WORKER SYNC ISSUE

[NASHATH NASAR]

I HAVE ONE MASTER AND 4 WORKERS IN CLUSTER MODE BUT MASTER NOT SYNC DATA FROM WORKERS

[Stuti Gupta]

Hi  NASHATH,

Can you please share the exact error or warning that you are facing? 
Are you seeing any errors in /var/ossec/logs/cluster.log or /var/ossec/logs/ossec.log on the master or workers?  

Please verify that the cluster configuration is correct on both the master and worker nodes.

On the master, ensure the <cluster> section is configured similarly to, mail;y the node type should be, <node_type>master</node_type>  :

<cluster>
    <name>wazuh</name>
    <node_name>master-node</node_name>
    <key>756c70a151ad0b73b20e9f8cd37fe24c</key>
    <node_type>master</node_type>
    <port>1516</port>
    <bind_addr>0.0.0.0</bind_addr>
    <nodes>
        <node><MASTER_NODE_IP_ADDRESS></node>
    </nodes>
    <hidden>no</hidden>
    <disabled>no</disabled>
</cluster>

On each worker, verify that:

• <node_type> is set to worker.
• The <name> and <key> match the master's configuration.
• The <nodes> section points to the master node IP.
• The cluster is enabled (<disabled>no</disabled>).

After verifying the configuration, restart the manager on all nodes:

sudo systemctl restart wazuh-manager

If the issue persists, please share the output of the following commands from both the master and one worker:

/var/ossec/bin/cluster_control -l

cat /var/ossec/etc/ossec.conf | grep -A10 "<cluster>"

cat var/ossec/logs/cluster.log

If cluster.log is not available, share the cluster-related messages from:

cat /var/ossec/logs/ossec.log

Also, ensure that port 1516/TCP is reachable between the master and workers and that no firewall is blocking the communication.

Finally, please clarify what you mean by "the master is not syncing data from the workers"? Are you referring to cluster-managed files (such as agent groups, rules, decoders, etc.), or are you expecting alerts/events to be synchronized? 

[NASHATH NASAR]

  <cluster>

    <name>wazuh-cluster</name>
    <node_name>ciconf2node</node_name>
    <node_type>worker</node_type>
    <key>7323c1a5a8cd205a5b3b48d0ea404ead</key>

    <port>1516</port>
    <bind_addr>0.0.0.0</bind_addr>
    <nodes>

        <node>192.168.30.118</node>

    </nodes>
    <hidden>no</hidden>
    <disabled>no</disabled>


  </cluster>

<cluster>
  <name>wazuh-cluster</name>
  <node_name>master-node</node_name>
  <node_type>master</node_type>
  <key>7323c1a5a8cd205a5b3b48d0ea404ead</key>

  <port>1516</port>
  <bind_addr>0.0.0.0</bind_addr>
  <nodes>

   <node>192.168.30.118</node>
   <node>192.168.100.241</node>
   <node>192.168.30.125</node>
   <node>192.168.85.101</node>
   <node>192.168.75.9</node>

  </nodes>
  <hidden>no</hidden>
  <disabled>no</disabled>
</cluster>

[NASHATH NASAR]

i am not getting any error   

this is master dashboard but each work dashboard they have data in here there is no data

On Monday, July 13, 2026 at 4:01:13 PM UTC+4 Stuti Gupta wrote:

[Stuti Gupta]

Hi NASHATH,

I noticed that the <nodes> section in your master configuration includes all of the worker IP addresses. This should not be configured this way.

According to the Wazuh cluster configuration, there can only be one master node, and the <nodes> section on both the master and each worker should contain only the master node's IP address. Any additional worker IP addresses should not be included in this section.

Your configuration should look similar to the following:

Master:<cluster>

    <name>wazuh-cluster</name>
    <node_name>master-node</node_name>
    <node_type>master</node_type>

    <key>YOUR_CLUSTER_KEY</key>

    <port>1516</port>
    <bind_addr>0.0.0.0</bind_addr>
    <nodes>
        <node><MASTER_NODE_IP_ADDRESS></node>
    </nodes>
    <hidden>no</hidden>
    <disabled>no</disabled>

</cluster>

Worker:

<cluster>
    <name>wazuh-cluster</name>
    <node_name>worker-node</node_name>
    <node_type>worker</node_type>
    <key>YOUR_CLUSTER_KEY</key>

    <port>1516</port>
    <bind_addr>0.0.0.0</bind_addr>
    <nodes>
        <node><MASTER_NODE_IP_ADDRESS></node>
    </nodes>
    <hidden>no</hidden>
    <disabled>no</disabled>
</cluster>

Please update the configuration accordingly, restart the Wazuh manager on all cluster nodes, and let us know if the issue persists.

For reference: https://documentation.wazuh.com/current/user-manual/wazuh-server-cluster/cluster-nodes-configuration.html?utm_source=chatgpt.com

For the vulnerability detection, also please refer to: https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/configuring-scans.html