Agent Communication
109 views
Skip to first unread message
Aayush Shrivastava
Jun 13, 2025, 2:38:31 AMJun 13
to Wazuh | Mailing List
Hi
I’m using Wazuh 4.8.0-1 in a two-node (master-worker) deployment with a virtual IP via Keepalived for agent communication. The issue is that agents remain in a pending state, although logs are consistently received. I’ve enabled debug mode on wazuh-remoted; please find the attached ossec.conf and ossec.log files from the manager.
I’m using Wazuh 4.8.0-1 in a two-node (master-worker) deployment with a virtual IP via Keepalived for agent communication. The issue is that agents remain in a pending state, although logs are consistently received. I’ve enabled debug mode on wazuh-remoted; please find the attached ossec.conf and ossec.log files from the manager.
Adedamola Okelola
Jun 13, 2025, 4:35:28 AMJun 13
to Wazuh | Mailing List
Hello Aayush,
I am reviewing the log and configuration file you shared.
I will investigate and respond to you soon.
Regards,
Adedamola
Aayush Shrivastava
Jun 13, 2025, 7:23:40 AMJun 13
to Wazuh | Mailing List
sure please
Aayush Shrivastava
Jun 17, 2025, 1:27:38 AMJun 17
to Wazuh | Mailing List
Hi @Adedamola Okelola
Just following up to check if you had a chance to go through the logs and configuration. Have you found anything or made any progress?
Looking forward to your update.
Just following up to check if you had a chance to go through the logs and configuration. Have you found anything or made any progress?
Looking forward to your update.
On Friday, June 13, 2025 at 2:05:28 PM UTC+5:30 Adedamola Okelola wrote:
Adedamola Okelola
Jun 23, 2025, 6:38:47 AMJun 23
to Wazuh | Mailing List
Hello Aayush,
Apologies it took a while to come back to you.
There are two issues here: the reported agent pending state and merged.mg configuration file not reaching the agents I see in the ossec.log.
The Wazuh manager generates the merged.mg file based on the Wazuh agent's configuration and group membership. This file is sent to the agents upon registration to the Wazuh server.
So, I think this might be the reason some of the agents are stuck on pending status.
To resolve this, I will advice you manually delete the merged.mg file on both the stuck agent and on Wazuh server. The file can be found in the directories below:
On the Wazuh server, the file is located at `var/ossec/etc/shared/merged.mg`.
On the Wazuh agent, it is located at `/var/ossec/etc/shared/merged.mg` for Linux and `C:\Program Files (x86)\ossec-agent\shared\merged.mg` on Windows.
On the Wazuh server, the file is located at `var/ossec/etc/shared/merged.mg`.
On the Wazuh agent, it is located at `/var/ossec/etc/shared/merged.mg` for Linux and `C:\Program Files (x86)\ossec-agent\shared\merged.mg` on Windows.
Aayush Shrivastava
Sep 3, 2025, 2:06:05 AM (4 days ago) Sep 3
to Wazuh | Mailing List
still the same issue
I deployed the new wazuh instance but the issue remanis same
Connected 50+ devices now 20 are active and remaing are showing in pending state.
registered agent:
wazuh-agent: INFO: (4102): Connected to the server ([wazuh]:1514/tcp). wazuh-agent: INFO: Server responded. Releasing lock. wazuh-agent: INFO: Agent is now online. Process unlocked, continuing... wazuh-agent: INFO: Agent is now online. Process unlocked, continuing... wazuh-agent: WARNING: Server unavailable. Setting lock.
ossec.log
deleted the merged.mg but still same issue
I deployed the new wazuh instance but the issue remanis same
Connected 50+ devices now 20 are active and remaing are showing in pending state.
registered agent:
wazuh-agent: INFO: (4102): Connected to the server ([wazuh]:1514/tcp). wazuh-agent: INFO: Server responded. Releasing lock. wazuh-agent: INFO: Agent is now online. Process unlocked, continuing... wazuh-agent: INFO: Agent is now online. Process unlocked, continuing... wazuh-agent: WARNING: Server unavailable. Setting lock.
ossec.log
deleted the merged.mg but still same issue
Reply all
Reply to author
Forward
0 new messages