFUSED, after 24 ms |
So the message points at slowness or a silent drop, not at a stopped service.
Fix
1. Fix the slow part first. A request that takes more than 20 seconds usually comes from a heavy query (large agent lists, big inventories, wide time ranges), an overloaded manager, or a network device dropping traffic to port 55000. The API log from step 2 tells you which.
2. If the work is legitimately slow, raise the limit. In the dashboard: Dashboard management → App settings → General → Request timeout, in milliseconds. The same key, timeout, can be set in the app's configuration file. Raising it hides a slow API; it does not make it faster.
Limits of what we measured
We measured the client side only: the exact message and timing from the dashboard's own axios build against a silent port and a closed port, inside our 4.14.7 dashboard container. That the Wazuh app passes its Request timeout setting to these requests comes from reading the 4.14.7 source. We did not reproduce a slow Wazuh API end to end through the dashboard UI, and we did not measure which pages are slowest at scale. Menu names may differ between versions.