Syscheck real time monitoring issue
50 views
Skip to first unread message
Ali Melikov
Jul 24, 2026, 4:08:05 AM (yesterday) Jul 24
to Wazuh | Mailing List
Hi everyone,
I've noticed an issue with Syscheck real-time file monitoring on one of my Wazuh agents.
Normally, the endpoint detects newly created files in real time without any issues. However, at some point, the real-time monitoring suddenly stops working. When this happens, newly created files are not detected immediately. Instead, they are only reported during the next scheduled Syscheck scan.
For my use case, real-time detection is critical, so this behavior is a problem.
I first noticed this behavior after moving the agent from one Wazuh manager to another. The migration itself completed successfully, and I don't see this problem on any other endpoints. The issue only affects this specific host after it was moved to the new manager.
Has you experienced similar behavior? Is there anything that could cause Syscheck real-time monitoring to stop while scheduled scans continue to work normally?
Any suggestions would be appreciated.
Stuti Gupta
Jul 24, 2026, 4:58:04 AM (yesterday) Jul 24
to Wazuh | Mailing List
Hi Ali Melikov
Since the issue started after migrating the agent to a new manager, please verify that the monitored directories are still configured with realtime="yes" in the agent's ossec.conf.
Also, check the Wazuh agent logs for any Syscheck-related messages or errors associated with the monitored directories, and share the relevant log entries.
Could you also confirm whether the issue is limited to a specific directory, or does it affect all directories configured for real-time monitoring?
Please share your complete <syscheck> configuration as well.
Finally, please share the name and path of a file that should have generated a real-time alert but was only detected during the scheduled Syscheck scan.
These all are requied to know the cause of the issue you are facing.
Ali Melikov
Jul 24, 2026, 5:01:41 AM (24 hours ago) Jul 24
to wa...@googlegroups.com
---------- Пересылаемое сообщение ---------
От: Ali Melikov <alime...@gmail.com>
Дата: пятница, 24 июля 2026 г., 12:08:05 UTC+4
Тема: Syscheck real time monitoring issue
Кому: Wazuh | Mailing List <wa...@googlegroups.com>
От: Ali Melikov <alime...@gmail.com>
Дата: пятница, 24 июля 2026 г., 12:08:05 UTC+4
Тема: Syscheck real time monitoring issue
Кому: Wazuh | Mailing List <wa...@googlegroups.com>
Also i noticed this when agent does't move from one manager pr to another. I check files doesn't reach limit. when the endpoint turn off, next day syscheck ignore logging realtime activity.
Stuti Gupta
Jul 24, 2026, 7:09:24 AM (22 hours ago) Jul 24
to Wazuh | Mailing List
Can you please clarify the issue?
Was the agent migrated to another manager successfully?
The FIM doesn't reach the limit; that is the good news.
In case it was successfully migrated to a different manager and it is active and reporting the rest of the logs but not the real-time logs, then please share the information asked above.
Was the agent migrated to another manager successfully?
The FIM doesn't reach the limit; that is the good news.
In case it was successfully migrated to a different manager and it is active and reporting the rest of the logs but not the real-time logs, then please share the information asked above.
- Please verify that the monitored directories are still configured with realtime="yes" in the agent's ossec.conf.
- Also, check the Wazuh agent logs for any Syscheck-related messages or errors associated with the monitored directories, and share the relevant log entries.
- Could you also confirm whether the issue is limited to a specific directory, or does it affect all directories configured for real-time monitoring?
- Please share your complete <syscheck> configuration as well.
- Finally, please share the name and path of a file that should have generated a real-time alert but was only detected during the scheduled Syscheck scan.
These all are requied to know the cause of the issue you are facing.
Ali Melikov
Jul 24, 2026, 8:01:21 AM (21 hours ago) Jul 24
to Wazuh | Mailing List
ossec.conf:
<!-- File integrity monitoring -->
<syscheck>
<disabled>no</disabled>
<!-- Frequency that syscheck is executed default every 12 hours -->
<frequency>43200</frequency>
<!-- Default files to be monitored. -->
<directories recursion_level="0" restrict="regedit.exe$|system.ini$|win.ini$">%WINDIR%</directories>
<directories recursion_level="0" restrict="at.exe$|attrib.exe$|cacls.exe$|cmd.exe$|eventcreate.exe$|ftp.exe$|lsass.exe$|net.exe$|net1.exe$|netsh.exe$|reg.exe$|regedt32.exe|regsvr32.exe|runas.exe|sc.exe|schtasks.exe|sethc.exe|subst.exe$">%WINDIR%\SysNative</directories>
<directories recursion_level="0">%WINDIR%\SysNative\drivers\etc</directories>
<directories recursion_level="0" restrict="WMIC.exe$">%WINDIR%\SysNative\wbem</directories>
<directories recursion_level="0" restrict="powershell.exe$">%WINDIR%\SysNative\WindowsPowerShell\v1.0</directories>
<directories recursion_level="0" restrict="winrm.vbs$">%WINDIR%\SysNative</directories>
<!-- 32-bit programs. -->
<directories recursion_level="0" restrict="at.exe$|attrib.exe$|cacls.exe$|cmd.exe$|eventcreate.exe$|ftp.exe$|lsass.exe$|net.exe$|net1.exe$|netsh.exe$|reg.exe$|regedit.exe$|regedt32.exe$|regsvr32.exe$|runas.exe$|sc.exe$|schtasks.exe$|sethc.exe$|subst.exe$">%WINDIR%\System32</directories>
<directories recursion_level="0">%WINDIR%\System32\drivers\etc</directories>
<directories recursion_level="0" restrict="WMIC.exe$">%WINDIR%\System32\wbem</directories>
<directories recursion_level="0" restrict="powershell.exe$">%WINDIR%\System32\WindowsPowerShell\v1.0</directories>
<directories recursion_level="0" restrict="winrm.vbs$">%WINDIR%\System32</directories>
<directories realtime="yes">%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup</directories>
<ignore>%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini</ignore>
<ignore type="sregex">.log$|.htm$|.jpg$|.png$|.chm$|.pnf$|.evtx$</ignore>
<!-- Windows registry entries to monitor. -->
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\batfile</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\cmdfile</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\comfile</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\exefile</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\piffile</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\AllFilesystemObjects</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\Directory</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\Folder</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Classes\Protocols</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Policies</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Security</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\KnownDLLs</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\winreg</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components</windows_registry>
<!-- Windows registry entries to ignore. -->
<registry_ignore>HKEY_LOCAL_MACHINE\Security\Policy\Secrets</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Security\SAM\Domains\Account\Users</registry_ignore>
<registry_ignore type="sregex">\Enum$</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\AppCs</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\DHCP</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\IPTLSIn</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\IPTLSOut</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\Teredo</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PolicyAgent\Parameters\Cache</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ADOVMPPackage\Final</registry_ignore>
<!-- Frequency for ACL checking (seconds) -->
<windows_audit_interval>60</windows_audit_interval>
<!-- Nice value for Syscheck module -->
<process_priority>10</process_priority>
<!-- Maximum output throughput -->
<max_eps>50</max_eps>
<!-- Database synchronization settings -->
<synchronization>
<enabled>yes</enabled>
<interval>5m</interval>
<max_eps>10</max_eps>
</synchronization>
</syscheck>
agent.conf:
<syscheck>
<disabled>no</disabled>
<frequency>43200</frequency>
<directories realtime="yes">D:\*\Desktop</directories>
<directories realtime="yes">D:\*\Documents</directories>
<directories realtime="yes">D:\*\Downloads</directories>
<directories realtime="yes">C:\Users\*\Downloads</directories>
<directories realtime="yes">C:\Windows\System32\drivers\etc\hosts</directories>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\batfile</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\cmdfile</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\piffile</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\AllFilesystemObjects</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\Folder</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\KnownDLLs</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\winreg</registry_ignore>
<synchronization>
<enabled>yes</enabled>
<interval>5m</interval>
<max_eps>10</max_eps>
</synchronization>
</syscheck>
Wazuh Notification.
2026 Jul 24 09:01:39
Received From: (Ali) any->syscheck
Rule: 100544 fired (level 16) -> "File added to the system."
Portion of the log(s):
File 'd:\ali\downloads\sample.pdf' added
Mode: scheduled
Attributes:
- Size: 123403
- Permissions: Administrators (allowed): DELETE|READ_CONTROL|WRITE_DAC|WRITE_OWNER|SYNCHRONIZE|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|EXECUTE|READ_ATTRIBUTES|WRITE_ATTRIBUTES, SYSTEM (allowed): DELETE|READ_CONTROL|WRITE_DAC|WRITE_OWNER|SYNCHRONIZE|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|EXECUTE|READ_ATTRIBUTES|WRITE_ATTRIBUTES, Authenticated Users (allowed): DELETE|READ_CONTROL|SYNCHRONIZE|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|EXECUTE|READ_ATTRIBUTES|WRITE_ATTRIBUTES, Users (allowed): READ_CONTROL|SYNCHRONIZE|READ_DATA|READ_EA|EXECUTE|READ_ATTRIBUTES
- Date: Thu Jul 23 16:57:59 2026
- Inode: 0
- User: Ali (S-1-5-21-3624353486-308272220-2052912969-17789)
- MD5: 7b9e0b0e02c5e3b2735c243304a78dbe
- SHA1: 7ea817db30fd67e8a9a24d3ae0fb5932f1d75abf
- SHA256: ae81814295cbf2aa4717fc86b6bc1c39647b51aad1c529d625f2210a6d897d95
- File attributes: ARCHIVE
That log i doesn't receive in real-time. Next day i show this
90% of endpoints works well, but some endpoints doesn't show real-time syscheck logs at current time. For example, last day it logs, but today doesn't have any scheduled and real-time, in fact that wazuh agents are active .
<!-- File integrity monitoring -->
<syscheck>
<disabled>no</disabled>
<!-- Frequency that syscheck is executed default every 12 hours -->
<frequency>43200</frequency>
<!-- Default files to be monitored. -->
<directories recursion_level="0" restrict="regedit.exe$|system.ini$|win.ini$">%WINDIR%</directories>
<directories recursion_level="0" restrict="at.exe$|attrib.exe$|cacls.exe$|cmd.exe$|eventcreate.exe$|ftp.exe$|lsass.exe$|net.exe$|net1.exe$|netsh.exe$|reg.exe$|regedt32.exe|regsvr32.exe|runas.exe|sc.exe|schtasks.exe|sethc.exe|subst.exe$">%WINDIR%\SysNative</directories>
<directories recursion_level="0">%WINDIR%\SysNative\drivers\etc</directories>
<directories recursion_level="0" restrict="WMIC.exe$">%WINDIR%\SysNative\wbem</directories>
<directories recursion_level="0" restrict="powershell.exe$">%WINDIR%\SysNative\WindowsPowerShell\v1.0</directories>
<directories recursion_level="0" restrict="winrm.vbs$">%WINDIR%\SysNative</directories>
<!-- 32-bit programs. -->
<directories recursion_level="0" restrict="at.exe$|attrib.exe$|cacls.exe$|cmd.exe$|eventcreate.exe$|ftp.exe$|lsass.exe$|net.exe$|net1.exe$|netsh.exe$|reg.exe$|regedit.exe$|regedt32.exe$|regsvr32.exe$|runas.exe$|sc.exe$|schtasks.exe$|sethc.exe$|subst.exe$">%WINDIR%\System32</directories>
<directories recursion_level="0">%WINDIR%\System32\drivers\etc</directories>
<directories recursion_level="0" restrict="WMIC.exe$">%WINDIR%\System32\wbem</directories>
<directories recursion_level="0" restrict="powershell.exe$">%WINDIR%\System32\WindowsPowerShell\v1.0</directories>
<directories recursion_level="0" restrict="winrm.vbs$">%WINDIR%\System32</directories>
<directories realtime="yes">%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup</directories>
<ignore>%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini</ignore>
<ignore type="sregex">.log$|.htm$|.jpg$|.png$|.chm$|.pnf$|.evtx$</ignore>
<!-- Windows registry entries to monitor. -->
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\batfile</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\cmdfile</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\comfile</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\exefile</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\piffile</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\AllFilesystemObjects</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\Directory</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Classes\Folder</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Classes\Protocols</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Policies</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Security</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\KnownDLLs</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\winreg</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce</windows_registry>
<windows_registry>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon</windows_registry>
<windows_registry arch="both">HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components</windows_registry>
<!-- Windows registry entries to ignore. -->
<registry_ignore>HKEY_LOCAL_MACHINE\Security\Policy\Secrets</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Security\SAM\Domains\Account\Users</registry_ignore>
<registry_ignore type="sregex">\Enum$</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\AppCs</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\DHCP</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\IPTLSIn</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\IPTLSOut</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\Teredo</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PolicyAgent\Parameters\Cache</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ADOVMPPackage\Final</registry_ignore>
<!-- Frequency for ACL checking (seconds) -->
<windows_audit_interval>60</windows_audit_interval>
<!-- Nice value for Syscheck module -->
<process_priority>10</process_priority>
<!-- Maximum output throughput -->
<max_eps>50</max_eps>
<!-- Database synchronization settings -->
<synchronization>
<enabled>yes</enabled>
<interval>5m</interval>
<max_eps>10</max_eps>
</synchronization>
</syscheck>
agent.conf:
<syscheck>
<disabled>no</disabled>
<frequency>43200</frequency>
<directories realtime="yes">D:\*\Desktop</directories>
<directories realtime="yes">D:\*\Documents</directories>
<directories realtime="yes">D:\*\Downloads</directories>
<directories realtime="yes">C:\Users\*\Downloads</directories>
<directories realtime="yes">C:\Windows\System32\drivers\etc\hosts</directories>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\batfile</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\cmdfile</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\piffile</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\AllFilesystemObjects</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\Folder</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\KnownDLLs</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\winreg</registry_ignore>
<synchronization>
<enabled>yes</enabled>
<interval>5m</interval>
<max_eps>10</max_eps>
</synchronization>
</syscheck>
Wazuh Notification.
2026 Jul 24 09:01:39
Received From: (Ali) any->syscheck
Rule: 100544 fired (level 16) -> "File added to the system."
Portion of the log(s):
File 'd:\ali\downloads\sample.pdf' added
Mode: scheduled
Attributes:
- Size: 123403
- Permissions: Administrators (allowed): DELETE|READ_CONTROL|WRITE_DAC|WRITE_OWNER|SYNCHRONIZE|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|EXECUTE|READ_ATTRIBUTES|WRITE_ATTRIBUTES, SYSTEM (allowed): DELETE|READ_CONTROL|WRITE_DAC|WRITE_OWNER|SYNCHRONIZE|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|EXECUTE|READ_ATTRIBUTES|WRITE_ATTRIBUTES, Authenticated Users (allowed): DELETE|READ_CONTROL|SYNCHRONIZE|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|EXECUTE|READ_ATTRIBUTES|WRITE_ATTRIBUTES, Users (allowed): READ_CONTROL|SYNCHRONIZE|READ_DATA|READ_EA|EXECUTE|READ_ATTRIBUTES
- Date: Thu Jul 23 16:57:59 2026
- Inode: 0
- User: Ali (S-1-5-21-3624353486-308272220-2052912969-17789)
- MD5: 7b9e0b0e02c5e3b2735c243304a78dbe
- SHA1: 7ea817db30fd67e8a9a24d3ae0fb5932f1d75abf
- SHA256: ae81814295cbf2aa4717fc86b6bc1c39647b51aad1c529d625f2210a6d897d95
- File attributes: ARCHIVE
That log i doesn't receive in real-time. Next day i show this
90% of endpoints works well, but some endpoints doesn't show real-time syscheck logs at current time. For example, last day it logs, but today doesn't have any scheduled and real-time, in fact that wazuh agents are active .
пятница, 24 июля 2026 г. в 15:09:24 UTC+4, Stuti Gupta:
Ali Melikov
Jul 24, 2026, 8:01:22 AM (21 hours ago) Jul 24
to Wazuh | Mailing List
Also i noticed this when agent does't move from one manager pr to another. I check files doesn't reach limit. when the endpoint turn off, next day syscheck ignore logging realtime activity.
Agent doesnt log any real-time activities at all in next day, It stuck on last day logs which is logged correctly. It affect all directories configured for real-time monitoring.
NOTE: My other endpoints logs all real-time activities in path which i monitor. I apply ossec and agent.conf to all endpoints
agent.conf:
<!-- File integrity monitoring -->
<syscheck>
<disabled>no</disabled>
<frequency>43200</frequency>
<directories realtime="yes">D:\*\Desktop</directories>
<directories realtime="yes">D:\*\Documents</directories>
<directories realtime="yes">D:\*\Downloads</directories>
<directories realtime="yes">C:\Users\*\Downloads</directories>
<directories realtime="yes">C:\Windows\System32\drivers\etc\hosts</directories>
<directories realtime="yes">D:\*\Desktop</directories>
<directories realtime="yes">D:\*\Documents</directories>
<directories realtime="yes">D:\*\Downloads</directories>
<directories realtime="yes">C:\Users\*\Downloads</directories>
<directories realtime="yes">C:\Windows\System32\drivers\etc\hosts</directories>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\batfile</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\cmdfile</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\piffile</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\AllFilesystemObjects</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Classes\Folder</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\KnownDLLs</registry_ignore>
<registry_ignore>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\winreg</registry_ignore>
<synchronization>
<enabled>yes</enabled>
<interval>5m</interval>
<max_eps>10</max_eps>
</synchronization>
</syscheck>
</agent_config>
пятница, 24 июля 2026 г. в 12:58:04 UTC+4, Stuti Gupta:
Reply all
Reply to author
Forward
0 new messages