Wazuh fim is not work properly.

[Farid Alakbarli]

Hello,
I get alert on fim monitoring list rule description like below:

The maximum limit of files monitored is close to being reached. At this moment there are 87841 files and the limit is 100000. If the limit is reached some events can be lost. You can modify this setting in the centralized configuration or locally in the agent.

syscheck files does not overwrite?

 

[Diego Cappri]

Hello Farid, that alert shows up because Wazuh's FIM database on the agent has a built-in entry limit, right now you're at 87,841 out of 100,000. It's just a heads-up that if you hit the cap, any new files added after that point won't be tracked (existing ones are fine). To raise the limit, update this block in your ossec.conf (or via centralized config in the manager):

<syscheck>
  <file_limit>
    <enabled>yes</enabled>
    <entries>200000</entries>  
  </file_limit>
</syscheck>

You can also check why you have so many files being monitored — sometimes a broad path like /var or /usr sneaks in and increases the count. You can use <ignore> tags to exclude directories you don't really need to watch.

After making changes, restart the agent to apply them.

Thanks.

Diego.

[Diego Cappri]

Anytime.

On Fri, May 22, 2026 at 2:32 AM Farid Alakbarli <alakbar...@gmail.com> wrote:

Thank you for your support Diego!

--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/5afe4e0b-efdb-488b-a4d1-cc6609b116abn%40googlegroups.com.

[Diego Cappri]

Hi Farid,

let me add the link to the official documentation, for your reference: https://documentation.wazuh.com/current/user-manual/capabilities/file-integrity/index.html

Thank you.

Diego.