Does the wazuh agent lose logs while updating?

[Daniel D'Angeli]

Hi,

im looking to mass upgrade the agents on my client infrastructure but i was wondering if while updating the agent would lose the logs.

Also, while i update the manager does the agent lose the log or store them in the bucket until is flooded?

Regards,

Daniel D.

[Jose Luis Carreras Marin]

Hello Daniel D'Angeli

During the upgrade, Wazuh remains off until it is finished and the process is restarted.

For practical purposes, when the manager is being updated, there would be no problem because the agents have standby states and a series of buffers and queues to not lose the events while the manager is disconnected or turned off. (As long as this state does not last too long in time, or the load is excessive, that is, as long as those buffers and queues hold).

On the other hand, when each one of the agents is being updated, Wazuh-agent is off, so during these moments, events cannot be processed, and some of them would be lost. However, in a standard environment and with a normal speed, this process should not take more than several seconds.

I hope to have solved your doubts, any other thing, do not hesitate to let me know.

Greetings, Jose

[Daniel D'Angeli]

Hi Jose,

thanks for the quick response. I will proceed to inform my client and begin the upgrade procedure.

Regards,

Daniel D.

[Jose Luis Carreras Marin]

Great!

Glad to have been of help.

Whatever you need, here you have the Wazuh team at your disposal!

Greetings